Bot Block - Revision history

Smsldoo at 14:31, 25 March 2014

2014-03-25T14:31:45Z

Smsldoo at 17:41, 17 February 2012

2012-02-17T17:41:46Z

Smsldoo: /* Block By User Agent */

2011-08-27T17:22:20Z

‎Block By User Agent

Smsldoo: /* Block By Agent Length */

2011-08-27T13:55:33Z

‎Block By Agent Length

Smsldoo: /* Block By User Agent */

2011-08-27T13:54:18Z

‎Block By User Agent

Smsldoo: /* Block By Agent Length */

2011-08-17T12:14:20Z

‎Block By Agent Length

Smsldoo: /* Block By User Agent */

2011-08-17T12:06:05Z

‎Block By User Agent

Smsldoo: /* Block By User Agent */

2011-07-07T15:55:55Z

‎Block By User Agent

Smsldoo: /* Block By User Agent */

2011-07-07T15:36:00Z

‎Block By User Agent

Smsldoo: /* Block By User Agent */

2011-07-07T15:32:21Z

‎Block By User Agent

@@ Line 6: / Line 6: @@
 ===Get Top User Agents===
 Get a list of top user agents (bot nets will only have a few and there will be tons of hits)
-<code>[bash,n]
+<source lang='bash'>
 tail -1000 <DOMLOGFILE> | cut -d '"' -f6 | sort | uniq -c | sort -n
-</code>
+</source>
 or
-<code>[bash,n]
+<source lang='bash'>
 cat <DOMLOGFILE> | cut -d '"' -f6 | sort | uniq -c | sort -n
-</code>
+</source>
 ===Block By User Agent===
 Block those user agents
-<code>[bash,n]
+<source lang='bash'>
 #!/bin/bash
@@ Line 178: / Line 178: @@
    esac
-</code>
+</source>
 ===Block By Agent Length===
-<code>[bash,n]
+<source lang='bash'>
 #!/bin/bash
 loglines=1000
@@ Line 331: / Line 331: @@
                  ;;
    esac
-</code>
+</source>
 ==What to change==

← Older revision		Revision as of 17:41, 17 February 2012
Line 1:		Line 1:
		+	[[Category:Scripts]]
	==Overview==		==Overview==

@@ Line 120: / Line 120: @@
          grep Botnet /etc/apf/deny_hosts.rules | cut -d "(" -f2-3 | sort | uniq -c | sort -n
 return
+}
@@ Line 142: / Line 154: @@
          --blockcount)
                  blockcount
                  ;;
          --help)
@@ Line 154: / Line 169: @@
                  echo " --blockcount"
                  echo "  Return number of current blocks per user agent"
                  ;;
          *)

@@ Line 201: / Line 201: @@
 	do
 		plog "Attempting to block $i"
 		plog "`/usr/sbin/csf -d $i Botnet 2>&1`"
 	done

@@ Line 47: / Line 47: @@
                  do
                          plog "Attempting to block $i ${useragents[$u]}"
-                         plog "`/usr/local/sbin/apf -d $i "RU Botnet IP (${useragents[$u]})" 2>&1`"
+                         plog "`/usr/local/sbin/apf -d $i "RU Botnet IP (${useragents[$u]})" 2>&1`"   ########APF FIREWALL
                  done
          done
@@ Line 108: / Line 109: @@
                  tail -$loglines $2 | cut -d '"' -f6 | sort | uniq -c | sort -n
          elif [ -e "/usr/local/apache/domlogs/$2" ]
                  tail -$loglines /usr/local/apache/domlogs/$2 | cut -d '"' -f6 | sort | uniq -c | sort -n
          else
@@ Line 138: / Line 140: @@
                  scanlog
                  ;;
-         --blockcount
+         --blockcount)
                  blockcount
          --help)
                  echo "Check for bots based on user agent and block in firewall:"

@@ Line 195: / Line 195: @@
 #                done
 #        done
-	for i in $(echo "$logperiod" | grep "GET / HTTP/1.1" | grep -E '"[a-zA-Z0-9]{10}"$')
+	for i in $(echo "$logperiod" | grep "GET / HTTP/1.1" | grep -E '"[a-zA-Z0-9]{10}"$' | awk '{ print $1 }')
 	do
-		ip=`echo "$i" | awk '{ print $1 }'`
+		plog "Attempting to block $i"
-		useragent=`echo "$i" | rev | awk '{ print $1 }' | rev`
+		plog "`/usr/sbin/csf -d $i Botnet 2>&1`"
 	done
@@ Line 311: / Line 309: @@
                  ;;
    esac
-</script>
+</code>
 ==What to change==

