Last active
October 1, 2019 02:56
-
-
Save macielportugal/bc22c03d345dc2b19f8d6212986c0e74 to your computer and use it in GitHub Desktop.
Script para bloquear ips que tenta logar no servidor Asterisk com senha inválida
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| logFile="/var/log/asterisk/messages" | |
| debugFile="/var/log/asterisk/ips-bloqueados.log" | |
| attempts=3 | |
| whitelist="127.0.0.1" | |
| name=`basename $0` | |
| checkIsScriptRunning=$(ps | grep $name | grep -v grep | wc -l) | |
| if [ $checkIsScriptRunning -ge 3 ]; then | |
| echo "Script ja rodando" | |
| exit | |
| fi | |
| echo "Start `date`" >> $debugFile | |
| declare -A ipList | |
| tail -f $logFile | grep --line-buffered -E "Wrong password|ChallengeSent|SuccessfulAuth" | while read result | |
| do | |
| #echo "$result" | |
| if [[ $result == *"SuccessfulAuth"* ]]; then | |
| ip=$(echo $result | sed -e "s/.*UDP\///g" | sed -e "s/\/.*//g"); | |
| echo "sucesso $ip" | |
| unset ipList["$ip"] | |
| else | |
| if [[ $result == *"ChallengeSent"* ]]; then | |
| ip=$(echo $result | sed -e "s/.*UDP\///g" | sed -e "s/\/.*//g"); | |
| else | |
| ip=$(echo $result | sed -e "s/.*failed for '//g" | sed -e "s/:.*//g"); | |
| fi | |
| if [[ $whitelist != *"$ip"* ]]; then | |
| echo "$ip na whitelist" | |
| if [ -z ${ipList["$ip"]} ]; then | |
| echo "Não existe na lista de ips" | |
| ipList["$ip"]=1 | |
| else | |
| echo "Existe na lista de ips" | |
| ipList["$ip"]=$((${ipList["$ip"]} + 1)) | |
| fi | |
| echo "Numero de tentativas de login ${ipList["$ip"]}" | |
| if [ ${ipList["$ip"]} -ge $attempts ]; then | |
| echo "Block ${ip}" | |
| iptables -A INPUT -s ${ip} -j DROP | |
| echo "Block ${ip}" >> $debugFile | |
| unset ipList["$ip"] | |
| fi | |
| fi | |
| fi | |
| done |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment