#!/bin/bash # Afrihost - ipset wrapper # list and manage aserv ipsets # 2016-08-15:p PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/afribin txtgrn='\e[0;32m' # green txtund=$(tput sgr 0 1) # Underline txtbld=$(tput bold) # Bold txtrst='\e[0m' # Text reset bldgrn='\e[1;32m' # Green bldblu='\e[1;36m' # Blue bldwht='\e[1;37m' # White bldred='\e[1;31m' # Red # cpanel check if ! [ -f "/usr/local/cpanel/cpanel" ]; then echo "No cpanel" exit fi if [ -f /etc/bypass_ips ]; then exit fi # some gen vars pscript=$(basename $0) TODAY=$(date +%Y-%m-%d) PWDIR="/root/.preports/"$pscript"" # IPFILTER_FUNCS redhatreleasever=$(egrep -o "4\.|5\.|6\.|7\." /etc/redhat-release|head -1) checkip () { #Do we have a valid IP address? octet="(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])" ip4="^$octet\\.$octet\\.$octet\\.$octet$" if [[ $IPARG =~ $ip4 ]]; then argument="$IPARG" else echo -e ${colred}"[ ip invalid ]"${colrst} exit 1 fi } IPFilter () { egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq | sed 's/^0*//' } IPFilter_noZA () { egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|ID|NA|ZM|CM|SZ|KE|IN|AO' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' } IPDodgeCountryFilter_conn1ormore () { egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|SZ|KE' | egrep 'US|RU|RS|LT|ES|UA|PT|FR|CN|RO|VN|TR|BR|MY|ID|CO|AR|MX|EG|BG|AE|MK|AL|IR|DO|PE|KW|AE|ID|CL|SA|AO|AT|BS|BY|DK|DZ|FI|GR|HR|IL|KZ|MA|TW|CH|HK|IT|JP|PL|SE|CA|NL|DE|IT|PH|JP|TN|KR' | sort |uniq -c | sort -k1n | awk '$1>=2 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' } IPDodgeCountryFilter_oneconn () { egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|SZ|KE' | egrep 'US|RU|RS|LT|ES|UA|PT|FR|CN|RO|VN|TR|BR|MY|ID|CO|AR|MX|EG|BG|AE|MK|AL|IR|DO|PE|KW|AE|ID|CL|SA|AT|BS|BY|DK|DZ|FI|GR|HR|IL|KZ|MA|TW|CH|HK|IT|JP|PL|SE|CA|NL|DE|IT|PH|JP|TN|KR' | sort |uniq -c | sort -k1n | awk '$1>=1 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' } IPRealDodgeCountryFilter_conn1ormore () { egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|SZ|KE'| egrep 'RU|UA|FR|CN|RO|VN|TR|BR|MY|ID|CO|AR|MX|EG|BG|AE|MK|AL|IR|DO|PE|KW' | sort |uniq -c | sort -k1n | awk '$1>=1 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' } IPRealRealDodgeCountryFilter_conn1ormore () { egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|SZ|KE' | egrep 'RU|UA|FR|CN|RO|VN|TR|BR|CO|AR|MX|EG|BG|MK|AL|DO|PE|KW' | sort |uniq -c | sort -k1n | awk '$1>=1 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' } IPDodgeCountryFilter_badies () { egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|SZ|KE' | egrep 'RU|RS|LT|ES|UA|PT|FR|CN|RO|VN|TR|BR|MY|ID|CO|AR|MX|EG|BG|MK|AL|IR|DO|PE|KW|AE|ID|CL|SA|AT|BS|BY|DK|DZ|FI|GR|HR|KZ|MA|TW|CH|HK|IT|JP|PL|SE|CA|NL|DE|IT|PH|JP|TN|KR' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' } badbots_block () { egrep -i 'seznambot|mj12bot|WBSearchBot|SemrushBot|megaindex|centurybot|cognitiveseo|DnyzBot|evc-batch|Facebot|Gowikibot|SemrushBot|SeoBotM6|ZoomBot|SMTBot|Wappalyzer|cortex|PetalBot|masscan|WPScan|healthhacks.ru|NetcraftSurveyAgent|aiHitBot|Nimbostratus|Adsbot/3.1|moz.com' } exclude_TrustedSPs () { /usr/local/afribin/trustedSPs } ################ # Global Funks # ################ redhatreleasever=$(egrep -o "4\.|5\.|6\.|7\." /etc/redhat-release| head -1) ipsetlist_func () { ipset list | geoip } # ipsetlist_func ipsetgrouplist () { ipset list | grep Name | grep -v -i whitelist | awk '{print $2}' | egrep 'local|global|sysadmin|threat|fh' | sort -r } ipsetresetblank () { service iptables stop ipset destroy service ipset stop service ipset start /usr/local/afribin/maintenance/firewall install } # ipset_restart_blank ipset_count_ZA_AU_ips () { for i in $(ipsetgrouplist) ; do ipset list "$i" | geoip | egrep 'ZA|AU' |while read ccode pIP ; do echo -e "-- Listed in: "$i" "$ccode" "$pIP"\n-- To remove run: # ips rza " done done } # ipset_count_ZA_AU_ips ipset_list_blocked () { for i in $(ipsetgrouplist) ; do ipset list $i | geoip | egrep "$IPARG" | while read ccode pIP ; do echo "IP listed $i $ccode $pIP" done ; done } # ipset_list_blocked ipset_remove_ipblock () { #if ! [ "$2" ] ; then # echo "Need an IP" # exit 1 #fi #IPARG="$1" #echo "[IPARG="$IPARG"]" #checkip for i in $(ipsetgrouplist) ; do echo "$i $(ipset list $i|grep "$IPARG"|grep '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}')" done | grep "$IPARG"| while read PGROUP PIP PTIMEOUT PTIMEOUT ; do echo "Running: ipset del $PGROUP $PIP" ipset del $PGROUP $PIP echo "Done" done #for i in $(ipsetgrouplist) ; do # echo "$i $(ipset list $i | grep "$IPARG" )" | # grep '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | # while read IPSETG pIP ; do # echo "IP rule Removed $IPSETG $pIP" ; # ipset del $IPSETG $pIP ; # exit #done ; done } # ipset_remove_ipblock ipset_remove_ZA_AU () { for i in $(ipsetgrouplist) ; do ipset list "$i" | geoip | egrep 'ZA|AU' |while read ccode pIP ; do echo "ipset del "$i" "$pIP" [Done]" ipset del "$i" "$pIP" done done } # ipset_remove_ZA_AU ipset_remove_googleandalike () { googlebotsIPs='209.185. 209.85. 216.239. 127.0.0. 169.0. 173.252. 169.1. 216.33. 64.233. 64.68. 66.249. 72.14. 74.125. 209.85. 8.8. 216.239. 8.6.' for gbots in `echo "$googlebotsIPs"` ; do for i in $(ipsetgrouplist) ; do echo "$i $(ipset list $i | egrep "^"$gbots"")" ; done ; done | grep '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | while read IPSG PIP ; do echo "Ensuring Google and alikes aren't blocked" ; ipset del $IPSETG $PIP done } # ipset_remove_googleandalike ipset_listgrouptotals () { for i in $(ipset list | grep Name | awk '{print $2}') ; do echo -e "$(ipset list $i | wc -l) $i" done | sort -k1n } # ipset_listgrouptotals ipset_listgrouptotals_total () { for i in $(ipset list | grep Name | awk '{print $2}') ; do echo -e "$(ipset list $i | wc -l) $i" done | sort -k1n TOTALGLOBALBLOCKED=$(for total in $(ipset list | grep Name | awk '{print $2}'| grep -v local) ; do echo "$(ipset list $total | wc -l)" done | sort -k1n | awk '{ sum+=$1} END {print sum}') echo -e "\n"$TOTALGLOBALBLOCKED Globally attained IPs being blocked"" TOTALLOCALBLOCKED=$(for total in $(ipset list | grep Name | awk '{print $2}'| grep local) ; do echo "$(ipset list $total | wc -l)" done | sort -k1n | awk '{ sum+=$1} END {print sum}') echo -e "\n"$TOTALLOCALBLOCKED Locally attained IPs being blocked"\n" } # ipset_listgrouptotals_total ipset_localblocks () { /usr/local/afribin/ipsets/ipset_localblocks } # ipset_localblocks ipset_localblocks_quick () { /usr/local/afribin/ipsets/ipset_localblocks_quick } # ipset_localblocks_quick ipset_block_all () { cd /usr/local/afribin/ipsets/globalthreatIPs/ for i in $(ls -1 *.IPs | sed 's/_local2global.IPs//g') ; do ipset flush $i ; ipset restore < "$i"_local2global.IPs done /usr/local/afribin/ipsets/ipset_global_block_critical /usr/local/afribin/ipsets/ipset_localblocks } # ipset_block_all ipset_show_iptable_stats () { iptables -L -v -n | grep match-set | awk '$1>=1 {print $0}' | sort -k1n } #ipset_show_iptable_stats ipset_show_iptable_stats_full () { iptables -L -v -n | grep match-set } #ipset_show_iptable_stats_full redhat_check () { redhatreleasever=$(egrep -o "4\.|5\.|6\.|7\." /etc/redhat-release) if [[ $redhatreleasever = "5." ]] ; then echo "Centos5-NOIPSETS" exit fi } spamnuke_func () { echo "[ Nuking any mail related to "$AUTHED" ]" for eachmid in $(exim -bp | awk '{print $3}'| egrep "......-......-.." | while read pmsg ; do echo "$pmsg" ; exim -Mvh "$pmsg" | grep "$pmsg\|$AUTHED"; done | grep -B1 $AUTHED | grep -o "......-......-..") ; do echo "exim -Mrm "$eachmid"" ; done | bash #echo "for p in $(exim -bp | awk '{print $3}' | grep .| grep "......-......-..") ; do echo "$p" && exim -Mvh "$p" | #grep ""$p"\|"$AUTHED"" ; done | grep -B1 "$AUTHED" | #grep "......-......-.." | xargs -i exim -Mrm {}" | bash } # spamnuke_func fileacc_func () { fileactivity_expand | geoip } # spamnuke_func cwdtoday_func () { grep "cwd=" /var/log/exim_mainlog|awk '{for(i=1;i<=10;i++){print $i}}'| sort|uniq -c|grep cwd|sort -n | egrep -v 'spool/exim|cwd=/root' } # spamnuke_func cwdexim_mainlog_func () { grep -E $(date +"%Y-%m-%d") /var/log/exim_mainlog | grep "cwd="|awk '{for(i=1;i<=10;i++){print $i}}'| sort|uniq -c|grep cwd|sort -n|egrep -v 'service|root|spool'| tail -2| grep -v -w "cwd=/"|sort -k1nr } # spamnuke_func eximstop_func () { /usr/local/afribin/maintenance/exim_stop } # eximstop_func eximbs_func () { grep `date +"%Y"-"%m-%d"` /var/log/exim_mainlog| grep "for .*@.*"| grep "<= <>"|awk -F"T=" '{print $2}'| awk '{print $NF,$0}'|awk -F" for" '{print $1}'|sort|uniq -c| sort -n } # eximbs_func domhammer_func () { grep -E $(date +"%d/%b/%Y") "$PDOOMARG" |tail -10 | exclude_TrustedSPs | egrep "wp-login.php|xmlrpc|administrator" | awk '{print $1}'| IPDodgeCountryFilter_conn1ormore | while read PDOMHIP ; do ipset add adminbrute_threats_local $PDOMHIP echo "`date +"%b %d %T"` `hostname` ipset [ips domh::sysadmin_added_ips: $pscript $PDOMHIP" #| #tee -a /var/log/messages|geoip done } # domhammer_func domhammerauto_func () { for i in $(ps auwfx | sort -k3n | grep php |awk '$3>7 {print $0}' | awk '{print $1}'|sort|uniq | while read puname ; do grep $puname /etc/trueuserdomains | awk -F ":" '{print $1}'; done ); do ips domh /usr/local/apache/domlogs/"$i" done } # domhammerauto_func domhammerautofileacc_func () { pfileac=$(fileactivity -x0 | grep domlogs | sort -k1 -n | tail -10 | awk '{print $4}') ; for i in `echo $pfileac` ; do ips domh $i ; done } # domhammerautofileacc_func newbomb_func () { ipset_localblocks_quick for i in $(ps auwfx | sort -k3n|grep php| awk '$3>7 {print $0}' | awk '{print $1}'| sort|uniq | while read puname ; do grep $puname /etc/trueuserdomains | awk -F ":" '{print $1}'; done ); do grep -ir $(date +"%d"/"%b"/"%Y":%H:..:..) /usr/local/apache/domlogs/$i | exclude_TrustedSPs | egrep "xmlrpc|GET \/wp-login.php" done | geoip| egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS' | awk '($10 > 399) {print $0}' | awk '{print $2}' | xargs -i ipset add adminbrute_threats_local {} echo "list /usr/local/apache/domlogs/ by time and grep date to the min and BlockDodge" cat /dev/null > /tmp/ipsbomb cd /usr/local/apache/domlogs/ for i in $(cd /usr/local/apache/domlogs/ ; ls -altrhd ./* | grep -v "drwxr"| egrep -v 'bytes_log|_log'|awk '{print $9}' | tail -150|egrep -v 'ftx' ) ; do tail -10 "$i" >> /tmp/ipsbomb done echo ":::: ips bomb :::: Created /tmp/ipsbomb" grep -ir $(date +"%d"/"%b"/"%Y":%H:%M:..) /tmp/ipsbomb | exclude_TrustedSPs | awk '($9 > 399) {print $0}' | geoip | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|ID' | awk '{print $2}'| sort | uniq -c | sort -k1n | awk '$1>=8 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | while read PDOMHIP ; do echo ":::: ips bomb :::: $(grep -o $(date +"%d"/"%b"/"%Y":%H:..:) /tmp/ipsbomb| grep $PDOMHIP) -- http response>400+IPcount>8>LastHour $PDOMHIP" | geoip #echo "`date +"%b %d %T"` `hostname` ipset [ips domh::adminbrute_threats_local: $pscript $PDOMHIP" #| #tee -a /var/log/messages|geoip ipset -! add sysadmin_added_ips $PDOMHIP done echo "list /usr/local/apache/domlogs/ by time and grep date to the min and BlockDodge" grep -ir $(date +"%d"/"%b"/"%Y":%H:.) /tmp/ipsbomb | exclude_TrustedSPs | egrep "wp-login.php|xmlrpc|administrator/index.php" | geoip | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|ID' | awk '{print $2}'| sort | uniq -c | sort -k1n | awk '$1>=3 {print $2}' | awk '{print $2}'| sort | uniq | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | while read PDOMHIP ; do echo ":::: ips bomb :::: $(grep -o $(date +"%d"/"%b"/"%Y":%H:..:) /tmp/ipsbomb| grep $PDOMHIP) -- DomlogModTimeNow+BruteBlock+DodgeCountry+IPcount=>3 $PDOMHIP" | geoip #echo "`date +"%b %d %T"` `hostname` ipset [ips domh::adminbrute_threats_local: $pscript $PDOMHIP" #| #tee -a /var/log/messages|geoip ipset -! add adminbrute_threats_local $PDOMHIP done echo "[ dmesg_firewall_threat ]" for eachdmesgIP in $(dmesg | tail -10 | IPRealRealDodgeCountryFilter_conn1ormore) ; do IPARG=$eachdmesgIP checkip echo "`date +"%b %d %T"` `hostname` ipset [dmesg|iptable|dodgecountry:sysadmin_added_ips]::$pscript $eachdmesgIP::" | geoip #tee -a /var/log/messages|geoip ipset -! add sysadmin_added_ips $eachdmesgIP done grep $(date +"%d"/"%b"/"%Y":%H:.) /tmp/ipsbomb | exclude_TrustedSPs | egrep -i 'seznambot|ahrefs|mj12bot|WBSearchBot|SemrushBot|megaindex' | IPFilter_noZA| while read PDOMHIP ; do ipset add badbot_threats_local "$PDOMHIP" echo ":::: ips bomb - DomlogModNow+badbot+country+count :::: $(grep $PDOMHIP /tmp/fa.tmp|grep -o $(date +"%d"/"%b"/"%Y":%H:..)) -- badbot+IPcount>2 $PDOMHIP" | geoip ; done echo "Run fileactivity_expand grep date+time+bruteattempts+geoip+ipcount=BlockDodge" cat /dev/null > /tmp/fa.tmp ips fa >> /tmp/fa.tmp; grep $(date +"%d"/"%b"/"%Y":%H:.) /tmp/fa.tmp|egrep -i "wp-login.php|xmlrpc|administrator" | egrep -v 'google|facebook|twitter|bing|jetpack|vaultpress|yahoo'| egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|ID'| awk '{print $2}'| sort | uniq -c | sort -k1n | awk '$1>=4 {print $1,$2,$3}'|egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | while read PDOMHIP ; do echo ":::: ips bomb - ips fa+login brute :::: $(grep -o $(date +"%d"/"%b"/"%Y":%H:.) /tmp/fa.tmp|grep $PDOMHIP) -- fileactivity_expand+BruteBlock=DodgeCountry+IPcount=>3 $PDOMHIP" | geoip ipset add adminbrute_threats_local $PDOMHIP done grep $(date +"%d"/"%b"/"%Y":%H:.) /tmp/fa.tmp | exclude_TrustedSPs | egrep -i 'seznambot|ahrefs|mj12bot|WBSearchBot|SemrushBot|megaindex.com|masscan' | IPFilter_noZA| while read PDOMHIP ; do ipset add badbot_threats_local $PDOMHIP echo ":::: ips bomb - ips fa+badbot+country+count :::: $(grep -o $(date +"%d"/"%b"/"%Y":%H:.) /tmp/fa.tmp|grep $PDOMHIP) -- badbot+IPcount>2 $PDOMHIP" | geoip ; done grep $(date +"%Y"-"%m"-"%d") /usr/local/cpanel/logs/cphulkd.log|grep "Login Blocked: IP reached maximum auth failures" | grep -o "\[Remote IP Address\]=\[.*\]" | awk '{print $1,$3}' | ipgrep | sort | uniq | geoip | egrep -v 'ZA|AU' | ipgrep | while read PDOMHIP ; do echo ":::: ips bomb - cphulkd_listed :::: $PDOMHIP" |geoip xargs -i ipset -! add cphulk_threats_local {} done tail -50 /var/lib/mysql/`hostname`.err | grep "could not be resolved" | geoip | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort | uniq -c | sort -k1n | geoip | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|AE|IN' | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | while read PDOMHIP ; do echo ":::: ips bomb - mysql_threats $PDOMHIP" |geoip xargs -i ipset -! add mysql_threat {} done echo "contact spam attack block" if [ $(grep -i $(date +"%d"/"%b"/"%Y":%H:..:..) /tmp/ipsbomb | grep -i contact | geoip | egrep -v 'ZA|127.0.0|_|AU' | egrep -vi 'google|facebook|twitter|bing|jetpack|vaultpress|yahoo'| awk '{print $12}' | wc -l) -gt 20 ] ; then grep -i $(date +"%d"/"%b"/"%Y":%H:..:..) /tmp/ipsbomb | grep contact | grep POST | geoip | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|ID|ZM|NA' | awk '{print $2}' |sort | uniq | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//'| while read PDOMHIP ; do echo ":::: ips bomb :::: $(grep -o $(date +"%d"/"%b"/"%Y":%H:..:) /tmp/ipsbomb| grep $PDOMHIP) -- DomlogContactBruteBlock+DodgeCountry $PDOMHIP" | geoip ipset -! add adminbrute_threats_local $PDOMHIP #ips spamnuke $PDOMHIP done fi exim -bp | egrep -B1 -i 'qq.com|2126.com' |grep -o "......-......