← Older revision		Revision as of 12:06, 17 August 2011
Line 158:		Line 158:

	</code>		</code>
		+
		+	===Block By Agent Length===
		+	<code>[bash,n]
		+	#!/bin/bash
		+	loglines=1000
		+	logperiod=`tail -$loglines /usr/local/apache/domlogs/abzocke.derblog.net`
		+	logrotate=10000
		+	logdelete=100
		+	#useragents[0]='Opera/9.02 (Windows NT 5.1; U; ru)'
		+	#useragents[1]='Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)'
		+	#useragents[2]='Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1'
		+
		+	function plog {
		+	echo "[ `date` ] $1" >> /var/log/botblock
		+	if [ "`wc -l /var/log/botblock \| awk '{print $1}'`" -gt "$logrotate" ]
		+	then
		+	sed -i -e "`echo $logdelete`d" /var/log/botblock
		+	fi
		+	return
		+	}
		+
		+	function botblock {
		+	touch /var/run/.botblock
		+	echo $$ > /var/run/.botblock
		+
		+
		+
		+	agentlen=${#useragents[@]}
		+
		+	# for (( u=0; u<${agentlen}; u++));
		+	# do
		+	# for i in $(echo "$logperiod" \| grep "GET /" \| grep "${useragents[$u]}" \| cut -d " " -f1 \| sort \| uniq \| sort)
		+	# do
		+	# plog "Attempting to block $i ${useragents[$u]}"
		+	# plog "`/usr/local/sbin/apf -d $i "RU Botnet IP (${useragents[$u]})" 2>&1`"
		+	# done
		+	# done
		+	for i in $(echo "$logperiod" \| grep "GET / HTTP/1.1" \| grep -E '"[a-zA-Z0-9]{10}"$')
		+	do
		+	ip=`echo "$i" \| awk '{ print $1 }'`
		+	useragent=`echo "$i" \| rev \| awk '{ print $1 }' \| rev`
		+	plog "Attempting to block $ip $useragent"
		+	plog "`/usr/sbin/csf -d $ip Botnet: $useragent 2>&1`"
		+	done
		+
		+	rm -f /var/run/.botblock
		+	}
		+
		+	function checkbots {
		+	if [ ! -e "/var/run/.botblock" ]
		+	then
		+	botblock
		+	else
		+	plog "Lock file found, script may be already running"
		+	opid=`cat /var/run/.botblock`
		+	if [ ! "`ps ax \| grep $opid \| grep ${0##*/}`" ]
		+	then
		+	plog "PID not active or not owned by script, clearing pid file"
		+	rm -f /var/run/.botblock
		+	botblock
		+	else
		+	plog "Script already running, PID active"
		+	fi
		+	fi
		+	}
		+
		+	function enablecron {
		+	if [ -e "/etc/cron.d/botblock.sh" ]
		+	then
		+	echo "Cron already enabled, use change to set new time"
		+	else
		+	echo "What time would you like to set the cron to"
		+	echo "[IE: * * * * * ]"
		+	read crontime;
		+	if [ ! $crontime ]
		+	then
		+	crontime="* * * * *"
		+	fi
		+	echo "SHELL=/bin/bash" > /etc/cron.d/botblock.sh
		+	echo "$crontime root $(readlink -f $0)" >> /etc/cron.d/botblock.sh
		+	chmod 0644 /etc/cron.d/botblock.sh
		+	echo "Cron enabled [$crontime root $(readlink -f $0)]"
		+	return
		+	fi
		+	return
		+	}
		+
		+	function disablecron {
		+	if [ -e "/etc/cron.d/botblock.sh" ]
		+	then
		+	rm -f /etc/cron.d/botblock.sh
		+	echo "Cron disabled"
		+	else
		+	echo "Cron not enabled"
		+	fi
		+	return
		+	}
		+
		+	function scanlog {
		+	if [ -e "$2" ]
		+	then
		+	tail -$loglines $2 \| cut -d '"' -f6 \| sort \| uniq -c \| sort -n
		+	elif [ -e "/usr/local/apache/domlogs/$2" ]
		+	then
		+	tail -$loglines /usr/local/apache/domlogs/$2 \| cut -d '"' -f6 \| sort \| uniq -c \| sort -n
		+	else
		+	echo "$2 - Log file not found"
		+	fi
		+	return
		+	}
		+
		+	function blockcount {
		+	grep Botnet /etc/apf/deny_hosts.rules \| cut -d "(" -f2-3 \| sort \| uniq -c \| sort -n
		+	return
		+	}
		+
		+	case $1 in
		+	--cron)
		+	case $2 in
		+	on)
		+	enablecron
		+	;;
		+	off)
		+	disablecron
		+	;;
		+	change)
		+	disablecron
		+	enablecron
		+	;;
		+	esac
		+	;;
		+	--scanlog)
		+	scanlog
		+	;;
		+	--blockcount)
		+	blockcount
		+	;;
		+	--help)
		+	echo "Check for bots based on user agent and block in firewall:"
		+	echo " --cron [on, change, off]"
		+	echo " on: Turns on cron job and asks for time"
		+	echo " change: Changes the cron time"
		+	echo " off: Turns off the cron job"
		+	echo ""
		+	echo " --scanlog [domlog to scan]"
		+	echo " Scan a log file and return user agents"
		+	echo " --blockcount"
		+	echo " Return number of current blocks per user agent"
		+	;;
		+	*)
		+	checkbots
		+	;;
		+	esac
		+	</script>

