ale/fail2ban
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

echo escape

Browse Source
This commit is contained in:
ale 2019-06-20 09:51:08 +00:00
parent 0bf8539909
commit f0fabd4f9b
2 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docker-compose.yml
View File

@ -10,8 +10,8 @@ services:
- /bin/bash
- /etc/fail2ban/entrypoint.sh
volumes:
- ./fail2ban/entrypoint.sh:/etc/fail2ban/entrypoint.sh
- ./fail2ban/sshd_config:/etc/ssh/sshd_config
- ./fail2ban/entrypoint.sh:/etc/fail2ban/entrypoint.sh:ro
- ./fail2ban/sshd_config:/etc/ssh/sshd_config:ro
ports:
- 22:22/tcp
- 2222:2222/tcp

16
fail2ban/entrypoint.sh
View File

@ -12,19 +12,19 @@ REMOTE_IP=\"\$1\"
SENDER_MAIL=\"\$2\"
DEST_MAIL=\"\$3\"
LOGFILE=\"\$4\"
DATE=\$\(date\)
WHOIS_OUTPUT=\$\(whois \$REMOTE_IP\)
REVERSE_IP=\$\(echo \$REMOTE_IP | awk 'BEGIN{FS=\".\";ORS=\".\"} {for \(i = NF; i > 0; i--\){print \$i}}'\)
LOG_LINES=\$\(grep \$REMOTE_IP \$LOGFILE\)
DATE=\$(date)
WHOIS_OUTPUT=\$(whois \$REMOTE_IP)
REVERSE_IP=\$(echo \$REMOTE_IP | awk 'BEGIN{FS=\".\";ORS=\".\"} {for (i = NF; i > 0; i--){print \$i}}')
LOG_LINES=\$(grep \$REMOTE_IP \$LOGFILE)
BANNED_IP_PATH=\"/var/tmp/fail2ban_banned_ips\"
# Skip sending email when an email was already sent out for that IP the last 24hours
if ! [ -d \$BANNED_IP_PATH ]; then mkdir \$BANNED_IP_PATH; else find \${BANNED_IP_PATH}/ -mtime +30 -type f -delete; fi
if [ -n \"\$\(find \${BANNED_IP_PATH}/\$REMOTE_IP -mtime -1 2>/dev/null\)\" ]; then exit 0; else touch \${BANNED_IP_PATH}/\$REMOTE_IP; fi
if [ -n \"\$(find \${BANNED_IP_PATH}/\$REMOTE_IP -mtime -1 2>/dev/null)\" ]; then exit 0; else touch \${BANNED_IP_PATH}/\$REMOTE_IP; fi
# Get the Abuse email address from Abusix
if DNS_REPLY=\$\(host -t TXT \${REVERSE_IP}abuse-contacts.abusix.org\); then
ABUSE_ADDR=\$\(echo \$DNS_REPLY | grep -Eio '\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b' | paste -sd \",\"\)
if DNS_REPLY=\$(host -t TXT \${REVERSE_IP}abuse-contacts.abusix.org); then
ABUSE_ADDR=\$(echo \$DNS_REPLY | grep -Eio '\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b' | paste -sd \",\")
fi
# Send email
@ -44,7 +44,7 @@ WHOIS report FYI:
Thanks for your time and curiosity... take care with botnets...
- ANTIBOTNET SYSTEM -
together will do a better and free world :-\)
together will do a better and free world :-)
from postmaster@$DOMAIN
by www.$DOMAIN\"
fi" > fail2ban_abuse_mail.sh