This is script /usr/local/sbin/block_sip_ip.sh. It has some options, but i doubt if you really need all of them
you can just add it to your crontab:
*/3 * * * * /usr/local/sbin/block_sip_ip.sh -n 1000
where
-n 1000 - amount of las lines of asterisk log to parse. You need to adjust that part accordingly of intensity of your calls. by default its only 200 lines.
-q - how many attempts allowed before IP will be banned. 3 by default
you can just add it to your crontab:
*/3 * * * * /usr/local/sbin/block_sip_ip.sh -n 1000
where
-n 1000 - amount of las lines of asterisk log to parse. You need to adjust that part accordingly of intensity of your calls. by default its only 200 lines.
-q - how many attempts allowed before IP will be banned. 3 by default
#!/bin/bash
# checking, is someone is getting "wrong password" in last 200 lines of asterisk log:
DEBUG=0
# email to notify about banned IPs
ADMIN_EMAIL="admin@domain.com"
# our internal network. First part only
LOCAL_NET="10.0.0"
# our own external IP:
OWNIP1="111.221.211.111"
LINES=200
INFO="Use: $0 -l /PATH/TO/LOG -q ATTEMPTS -n LINES"
while getopts ":dl:q:n:" optname
do
case "$optname" in
"d")
DEBUG=1
echo "debugging is on"
;;
"n")
LINES=$OPTARG
;;
"l")
LOG_FILE=$OPTARG
;;
"q")
ATTEMPTS=$OPTARG
;;
"?")
echo "Unknown option $OPTARG"
echo $INFO
exit 0
;;
":")
echo "No argument value for option $OPTARG"
echo $INFO
exit 0
;;
*)
echo "Unknown error while processing options"
exit 0
;;
esac
done
if [ -z "$LOG_FILE" ]
then
LOG_FILE="/var/log/sip_hackers_ips"
fi
[ "$DEBUG" -eq 1 ] && echo "logfile : $LOG_FILE"
[ "$DEBUG" -eq 1 ] && echo "lines : $LINES"
if [ -z "$ATTEMPTS" ]
then
ATTEMPTS=2
fi
[ "$DEBUG" -eq 1 ] && echo "failed ext. allowed : $ATTEMPTS"
for i in `tail -$LINES /var/log/asterisk/full | grep -v $LOCAL_NET | grep -E '(Wrong password| failed for )' | grep -Eo '(([0-9]{1,3}\.){3}[0-9]{1,3})' | sort | uniq | grep -v "$OWNIP1"`
do
# checking amount of attempted extensions
EXT_CNT=$(tail -$LINES /var/log/asterisk/full | grep -oc "$i")
# if its geater than 3, block it!!
if [ "$EXT_CNT" -gt "$ATTEMPTS" ];
then
IPTABLES_CNT=$(/sbin/iptables -nvL | grep -c $i);
if [ "$IPTABLES_CNT" -eq 0 ];
then
[ "$DEBUG" -eq 1 ] && echo "To BLOCK: $i";
echo -n "[`date`]">> $LOG_FILE
echo $i >> $LOG_FILE
/sbin/iptables -I INPUT -s $i -j DROP
/sbin/iptables -A OUTPUT -d $i -j DROP
[ "$DEBUG" -eq 1 ] && echo "IP $i has been blocked"
echo "VPBX: $i has been blocked" | mail -s "VPBX: $i has been blocked" $ADMIN_EMAIL
fi
fi
done
