2

Is it possible to write a shell script that checks connections in an apache server and blocks suspicious ip addresses with large number of connections automatically and fires a mail for it to the system administrator. Please Help.

I have also heard about fail2ban. Will it be convenient to use fail2ban or a shell script as shell script need to be run on regular time intervals. any comments?

4

3 Answers 3

3

As I was reading the first paragraph, I was thinking about fail2ban.

The biggest issue here is detecting a bad user. If you do that manually, skip fail2ban and use sudo ufw deny from 1.2.3.4. That will be a permanent block but there you go.

fail2ban works best when your system (any service, including a dynamic website) sends things to the logs (syslog or service specific). fail2ban then has a stack of things to look for and then what to do if it finds things.

For example, I'm currently employing a fail2ban plugin for Wordpress that sends events to syslog. fail2ban detects three incorrect tries and then blocks the IP for five minutes. It's genius stuff that has pretty much entirely blocked brute force attacks. I mention that plugin as it's a good example of a simple custom-written ruleset. It's easy to see how it works and adapt it for your own needs.

Email notification is pretty simple but you can go further and email nmap scans back. Thinking about it, it might be worth running the IP through a whois, extracting the abuse email and automatically sending an abuse report when you ban a user (explaining why).

2
  • Thanks for the reply. Can there be a script that checks the number of connections from a particular ip. If it gets exceeded from a given number than it blocks that ip.
    – Tarun
    Jun 26, 2013 at 13:25
  • @Tarun As I say, if you can get something to log an event, you can direct fail2ban to detect a number of logged instances within a timeframe. But if you just want to rate-limit connections, you can do this more efficiently from within iptables: debian-administration.org/articles/187 (note you'll need to run that on boot - iptables won't remember it on its own
    – Oli
    Jun 26, 2013 at 13:31
0

fail2ban will do exactly what you have described.

It checks for connections wich try to connect too often. You can do some configurations with fail2ban to check different situations an ban an IP-adress for a specific time or forever. And of course it can send you a mail report.

I'm using it with logcheck wich gives me a better readable output of the fail2ban messages.

0

You can also use AIPA (https://aipa.elineo.eu) to block IP listed on blacklists as abuseipdb.com, blocklist.de or myip.ms

1
  • 1
    Welcome to Ask Ubuntu! I recommend to edit this answer to expand it with specific details about how to do this. (See also How do I write a good answer? for general advice about what sorts of answers are considered most valuable on Ask Ubuntu.) P.S.: Your post looks a bit spammy due to the product promotion, lack of detail, and novelty of your account. Feb 4, 2018 at 22:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.