-.." | xargs -i exim -Mrm {} } bombnofa_func () { trigger=80 ppload="$(uptime | awk '{print $(NF-2)}' | awk -F "." '{print $1}')" response=`echo | awk -v T=$trigger -v L=$ppload 'BEGIN{if ( L > T){ print "greater"}}'` if [[ $response = "greater" ]] ; then echo -e ${bldblu}"[LOAD HIGHER THAN 80 :: GOING TO TRY HAMMER DOWN ]"${txtrst} echo "apache and fpm quick restart" ; for run in {1..60}; do killall -9 httpd php-fpm php-cgi ; done /scripts/php_fpm_config --rebuild all /scripts/restartsrv_apache_php_fpm service httpd start for i in $(netstat -ntu | awk '/tcp|udp/ {print $5}' | sed 's/::ffff://' | cut -d: -f1 | sort | uniq -c | sort -n | geoip | egrep 'CN|TR|EG|CZ|RU|BR|CO|JP|RO|CH|NL' | awk '{print $3}' | sort | uniq -c | sort -n | geoip | awk '$1 > 0 ' | IPDodgeCountryFilter_badies | ipgrep); do ipset -! add ddos_ips_min $i done if [[ `hostname` = *\.aserv\.co\.za ]] ; then ps auwfx| grep php-cgi | awk '{if($1!=$1+0 && $1!="root")print $0}' | awk '{print $1}'|sed 's/+//' | sort | uniq -c | awk '($1 > 50 )' | awk '{print $2}' | while read pusercgi ; do ps awufx | grep $pusercgi | grep php-cgi| grep -v grep | awk '{print $2}' | xargs -i kill -9 {} done fi cphulkresp=$(ps auwfx | grep cPhulkd |wc -l | awk '{if ( $1 > 9){ print "greater"}'}) if [[ $cphulkresp = "greater" ]] ; then killall -9 "cPhulkd - processor" killall -9 "cPhulkd - dbprocessor" killall -9 "cPhulkd - processor - http socket" /scripts/restartsrv_cphulkd fi telegram-send "$(hostname) - killed everything cause of load above 80" netstat -ntu | egrep ":443\ |:80\ " | awk '/tcp|udp/ {print $5}' | sed 's/::ffff://' | cut -d: -f1 | sort | uniq -c | sort -n | geoip | egrep -v '127.0.0.1|ZA|_' | ipgrep | xargs -i ipset add ddos_ips_min {} if ps auwfx | grep "/usr/sbin/httpd -k start" | wc -l | awk '($1 > 130)' | grep "[0-9]" ; then ps auwfx | grep "/usr/sbin/httpd -k start" |sort -k3 | grep "S\ " | head -n20 | awk '{print $2}' | xargs -i kill -9 {} nshow | egrep 'PL|BG|BD|CA|RO|TR|EG|CN|IT|RU|BR|US|FR|CA|GB|NL' |ipgrep| xargs -i ipset -! add ddos_ips_min {} telegram-send "$(hostname) - apache hit 130 processes, investigate" fi fi echo -e ${bldblu}"[Creating tail dump of domlogs /usr/local/apache/domlogs/ by time and grep date to the min to use for subsequent blocks below"${txtrst} cat /dev/null > /tmp/ipsbomb find /usr/local/apache/{logs,domlogs}/* -maxdepth 0 -type f -mmin -10 | egrep -v 'bytes_|ftp' | xargs -i tail -n10 {} > /tmp/ipsbomb chmod 600 /tmp/ipsbomb echo ":::: ips bomb :::: Created /tmp/ipsbomb" trigger=$(echo $((`nproc`+15))) ppload="$(uptime | awk '{print $(NF-2)}' | awk -F "." '{print $1}')" response=`echo | awk -v T=$trigger -v L=$ppload 'BEGIN{if ( L > T){ print "greater"}}'` if [[ $response = "greater" ]] ; then echo -e ${bldblu}"[Blocking based on load and concurrent connections of dodge countries 1min block]"${txtrst} nshow | egrep 'PL|BG|BD|CA|RO|TR|EG|CN|IT|RU|BR|US|FR|CA|GB|NL' |ipgrep|xargs -i ipset -! add ddos_ips_min {} if ! screen -ls | grep ipsmalblock ; then screen -dmS ipsmalblock /usr/local/afribin/configs/cpanel_malicious_ipsbmombrun ; fi fi #echo -e ${bldblu}"[Blocking based on current highest cpu users|php|bruteforceattachs|httpreturncode"${txtrst} #for i in $(ps auwfx | sort -k3n|grep php| # awk '$3~0 {print $0}' | awk '{print $1}'| # sort|uniq | while read puname ; do # grep $puname /etc/trueuserdomains | # awk -F ":" '{print $1}'; done ); do # cat /tmp/ipsbomb | exclude_TrustedSPs | # egrep "xmlrpc|GET \/wp-login.php|FPURL.xml" #done | geoip| IPFilter_noZA | #awk '($10 > 399) {print $0}' | awk '{print $2}' | sort | uniq | #egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | #xargs -i ipset -q add adminbrute_threats_local {} echo -e ${bldblu}"[Blocking based on /usr/local/cpanel/logs/cphulkd.log ]"${txtrst} grep $(date +"%Y"-"%m"-"%d") /usr/local/cpanel/logs/cphulkd.log|grep "Login Blocked: IP reached maximum auth failures" | grep -o "\[Remote IP Address\]=\[.*\]" | awk '{print $1,$3}' | ipgrep | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|ID|ZM|NA' | ipgrep | while read PDOMHIP ; do xargs -i ipset -! add cphulk_threats_local {} && echo ":::: ips bomb - cphulkd_listed :::: $PDOMHIP" |geoip done echo -e ${bldblu}"[Blocking based on badbots_block list check ips script for function badbots_block list ]"${txtrst} grep $(date +"%d"/"%b"/"%Y":%H:.) /tmp/ipsbomb | badbots_block | egrep -v '127.0.0|_' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//'| while read PDOMHIP ; do ipset -! add badbot_threats_local $PDOMHIP # echo ":::: ips bomb - DomlogModNow+badbot+country+count :::: $(grep "$PDOMHIP" /tmp/ipsbomb | grep -o $(date +"%d"/"%b"/"%Y":%H:..)|grep "$PDOMHIP") -- badbot+IPcount>2 $PDOMHIP" | geoip done ltrigger=$(echo $((`nproc`+1))) ppload="$(uptime | awk '{print $(NF-2)}' | awk -F "." '{print $1}')" response=`echo | awk -v T=$ltrigger -v L=$ppload 'BEGIN{if ( L > T){ print "greater"}}'` if [[ $response = "greater" ]] ; then echo -e ${bldblu}"[Blocking based on load and concurrent connections of dodge countries ]"${txtrst} ps auwfx| grep php-cgi | awk '{if($1!=$1+0 && $1!="root")print $0}' | awk '{print $1}'| sed 's/+//' | xargs -i grep {} /etc/trueuserdomains | awk -F ": " '{print $2}' | sort | uniq | xargs -i ips applyfpm {} if [[ `hostname` = *\.aserv\.co\.za ]] ; then ps auwfx| grep php-cgi | awk '{if($1!=$1+0 && $1!