From 0bde1ce7c4ae55f9f3807d34a9671b3cdfbcba57 Mon Sep 17 00:00:00 2001 From: Valentin CZERYBA Date: Sun, 12 Mar 2023 22:36:59 +0100 Subject: [PATCH] multi-clustering blacklist --- inventory/host_vars/vps-host | 64 +++++++++++++---------- roles/deploy-web/files/blacklist.sh | 21 +++++++- roles/deploy-web/templates/exclude.j2 | 3 ++ roles/deploy-web/templates/ip.j2 | 3 ++ roles/deploy-web/templates/ssh_port.j2 | 1 + roles/deploy-web/templates/virtualhost.j2 | 2 +- 6 files changed, 63 insertions(+), 31 deletions(-) create mode 100644 roles/deploy-web/templates/exclude.j2 create mode 100644 roles/deploy-web/templates/ip.j2 create mode 100644 roles/deploy-web/templates/ssh_port.j2 diff --git a/inventory/host_vars/vps-host b/inventory/host_vars/vps-host index b10ad15..c8fc87c 100644 --- a/inventory/host_vars/vps-host +++ b/inventory/host_vars/vps-host @@ -1,30 +1,36 @@ $ANSIBLE_VAULT;1.1;AES256 -33636162336330363833666465326430326230353032643365623263306139346138363135316462 -6232623366616434333833333630663435333237306563630a333065363335653361613135316131 -38346464653533633062636534303937366534383064376232336635663665323163386566336465 -3037636164626361390a373963346334616232323639353561306631333834613964363635626330 -62633139383230373063313136383534653230323038313762323430393164616534363836376333 -30303662613534333631393031303165376435363831323636316561336530393963313465356164 -37386462643361363265326230393465313536343533646437393634663663663862643033323966 -34396162613134343738343861666663643338363136383262666263623933316435323135656331 -30373134376565633662646365636464663562636666303061653664633138326139373737303163 -30613561366233333264336562633837393239626462633238323564386332613861323266643733 -37653764646637313631326365373935313762393934663234326362393762313434663366663165 -62313036373732383739666166626631353738323830636234383430313539666433643139346232 -39626462613537363263343166663038346338383863343334656433396238346330653938373139 -39373265373961303763613962353762303735323966373762616462643433353162623136656130 -34666362373638303635313833663133623431353230386266653962646163646665333334646661 -38663634346461663430623235623138666563343739643432366635653331663233366136353666 -35393765346362663561633064356364623737353862353334386638306362363362386663663636 -37663731356664396330663862623965343237643066663031336338313937363461343264633534 -39613230373964663462656664656161623939656361336532383530303030666264323439623231 -65643430643433643239333338646363343933373934353435646337333238663239613539333862 -33333130386239303738366262386562323261653334356238646132313861396661633937353630 -65643064383036623035313766346636636264653265666232343837343033646466623066663932 -37313366363064613662383938663965633865326333323264363730666635316533393331643362 -64373661303761633862613237363430346134346237633736326139363963656239393162616432 -31663437333434626536353164663234353164623265623538303031333833646438616265306633 -38346535366531323032313232656533613431313133373561343465616266306634656237333038 -65633134656132623238363136623934346235316336326136613863626564396339646265323262 -65313239353737656231383664656431343239363730666362376532663835643337666664393738 -6131 +65333737373761626438343263333163623934626161313738303239383134333133313661333739 +3765666232653562383861643033356535383230613564330a343931393265303332346339373161 +31653534646463333138633564663238323664313432343666613633353538323530323631326665 +3133303461303966310a626664396637313532313666386236303765613530343863636636346334 +33633536656337643962663564656465666636623734376162366233643431343966373737613064 +62336665386635316433636166353263356131383632616665643935616131333230343965613834 +63323363616535363437306362613934633533386438353466353138386438313063316565616636 +66643535356364396230653032643661316534356266333035323766306165383562653836313532 +31396432316564633933363338393535363937386533343137373664366538323836343038313062 +61383630386233313034353966383265333735303064333535643738633362336362323565326131 +66666565376663383733616136386462353937613364653932353062386665623439613933366535 +61343134323031343133626265336231306131376661396163333939643561356363306333666637 +64353137643238653562643034383262356266366636333135616262643436363638666166336565 +63346131346238666166303338303264363634373635663830663636656661303935623239346339 +33306564313566343339626362333735343737333763616330303266353836303438323131306161 +61303633636335636335383734326638663238313961653561613164333865383364323234383133 +65626130376434343165373531643935616431316631636165323365376564646535613534616237 +65303430373336383436373162376536376563623730343237366435653163613337303538643062 +66643361613732366431336231363133326435623361663366646537386433613262326161303966 +39363732653361646534653866326436666462346235376664623039343431373938666266313034 +62373639323039656266623562326634633131623964313666646463383064303266643162636362 +35646563623533303466636631646339626464306665383266643839653734373465313538363035 +33313762313934396137323433313238393239623831663430396530303764336338356366646264 +36393038633033303066346339663939653964333735303465626139613464313437356264373562 +34376230333834373831363661636461383763383138653537383235343132623830326532393564 +61646265303835306534346433303138306632306163613336393834313337306233376665313262 +35396630666162373432313939646537666335343835613363653334313234356564373431366537 +37323838323835386538343261633762303035336665656638636165303130343733633766656333 +33623861633664626232316434326138303539363130333561323630393932363735363362663832 +64393965346131396236653864323930633763303435613330386236633164636465646664396530 +35343838323364643236383334663432316339613231613030643935333932633732313635633164 +63663861323663613931636238313862326364396538616463376533396136653266393136663265 +65613862333066643030656263333534343161613638356264663635643430356563313561633535 +30303165663931633761363633383237333765383332363962353530313036346561383539643966 +336562336464303538313234386162383165 diff --git a/roles/deploy-web/files/blacklist.sh b/roles/deploy-web/files/blacklist.sh index d63169c..e93482a 100755 --- a/roles/deploy-web/files/blacklist.sh +++ b/roles/deploy-web/files/blacklist.sh @@ -4,12 +4,27 @@ SERVER_LOG=/var/log/nginx HOST=($(cat /etc/sentinel/virtualhost)) BLACKLIST=/etc/sentinel/blacklist EXCLUDE=/etc/sentinel/exclude - +SENDER=/etc/sentinel/ip +SSH=$(cat /etc/sentinel/ssh_port) +IP=$(hostname -I |awk '{print $1}') chain_count=$(/usr/sbin/iptables -L BLACKLIST -n | wc -l) if [ ${chain_count} -eq 0 ]; then bash /usr/local/bin/sentinel/refill_blacklist.sh fi +list_sender=($(cat ${SENDER})) + +for i in ${list_sender[@]} +do + if [ -f /tmp/blacklist_${i} ]; then + count_ip=$(cat ${BLACKLIST} /tmp/blacklist_${i} |grep -f ${EXCLUDE} -v |sort |uniq -ui |wc -l) + cat ${BLACKLIST} /tmp/blacklist_${i} |grep -f ${EXCLUDE} -v |sort |uniq -u >> ${BLACKLIST} + if [ ${count_ip} -ne 0 ]; then + bash /usr/local/bin/sentinel/refill_blacklist.sh + fi + fi +done + for i in ${HOST[@]} do log_access=${SERVER_LOG}/${i}_access.log @@ -32,6 +47,10 @@ do echo ${j} >> ${BLACKLIST} /usr/sbin/iptables -A BLACKLIST -s ${j} -j DROP done + for j in ${list_sender} + do + scp -i /home/valentin/.ssh-blacklist/id_rsa -P ${SSH} ${BLACKLIST} blacklist_user@${j}:/tmp/blacklist_${IP} + done echo "IP dejà blacklisté : " >> ${MAIL} cat ${BLACKLIST} >> ${MAIL} cat ${MAIL} |mail -s "Blacklist IP ${i}" valczebackup@gmail.com diff --git a/roles/deploy-web/templates/exclude.j2 b/roles/deploy-web/templates/exclude.j2 new file mode 100644 index 0000000..661ce34 --- /dev/null +++ b/roles/deploy-web/templates/exclude.j2 @@ -0,0 +1,3 @@ +{% for host in ip_exclude_blacklist %} +{{ host }} +{% endfor %} diff --git a/roles/deploy-web/templates/ip.j2 b/roles/deploy-web/templates/ip.j2 new file mode 100644 index 0000000..d044287 --- /dev/null +++ b/roles/deploy-web/templates/ip.j2 @@ -0,0 +1,3 @@ +{% for host in ip_sender_blacklist %} +{{ host }} +{% endfor %} diff --git a/roles/deploy-web/templates/ssh_port.j2 b/roles/deploy-web/templates/ssh_port.j2 new file mode 100644 index 0000000..414400a --- /dev/null +++ b/roles/deploy-web/templates/ssh_port.j2 @@ -0,0 +1 @@ +{{ ssh_port_blacklist }} \ No newline at end of file diff --git a/roles/deploy-web/templates/virtualhost.j2 b/roles/deploy-web/templates/virtualhost.j2 index 8ca5a18..75fcf0d 100644 --- a/roles/deploy-web/templates/virtualhost.j2 +++ b/roles/deploy-web/templates/virtualhost.j2 @@ -1,3 +1,3 @@ {% for host in virtualhosts %} - {{ host }} +{{ host }} {% endfor %}