#!/bin/bash

# Update ban list: Useful as a cron task.
# This script updates the hosts.deny file and adds an iptable deny entry with 
# all those IP subdomains that attempted to connect using an invalid user ID. 
# If a hacker attempts to use the same IP subnet ###.###.###.* (/24), they will 
# be blocked.
# Note: IP Addresses that match the subnet of the server are not banned

# By Antony Booth, March 2005

declare -a inList;
declare -a outArray;


outFile="/etc/hosts.deny";
logFile="/var/log/secure";
iptables="/sbin/iptables";
save="/sbin/iptables-save";

# This should be used with 'iptables-restore' in a startup script in /etc/init.d
# E.G: iptables-restore -n /etc/sysconfig/iptables
dataFile="/etc/sysconfig/iptables";

# For getting first 3 parts (/24) of the dotted quad 255.255.255.*
regExp="^(25[0-5]|2[0-4][0-9]|[0-1]{1}[0-9]{2}|[1-9]{1}[0-9]{1}|[1-9])\.(25[0-5]
|2[0-4][0-9]|[0-1]{1}[0-9]{2}|[1-9]{1}[0-9]{1}|[1-9]|0)\.(25[0-5]|2[0-4][0-9]|[0
-1]{1}[0-9]{2}|[1-9]{1}[0-9]{1}|[1-9]|0)\.";

# Get Local /24 domain
localDomain=`hostname -i | egrep -o ${regExp}`;

# Add the ip addresses in list inList to outArray if they're not
# already there.
function groupAddresses()
{
    # iterate the list of addresses found
    for i in "${inList[@]}"; do
        found=0;
        thisIp=`echo "${i}" | egrep -o "${regExp}"`;
        if [ "${thisIp}" != "" ]; then

           # Exclude local domain
            if [ "${thisIp}" = "${localDomain}" ]; then
               found=1;
            fi;
            # Check to see if current IP subdomain is already in the list
            if [ "`echo ${outArray[@]} | egrep -o ${thisIp}`" != "" ]; then
               found=1;
            fi;
            # Not found in list, so add it
            if [ $found -ne 1 ]; then
                outArray[${#outArray[@]}]="${thisIp}";
            fi;
        fi;
    done;
}

# get all the ip addresses using invalid user accounts
inList=(`cat ${logFile} | gawk '/illegal user/ {printf("%s ", $13)}'`);
groupAddresses;
logArray=(${outArray[@]});

unset outArray;
declare -a outArray;

# get the existing subnets from the deny list
inList=(`cat ${outFile} | gawk -F":" '/ALL/ {printf("%s ", $2)}'`);
groupAddresses;

declare -a newDomains;
for i in "${logArray[@]}"; do
    if [ "`echo ${outArray[@]} | egrep -o ${i}`" = "" ]; then
        newDomains[${#newDomains[@]}]="${i}";
    fi;
done;

# set this to 1 if you don't want a date stamp added to the hosts.deny file
label=0;

# Append the list of new banned domains to deny file and IPtables
for i in "${newDomains[@]}"; do
    if [ $label -ne 1 ]; then
        echo "# `date`" >> ${outFile};
        label=1;
    fi;
    echo "ALL:${i}" >> ${outFile};
    rule="-A INPUT -s ${i}0/24 -j DROP";
    # save rule to file and apply now
    $iptables ${rule};
    $save > ${dataFile};
done;