	==What to change==		==What to change==

@@ Line 17: / Line 17: @@
 #!/bin/bash
-logperiod=`tail -1000 <DOMLOG WITH FULL PATH>`
+loglines=1000
 logrotate=10000
 logdelete=100
@@ Line 102: / Line 103: @@
+}
 case $1 in
@@ Line 118: / Line 135: @@
 		esac
                  ;;
          --help)
                  echo "Check for bots based on user agent and block in firewall:"
@@ Line 124: / Line 146: @@
 		echo "	change: Changes the cron time"
 		echo "	off: Turns off the cron job"
                  ;;
          *)

@@ Line 52: / Line 52: @@
+}
-if [ ! -e "/var/run/.botblock" ]
+function checkbots {
-then
+        if [ ! -e "/var/run/.botblock" ]
          then
                  botblock
          else
-                 plog "Script already running, PID active"
+                 plog "Lock file found, script may be already running"
          fi
-fi
 </code>
 ==What to change==

@@ Line 15: / Line 15: @@
 Block those user agents
 <code>[bash,n]
 #!/bin/bash
-logperiod=`tail -1000 <FULL DOMLOG FILE>`
+logperiod=`tail -1000 <DOMLOG WITH FULL PATH>`
 logrotate=10000
 useragents[0]='Opera/9.02 (Windows NT 5.1; U; ru)'
 useragents[1]='Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)'
@@ Line 23: / Line 25: @@
 function plog {
-         echo "[ `date` ] $1" >> /var/log/rubotblock
+         echo "[ `date` ] $1" >> /var/log/botblock
-         if [ "`wc -l /var/log/rubotblock | awk '{print $1}'`" -gt "$logrotate" ]
+         if [ "`wc -l /var/log/botblock | awk '{print $1}'`" -gt "$logrotate" ]
          then
-                 sed -i -e "1d" /var/log/rubotblock
+                 sed -i -e "`echo $logdelete`d" /var/log/botblock
          fi
          return
@@ Line 32: / Line 34: @@
 function botblock {
-agentlen=${#useragents[@]}
+        touch /var/run/.botblock
-for (( u=0; u<${agentlen}; u++));
+        agentlen=${#useragents[@]}
+}
-if [ ! -e "/var/run/.rubotblock" ]
+if [ ! -e "/var/run/.botblock" ]
 then
          botblock
 else
-         plog "Lock file found, may be already running"
+         plog "Lock file found, script may be already running"
-         opid=`cat /var/run/.rubotblock`
+         opid=`cat /var/run/.botblock`
          if [ ! "`ps ax | grep $opid | grep ${0##*/}`" ]
          then
-                 plog "PID not active or not owned by script, removing lock file"
+                 plog "PID not active or not owned by script, clearing pid file"
-                 rm -f /var/run/.rubotblock
+                 rm -f /var/run/.botblock
                  botblock
          else
-                 plog "Script already running, pid is not stale"
+                 plog "Script already running, PID active"
          fi
 fi
 </code>
 ==What to change==