="root")print $0}' | awk '{print $1}'|sed 's/+//' | sort | uniq -c| awk '($1 > 50 )' | awk '{print $2}' | while read pusercgi ; do ps awufx | grep $pusercgi | grep php-cgi | grep -v grep | awk '{print $2}' | xargs -i kill -9 {} ; done fi if ps auwfx | grep -v grep | grep -q jailshell ; then killall -9 jailshell; fi grep xmlrpc /tmp/ipsbomb | awk '{print $1}' | sort | uniq -c | geoip | awk '($1 > 10) {print $1,$3}' | while read ppcount ppip ; do ipset -! add fh_level4_ips $ppip ; done echo -e ${bldblu}"[Blocking based on known brute force attacks and known combination User-Agents ]"${txtrst} grep $(date +"%d"/"%b"/"%Y":%H:.) /tmp/ipsbomb | exclude_TrustedSPs | egrep --colour -i "GET \/wp-login.php\ |xmlrpc|administrator/index.php|FPURL.xml|POST\ \/wp-login.php\ HTTP|POST /xmlrpc.php HTTP/1.1" | egrep 'Ubuntu|X11\;\ Linux' | geoip | awk '{print $1,$2}'| IPFilter_noZA | awk '{print $2}'| sort | uniq -c | sort -k1n | awk '$1>=4 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | while read PDOMHIP ; do ipset -! add adminbrute_threats_local $PDOMHIP; done nshow | egrep 'PL|BG|BD|CA|RO|TR|EG|CN|IT|RU|BR|US|FR|CA|GB|NL' |ipgrep| xargs -i ipset -! add ddos_ips_min {}; ps auwfx| sort -k3n | egrep 'php-fpm|php-cgi' | tail -n7 | egrep -v 'root|mysql' | awk '{print $1}' | sort | uniq | while read puname ; do grep "USER="$puname"$" /var/cpanel/users/"$puname" | sed 's/USER=//' | while read realuname ; do tail -n5 /usr/local/apache/domlogs/"$realuname"/* | /usr/local/afribin/trustedSPs | geoip | awk '{print $1,$2}' | egrep -v 'ZA|127.0.0|_|AU' | ipgrep | xargs -i ipset -! add ddos_ips_min {} ; done ; done; fi trigger=$(echo $((`nproc`+1))) ppload="$(uptime | awk '{print $(NF-2)}' | awk -F "." '{print $1}')" response=`echo | awk -v T=$trigger -v L=$ppload 'BEGIN{if ( L > T){ print "greater"}}'` if [[ $response = "greater" ]] ; then echo -e ${bldblu}"[cPhulk check :: cause cPhulk can't handle huge spikes, restarting if more than 7 processes and load above high trigger of 15 and an aserv.co.za ]"${txtrst} cphulkresp=$(ps auwfx | grep cPhulkd |wc -l | awk '{if ( $1 > 7){ print "greater"}'}) ; if [[ $cphulkresp = "greater" ]] ; then echo "killing cphulk and restarting" ; killall -9 "cPhulkd - processor" ; killall -9 "cPhulkd - dbprocessor";killall -9 "cPhulkd - processor - http socket" ; /scripts/restartsrv_cphulkd ; fi fi grep xmlrpc /tmp/ipsbomb | awk '{print $1}' | sort | uniq -c | geoip | awk '($1 > 10) {print $1,$3}' | while read ppcount ppip ; do ipset -! add fh_level4_ips $ppip ; done echo -e ${bldblu}"[Blocking based on known brute force attacks and known combination User-Agents ]"${txtrst} grep $(date +"%d"/"%b"/"%Y":%H:.) /tmp/ipsbomb | exclude_TrustedSPs | egrep --colour -i "GET \/wp-login.php\ |xmlrpc|administrator/index.php|FPURL.xml|POST\ \/wp-login.php\ HTTP|POST /xmlrpc.php HTTP/1.1" | egrep 'Ubuntu|X11\;\ Linux' | geoip | awk '{print $1,$2}'| IPFilter_noZA | awk '{print $2}'| sort | uniq -c | sort -k1n | awk '$1>=4 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | while read PDOMHIP ; do # echo ":::: ips bomb :::: $(grep -o $(date +"%d"/"%b"/"%Y":%H:..:) /tmp/ipsbomb| grep $PDOMHIP) -- DomlogModTimeNow+BruteBlock+DodgeCountry+IPcount=>4 $PDOMHIP" | geoip ipset -! add adminbrute_threats_local $PDOMHIP; done echo -e ${bldblu}"[Blocking based on known brute force attacks and known combination User-Agents ]"${txtrst} grep $(date +"%d"/"%b"/"%Y":%H:.) /tmp/ipsbomb | exclude_TrustedSPs | egrep --colour -i "GET \/wp-login.php\ |xmlrpc|administrator/index.php|FPURL.xml|POST\ \/wp-login.php\ HTTP|POST /xmlrpc.php HTTP/1.1" | egrep 'Ubuntu|X11\;\ Linux' | geoip | awk '{print $1,$2}'| IPFilter_noZA | IPRealDodgeCountryFilter_conn1ormore | awk '{print $2}'| sort | uniq -c | sort -k1n | awk '$1>=2 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | while read PDOMHIP ; do # echo ":::: ips bomb :::: $(grep -o $(date +"%d"/"%b"/"%Y":%H:..:) /tmp/ipsbomb| grep $PDOMHIP) -- DomlogModTimeNow+BruteBlock+DodgeCountry+IPcount=>4 $PDOMHIP" | geoip ipset -! add adminbrute_threats_local $PDOMHIP; done grep $(date +"%d"/"%b"/"%Y":%H:.) /tmp/ipsbomb | /usr/local/afribin/trustedSPs | egrep -i "GET \/wp-login.php|xmlrpc|administrator|FPURL.xml|POST\ \/wp-login.php\ HTTP|administrator/index.php|POST /xmlrpc.php HTTP/1.1" | geoip | awk '{print $1,$2}'| IPFilter_noZA | IPDodgeCountryFilter_badies | awk '{print $2}'| sort | uniq -c | sort -k1n | awk '$1>=10 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | while read PDOMHIP ; do echo ":::: ips bomb :::: $(grep -o $(date +"%d"/"%b"/"%Y":%H:..:) /tmp/ipsbomb| grep $PDOMHIP) -- DomlogModTimeNow+BruteBlock+DodgeCountry+IPcount=>10 $PDOMHIP" | geoip; ipset -! add adminbrute_threats_local $PDOMHIP; done echo -e ${bldblu}"[Blocking based on apache http response code and concurrent connections at a given poiont in time ]"${txtrst} grep -i $(date +"%d"/"%b"/"%Y":%H:%M:..) /tmp/ipsbomb | exclude_TrustedSPs | awk '($9 > 399) {print $0}' | geoip | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|ID|ZM|NA' | awk '{print $2}'| sort | uniq -c | sort -k1n | awk '$1>=4 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | while read PDOMHIP ; do echo ":::: ips bomb :::: $(grep -o $(date +"%d"/"%b"/"%Y":%H:..:) /tmp/ipsbomb| grep $PDOMHIP) -- http response>400+IPcount>10 $PDOMHIP" | geoip #echo "`date +"%b %d %T"` `hostname` ipset [ips domh::adminbrute_threats_local: $pscript $PDOMHIP" #| #tee -a /var/log/messages|geoip ipset -! add sysadmin_added_ips $PDOMHIP done echo -e ${bldblu}"[Blocking based on xlmrpc attacks ]"${txtrst} grep -i $(date +"%d"/"%b"/"%Y":%H:..) /tmp/ipsbomb | grep "POST /xmlrpc.php HTTP/1.1\" 200 40[1,4]" | exclude_TrustedSPs | geoip | awk '{print $1,$2}' | IPFilter_noZA |sort | uniq -c | sort -k1n | awk '$1>=2 {print $3}' | while read PDOMHIP ; do echo ":::: ips bomb :::: $(grep -o $(date +"%d"/"%b"/"%Y":%H:..:) /tmp/ipsbomb| grep $PDOMHIP) -- xmlrpc attack response>400+IPcount>3 $PDOMHIP" | geoip ipset -! add sysadmin_added_ips $PDOMHIP done echo -e ${bldblu}"[Blocking based on list /usr/local/apache/domlogs/ by time and grep date to the min and BlockDodge]"${txtrst} grep -i $(date +"%d"/"%b"/"%Y":%H:.) /tmp/ipsbomb | exclude_TrustedSPs | egrep "/wp-login.php HTTP/1.1|GET \/wp-login.php|xmlrpc|administrator/index.php|FPURL.xml|POST\ \/wp-login.php\ HTTP|POST /xmlrpc.php HTTP/1.1" | geoip | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|ZM|NA' | awk '{print $2}'| sort | uniq -c | sort -k1n | awk '$1>=4 {print $1,$2,$3}' | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//' | while read PDOMHIP ; do # echo ":::: ips bomb :::: $(grep -o $(date +"%d"/"%b"/"%Y":%H:..:) /tmp/ipsbomb| grep $PDOMHIP) -- DomlogModTimeNow+BruteBlock+DodgeCountry+IPcount=>3 $PDOMHIP" | geoip #echo "`date +"%b %d %T"` `hostname` ipset [ips domh::adminbrute_threats_local: $pscript $PDOMHIP" #| #tee -a /var/log/messages|geoip ipset -! add adminbrute_threats_local $PDOMHIP done echo -e ${bldblu}"[Blocking based on contact spam attack block]"${txtrst} if [ $(grep -i $(date +"%d"/"%b"/"%Y":%H:..:..) /tmp/ipsbomb | grep -i contact | geoip | IPFilter_noZA | exclude_TrustedSPs | awk '{print $12}' | wc -l) -gt 20 ] ; then grep -i $(date +"%d"/"%b"/"%Y":%H:..:..) /tmp/ipsbomb | grep contact | grep POST | geoip | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|ID|ZM|NA' | awk '{print $2}' |sort | uniq | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed 's/^0*//'| while read PDOMHIP ; do # echo ":::: ips bomb :::: $(grep -o $(date +"%d"/"%b"/"%Y":%H:..:) /tmp/ipsbomb| grep $PDOMHIP) -- DomlogContactBruteBlock+DodgeCountry $PDOMHIP" | geoip ipset -! add adminbrute_threats_local $PDOMHIP #ips spamnuke $PDOMHIP done fi #exim -bp | egrep -B1 -i 'qq.com|2126.com' |grep -o "......-......-.." | xargs -i exim -Mrm {} echo -e ${bldblu}"[Blocking based on dmesg_firewall_threat ]"${txtrst} for eachdmesgIP in $(dmesg | tail -n10 | IPRealRealDodgeCountryFilter_conn1ormore) ; do IPARG=$eachdmesgIP checkip #tee -a /var/log/messages|geoip ipset -q add sysadmin_added_ips $eachdmesgIP #echo "`date +"%b %d %T"` `hostname` ipset dmesg" | geoip done echo -e ${bldblu}"[Blocking based on mysql direct connect attemps ]"${txtrst} tail -n250 /var/lib/mysql/`hostname`.err | grep "could not be resolved" |geoip| egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|AE|ZM|NA'| grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | sort | uniq | while read PDOMHIP ; do ipset -q add mysql_threats_local "$PDOMHIP" #echo ":::: ips bomb - mysql_threats "$PDOMHIP"" |geoip done #echo "[ exim auth failures ]" #grep "$(date +"%b %d ")" /var/log/maillog | grep -i "auth failed" | geoip | grep -v "rip=ZA" |grep -Po "(?<=rip\=)[^/]*(?=, TLS)" | #tail -500 /var/log/maillog | grep -i "auth failed" | geoip | grep -v "rip=ZA" |grep -Po "(?<=rip\=)[^/]*(?=, TLS)" | # awk '{print $1,$2}' | sed 's/,//' | sort | uniq -c | sort -k1n | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|ID|NA|ZM' | ipgrep | # while read PDOMHIP ; do # ipset -q add exim_authfail_threats_local "$PDOMHIP" && echo ":::: ips bomb - exim_authfail_threats_local "$PDOMHIP"" | geoip #done echo -e ${bldblu}"[Blocking based on ftp international auth failures ]"${txtrst} #grep "$(date +"%b %d ")" /var/log/messages | grep "Authentication failed for user" | geoip | grep -v "ZA" | tail -n10 /var/log/{messages,ftplogs} | grep "Authentication failed for user" | geoip | grep -v "ZA" | awk '{print $6,$7}' | sed 's/)//' | sort | uniq -c | sort -k1n | egrep -v 'ZA|127.0.0|_|AU|ZW|BW|MZ|LS|ID|NA|ZM' | ipgrep | while read PDOMHIP ; do # echo ":::: ips bomb - ftp_threats_local "$PDOMHIP"" | geoip ipset -! add ftp_threats_local "$PDOMHIP" done echo -e ${bldblu}"[Blocking based on cpanel/whm international auth failures ]"${txtrst} grep "$(date +"%Y"-"%m"-"%d %H: ")" /usr/local/cpanel/logs/login_log | grep "FAILED LOGIN" | geoip | awk '{print $6,$7}' | sed 's/)//' | sort | uniq -c | sort -k1n | IPFilter_noZA | ipgrep | while read PDOMHIP ; do ipset -q add cpanel_authfail_threats_local "$PDOMHIP" #echo ":::: ips bomb - cpanel_authfail_threats "$PDOMHIP"" | geoip done echo -e ${bldblu}"[Blocking based on exim YLMF helo name and geoip]"${txtrst} for i in $(tail -n500 /var/log/exim_mainlog | grep AH-Block | IPFilter_noZA ) ; do #echo "$i" | tee -a $YLMF_OUTFILE ; ipset -q add ylmf_helo_threats_local $i && echo ":::: `date +"%b%d_%T"` ips bombnofa - ylmf_helo_threats_local "$i"" | geoip done echo -e ${bldblu}"[Blocking