scan_logs_bruteforce - Add bad guys to brute force table

expire_bruteforce.sh

#!/bin/sh

# Add to crontab
# @hourly					sleep $((RANDOM \% 1800)) && expire_bruteforce.sh > /dev/null

result=$(pfctl -t bruteforce -T expire 86400 2>&1)
count=$(echo $result  | cut -d '/' -f 1)

if [ ${count:-0} -gt 0 ] ; then
	echo $result
fi

scan_logs_bruteforce.sh

#!/bin/sh

# Add to crontab
# */15	*	*	*	*	scan_logs_bruteforce.sh 2>/dev/null

rm -f /var/db/bruteforce
touch /var/db/bruteforce

# IPV6 left as an exercise for the reader (passim)
EXT_IP=$(ifconfig egress | grep inet | awk ' { print $2 }' | egrep -ao '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -n1)

for i in $(egrep '403|404' /var/www/logs/access.log | grep -v 'GET / ' | egrep -iv 'Robots|SiteMap' | egrep -ao '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | sort -nu | egrep -v "0.0.0.0|$EXT_IP") ; do
	echo $i >> /var/db/bruteforce
done

for i in $(grep 'not listed in AllowUsers' /var/log/authlog | egrep -ao '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | sort -nu | egrep -v "0.0.0.0|$EXT_IP") ; do
	echo $i >> /var/db/bruteforce
done

pfctl -t bruteforce -T add -f /var/db/bruteforce
# Uncomment to protect home ip from inclusion
# pfctl -t bruteforce -T delete <ip address>