Script that will automatically add entries to the iptables file

kaplan71 · 12-10-2007, 12:00 PM

Hi there --

I have the iptables firewall running on one of our systems, and I currently manually add the ip addresses of suspected hack attacks to it. I get the addresses in question via the daily logwatch output file.

Is there a script available that will automatically do this procedure when the hack attack occurs? Thanks.

unSpawn · 12-10-2007, 01:25 PM

Guardian, PSAD, Hogwash would be "better" choices for automating this.

marozsas · 12-10-2007, 02:34 PM

Let me add to unSpawn's list, the program fail2ban (http://fail2ban.sourceforge.net/) which I am using even in the servers to temporary add an iptables rule (and to remove it after a configurable delay), for blocking consecutive login failures in services like ftp, ssh and in some web pages (apache).