dovecot auth fail and dodge country]"${txtrst} for i in $(tail -n250 /var/log/exim_mainlog | grep "dovecot_plain authenticator failed for" | ipgrep | geoip | IPFilter_noZA | ipgrep ) ; do #echo "$i" | tee -a $YLMF_OUTFILE ; ipset -q add exim_authfail_threats_local $i && echo ":::: `date +"%b%d_%T"` ips bombnofa - dovecot_plain authenticator failed "$i"" | geoip done echo -e ${bldblu}"[Blocking based on RBL matches]"${txtrst} for i in $(tail -n550 /var/log/exim_mainlog | egrep "because of RBL match" | IPFilter_noZA ) ; do #echo "$i" | tee -a "$RBL_OUTFILE" ; ipset -q add exim_RBL_threats_local $i && echo ":::: `date +"%b%d_%T"` `hostname` ipsets bombnofa - exim_RBL_threats_local "$PDOMHIP"" | geoip done echo -e ${bldblu}"[Blocking based on exim_mainlog no MAIL in SMTP connection from]"${txtrst} for i in $(tail -n100 /var/log/exim_mainlog | egrep -vi 'google|facebook|twitter|bing|jetpack|vaultpress|yahoo' | egrep -o "no MAIL in SMTP connection from.{0,20}" | ipgrep | sort | uniq | geoip | egrep -v 'ZA|127.0.0|_|AU' | ipgrep | IPFilter_noZA ) ; do #echo "$i" | tee -a "$RBL_OUTFILE" ; ipset -q add exim_invalidhelo_threats_local $i && echo ":::: `date +"%b%d_%T"` `hostname` ipsets bombnofa - no MAIL in SMTP connection"$i"" | geoip done echo -e ${bldblu}"[Blocking based on exim_mainlog no MAIL in SMTP connection from]"${txtrst} tail -100 /var/log/exim_mainlog | grep -A1 "TCP/IP connection count =" | sed 's/)//' | awk '($NF > 20)' | geoip | grep "no host name found" | IPFilter_noZA | awk '{print $NF}' | while read exim_dodge ; do #echo "$i" | tee -a "$RBL_OUTFILE" ; ipset -q add exim_invalidhelo_threats_local $exim_dodge #echo ":::: `date +"%b%d_%T"` `hostname` ipsets bombnofa - no MAIL in SMTP connection"$exim_dodge"" | geoip done echo -e ${bldblu}"[Blocking based on atomicorp known matches and geoip]"${txtrst} for i in $(tail -n100 /usr/local/apache/logs/error_log | egrep "WAF Rules: Fake|Threat Intelligence Match|WAF Rules - Login Failure Detection" | IPFilter_noZA ) ; do #echo "$i" | tee -a $WAF_FAKE_THREATMATCH_OUTFILE ipset -! add modsec_threats_local $i # echo "[Added :: $(echo "$i" | wc -l) IPs]" done echo -e ${bldblu}"[Blocking based on http concurrent connections more than 55 per ip and geoip]"${txtrst} for i in $(netstat -ntu | egrep ":443\ |:80\ " | awk '/tcp|udp/ {print $5}' | sed 's/::ffff://' | cut -d: -f1 | sort | uniq -c | sort -n | geoip | awk '($1 >= 1) {print $0}'| IPFilter_noZA | sort | uniq -c | awk '($1 > 55) {print $0}' | ipgrep ) ; do ipset -! add http2concurconn_threats_local $i done echo -e ${bldblu}"[Blocking based on http concurrent connections more than 5 per ip and geoip]"${txtrst} for i in $(ss | grep http | ipgrep | geoip | IPFilter_noZA | egrep 'EG|CN|BR|TR|RU|RO|CZ' | sort | uniq -c | awk '($1 > 5) {print $0}' | ipgrep ) ; do ipset -! add http2concurconn_threats_local $i done echo -e ${bldblu}"[Blocking based on concurrent connections more than 5 per ip and geoip dodge countries]"${txtrst} for i in $(netstat -ntu | awk '/tcp|udp/ {print $5}' | sed 's/::ffff://' | cut -d: -f1 | sort | uniq -c | sort -n | geoip | awk '$1 > 35' | IPDodgeCountryFilter_badies | ipgrep); do ipset -q add ddos_ips $i #echo ":::: `date +"%b%d_%T"` `hostname` ipsets bombnofa - dodge concurrent connections "$i"" | geoip done echo -e ${bldblu}"[Blocking based on dovecot_login authenticator failed and dodge countries]"${txtrst} tail -n100 /var/log/exim_mainlog | grep "dovecot_login authenticator failed for" | geoip | grep -oP '\[.*?\]' | IPDodgeCountryFilter_oneconn | while read dovecot_autdodge ; do ipset -! add exim_authfail_threats_local "$dovecot_autdodge" done echo -e ${bldblu}"[Blocking based on 404 to hostname and dodge country and two connections ]"${txtrst} tail -n100 /usr/local/apache/domlogs/`hostname` /usr/local/apache/logs/access_log | grep 404 | /usr/local/afribin/trustedSPs | geoip | IPFilter_noZA | egrep -v 'ZA|127.0.0|_|AU' | ipgrep | while read PDOMHIP ; do ipset -! -q add hostname404_threats_local "$PDOMHIP" # echo ":::: ips bombnofa - hostname404_threats_local "$PDOMHIP"" | geoip done echo -e ${bldblu}"[Blocking based on 404 in domlogs/proxy-subdomains-vhost.localhost and dodge country and two connections ]"${txtrst} tail -n100 /usr/local/apache/domlogs/proxy-subdomains-vhost.localhost | /usr/local/afribin/trustedSPs | egrep -v "COMODO|DCV|Cpanel-HTTP-Client" | geoip | IPFilter_noZA | ipgrep | while read PDOMHIP ; do ipset -! -q add hostname404_threats_local "$PDOMHIP" # echo ":::: ips bombnofa - proxy-subdomains-vhost.localhost "$PDOMHIP"" | geoip done echo -e ${bldblu}"[Blocking based on 404 in domlogs and dodge country and two connections and not /usr/local/afribin/trustedSPs ]"${txtrst} grep -i $(date +"%d"/"%b"/"%Y":%H:.) /tmp/ipsbomb | grep -oP '.* ?