60 lines
2.1 KiB
Bash
Executable File
60 lines
2.1 KiB
Bash
Executable File
#!/bin/bash
|
|
MAIL=/tmp/mail
|
|
SERVER_LOG=/var/log/nginx
|
|
HOST=($(cat /etc/sentinel/virtualhost))
|
|
BLACKLIST=/etc/sentinel/blacklist
|
|
EXCLUDE=/etc/sentinel/exclude
|
|
SENDER=/etc/sentinel/ip
|
|
SSH=$(cat /etc/sentinel/ssh_port)
|
|
IP=$(hostname -I |awk '{print $1}')
|
|
chain_count=$(/usr/sbin/iptables -L BLACKLIST -n | wc -l)
|
|
if [ ${chain_count} -eq 0 ]; then
|
|
bash /usr/local/bin/sentinel/refill_blacklist.sh
|
|
fi
|
|
|
|
list_sender=($(cat ${SENDER}))
|
|
|
|
for i in ${list_sender[@]}
|
|
do
|
|
if [ -f /tmp/blacklist_${i} ]; then
|
|
count_ip=$(cat ${BLACKLIST} /tmp/blacklist_${i} |grep -f ${EXCLUDE} -v |sort |uniq -ui |wc -l)
|
|
cat ${BLACKLIST} /tmp/blacklist_${i} |grep -f ${EXCLUDE} -v |sort |uniq -u >> ${BLACKLIST}
|
|
if [ ${count_ip} -ne 0 ]; then
|
|
bash /usr/local/bin/sentinel/refill_blacklist.sh
|
|
fi
|
|
fi
|
|
done
|
|
|
|
for i in ${HOST[@]}
|
|
do
|
|
log_access=${SERVER_LOG}/${i}_access.log
|
|
tail -n 50 $log_access | awk -F "|" '{ if($2 == "400" || $2 == "404") print $0}' > /tmp/error_$i
|
|
cat /tmp/error_$i | awk -F "|" '{ if($2 == "404") print $1}' > /tmp/404_$i
|
|
cat /tmp/error_$i | awk -F "|" '{ if($2 == "400") print $1}' > /tmp/400_$i
|
|
cat /tmp/404_$i | sort | uniq -c | awk '{ if($1 >= 5) print $2}' > /tmp/blacklist_404
|
|
cat /tmp/400_$i |sort | uniq -c |awk '{ if($1 >= 5) print $2}' > /tmp/blacklist_400
|
|
count=$(cat /tmp/blacklist_404 /tmp/blacklist_400 |grep -f ${BLACKLIST} -v |grep -f ${EXCLUDE} -v |sort |uniq |wc -l)
|
|
if [ ${count} -ne 0 ]; then
|
|
echo "Nouvelle IP blacklisté" > ${MAIL}
|
|
list_ip=($(cat /tmp/blacklist_400 /tmp/blacklist_404 |grep -f ${BLACKLIST} -v |grep -f ${EXCLUDE} -v |sort |uniq))
|
|
for j in ${list_ip[@]}
|
|
do
|
|
echo ${j} >> ${MAIL}
|
|
curl http://ipinfo.io/${j} >> ${MAIL}
|
|
echo "" >> ${MAIL}
|
|
cat /tmp/error_$i | grep ${j} >> ${MAIL}
|
|
echo "" >> ${MAIL}
|
|
echo ${j} >> ${BLACKLIST}
|
|
/usr/sbin/iptables -A BLACKLIST -s ${j} -j DROP
|
|
done
|
|
for j in ${list_sender}
|
|
do
|
|
scp -i /home/valentin/.ssh-blacklist/id_rsa -P ${SSH} ${BLACKLIST} blacklist_user@${j}:/tmp/blacklist_${IP}
|
|
done
|
|
echo "IP dejà blacklisté : " >> ${MAIL}
|
|
cat ${BLACKLIST} >> ${MAIL}
|
|
cat ${MAIL} |mail -s "Blacklist IP ${i}" valczebackup@gmail.com
|
|
fi
|
|
done
|
|
|