\ 404\ ' | awk '{print $1}' | sort | uniq | xargs -i grep {} /tmp/ipsbomb | geoip | /usr/local/afribin/trustedSPs | IPFilter_noZA | egrep -v "COMODO|DCV|Cpanel-HTTP-Client" | IPFilter_noZA | ipgrep | IPRealRealDodgeCountryFilter_conn1ormore | while read PDOMHIP ; do ipset -! -q add hostname404_threats_local "$PDOMHIP" #echo ":::: ips bombnofa - 404, dodge countries "$PDOMHIP"" | geoip done echo -e ${bldblu}"[Blocking based on modsec threats ]"${txtrst} tail -n100 /usr/local/apache/logs/error_log | grep ModSecurity: | geoip | awk '{print $1,$2,$3,$4,$5,$6,$10,$11}' | IPFilter_noZA | ipgrep | while read PDOMHIP ; do ipset -! add modsec_threats_local "$PDOMHIP" #echo ":::: ips bombnofa - modsec_threats_local "$PDOMHIP"" | geoip done echo -e ${bldblu}"[Blocking based on http 130 process limit and killing some http processes ]"${txtrst} hostname | grep aserv.co.za && if ps auwfx | grep "/usr/sbin/httpd -k start" | wc -l | awk '($1 > 130)' | grep "[0-9]" ; then ps auwfx | grep "/usr/sbin/httpd -k start" |sort -k3 | grep "S\ " | head -n20 | awk '{print $2}' | xargs -i kill -9 {} netstat -ntu | awk '/tcp|udp/ {print $5}' | sed 's/::ffff://' | cut -d: -f1 | sort | uniq -c | sort -n | geoip | egrep 'CN|TR|EG|CZ|RU|BR|BG|IR|IT|SC' | awk '{print $3}' | xargs -i ipset -q add ddos_ips {} telegram-send "$(hostname) - apache hit 130 processes, investigate" fi } phpuserproclimit_func () { if ps auwfx | grep php | awk '{print $1}' | sort | uniq -c | sort -k1n | grep -v root| awk '$1>=4 {print $0}' | awk '{print $2}' ; then ps auwfx|grep php| awk '{print $1}'| sort|uniq -c|sort -k1n|awk '$1>=4 {print $0}'| awk '{print $2}'| xargs -i grep {} /etc/trueuserdomains | awk -F ":" '{print $1,$2}'| while read pdomain puname ; do cd /home/$puname/public_html/ && frob generosity limits && sed -i 's/^DefaultMaxClassProcessCount.*/DefaultMaxClassProcessCount 3/g' /usr/local/apache/conf/userdata/std/2/$puname/$pdomain/generosity.conf ps auwfx| grep $puname | grep php | awk '{print $2}'| xargs -i kill -9 {} /usr/local/cpanel/bin/rebuild_phpconf 5 none fcgi enabled frob rebuild frob runphpinstall done fi } # domhammerautofileacc_func loadstats_func () { echo -e "\n====== CPU LOAD STATS ====== \n\n $(ps auwfx | sort -k3n | tail -100)\n\n==========MEM LOAD STATS================\n\n $(free -m) \n $(ps auwfx| sort -k4n | tail -100)\n\n ================== Process count stats ================= \n\n ::PHP processes:: \n$(ps auwfx| grep php | awk '{print $1}' | sort | uniq -c | sort -k1n)\n\n ::http processes::\n$(ps uawfx| grep http |wc -l) \n\n ========== Current IPs Connected ========== \n\n$(netstat -ntu | awk '/tcp|udp/ {print $5}' | sed 's/::ffff://' | cut -d: -f1 |sort|uniq -c|sort -n| tail -50)\n\n ============== Disk Stats =========== $(iostat -xtcdm 2 2) \n\n ======== my.cnf ======= \n\n === swappiness ====$(sysctl -a | grep swap)" | geoip } ipsetgrouplistips_func () { echo -e "\n$(ipset list $GROUPARG)\n" | geoip } applyfpm_limits () { if [ -f /etc/php-fpm-exclude ] ; then grep "$FPMSETARG" /etc/userdomains | egrep -v "$(cat /etc/php-fpm-exclude)" | awk -F ": " '{print $1,$2}' | while read pdom pusername ; do cp /usr/local/afribin/configs/cpanel_php_fpm/default.php-fpm.yaml /var/cpanel/userdata/"$pusername"/"$pdom".php-fpm.yaml /scripts/php_fpm_config --rebuild --domain="$pdom" echo "apache fpm dynamic config file ::: $(find /opt/cpanel/ea-php* | grep $pdom)" done else grep "$FPMSETARG" /etc/userdomains | awk -F ": " '{print $1,$2}' | while read pdom pusername ; do cp /usr/local/afribin/configs/cpanel_php_fpm/default.php-fpm.yaml /var/cpanel/userdata/"$pusername"/"$pdom".php-fpm.yaml /scripts/php_fpm_config --rebuild --domain="$pdom" echo -e "apache fpm dynamic config file ::: $(find /opt/cpanel/ea-php* | grep $pdom)\n - file used to build fpm config file /var/cpanel/userdata/"$pusername"/"$pdom".php-fpm.yaml" done fi } applyfpm_limits_performance () { grep "$FPMSETARG" /etc/userdomains | awk -F ": " '{print $1,$2}' | while read pdom pusername ; do cp /usr/local/afribin/configs/cpanel_php_fpm/performance.default.php-fpm.yaml /var/cpanel/userdata/"$pusername"/"$pdom".php-fpm.yaml /scripts/php_fpm_config --rebuild --domain="$pdom" echo -e "apache fpm dynamic config file ::: $(find /opt/cpanel/ea-php* | grep $pdom)\n - file used to build fpm config file /var/cpanel/userdata/"$pusername"/"$pdom".php-fpm.yaml" done } applyfpm_limits_auto () { if [ -f /etc/php-fpm-exclude ] ; then ps auwfx | grep php-cgi | egrep -v "$(cat /etc/php-fpm-exclude)" | awk '{print $1}' | sort | uniq | egrep -v 'dovecot|cpanelr|root' | while read puname ; do grep $puname /etc/trueuserdomains| awk -F ":" '{print $1,$2}' | while read ppdom ppuname ; do cp /usr/local/afribin/configs/cpanel_php_fpm/default.php-fpm.yaml /var/cpanel/userdata/"$ppuname"/"$ppdom".php-fpm.yaml ; /scripts/php_fpm_config --rebuild --domain="$ppdom" ; done ; done else ps auwfx | grep php-cgi | awk '{print $1}' | sort | uniq | egrep -v 'dovecot|cpanelr|root' | while read puname ; do grep $puname /etc/trueuserdomains| awk -F ":" '{print $1,$2}' | while read ppdom ppuname ; do cp /usr/local/afribin/configs/cpanel_php_fpm/default.php-fpm.yaml /var/cpanel/userdata/"$ppuname"/"$ppdom".php-fpm.yaml ; /scripts/php_fpm_config --rebuild --domain="$ppdom" ; done ; done fi } fpmlimitscheck_errorlog () { for i in $(grep httpd-UDS /usr/local/apache/logs/error_log | domaingrep | sort | uniq | grep -v ".php\|www\|.html\|whois" ) ; do grep $i /etc/trueuserdomains | egrep -v "$(cat /etc/php-fpm-exclude)" ; done | awk -F ":" '{print $1,$2}' | while read pdom puname ; do ips applyfpm $puname ; done } usage_short() { cat <