The FreeBSD Diary

The FreeBSD Diary (TM)

Providing practical examples since 1998

If you buy from Amazon USA, please support us by using this link.
[ HOME | TOPICS | INDEX | WEB RESOURCES | BOOKS | CONTRIBUTE | SEARCH | FEEDBACK | FAQ | FORUMS ]
Scripts / handy tips
 New Topic  |  Go to Top  |  Go to Topic  |  Search  |  Log In   Previous Message  |  Next Message 
 Adding blocked hosts to multiple systems
Author: el_kab0ng 
Date:   22-01-02 01:10

Ever had a machine that used snort/portsentry and blackhole to maintain a list of blocked hosts on a machine?

I got tired of manually adding networks to the null route (blackhole), so I developed a decent way to automate this into one command.

First, some background:

normally the command is run like so:

route add -net IP -netmask IP 127.0.0.1 -blackhole

This in effect lists them in a netstat -arn as:

IP/32 127.0.01

In any event, I have 3 servers, all running different services for my network. What hits one machine, usually hits the rest as well. To make sure all machines have a current blocked list, I have developed the following script. It's simple, but effective.

#!/bin/sh
netstat -arn | grep 127 | awk '{print $1}' | sed 's/\/.*$//' | grep -v 127.0.0.1 > /path/to/blocked.txt
for IP in `cat /path/to/blocked.txt` ; do
route add -net $IP -netmask 255.255.255.255 127.0.0.1 -blackhole
done


I'm sure this very basic script can be improved upon, but I figured I'd post it anyway... just for those who wanted it.

 Reply To This Message  |  Forum List  |  Flat View   Newer Topic  |  Older Topic 

 Topics Author  Date
 Adding blocked hosts to multiple systems   new
el_kab0ng 22-01-02 01:10 
 Re: Adding blocked hosts to multiple systems   new
el_kab0ng 22-01-02 01:13 
 Re: Adding blocked hosts to multiple systems   new
el_kab0ng 22-01-02 01:17 
 Re: Adding blocked hosts to multiple systems   new
william cooper 22-01-02 15:00 
 Re: Adding blocked hosts to multiple systems   new
el_kab0ng 22-01-02 20:06 
 Re: Adding blocked hosts to multiple systems   new
Jeff Pabian 23-01-02 07:54 
 Re: Adding blocked hosts to multiple systems   new
Jeff Pabian 23-01-02 07:55 
 Re: Adding blocked hosts to multiple systems   new
Sunil 02-02-02 05:04 
 Re: Adding blocked hosts to multiple systems   new
el_kab0ng 12-04-02 16:25 


 Forum List  |  Need a Login? Register Here 
 User Login
 User Name:
 Password:
 Remember my login:
   
 Forgot Your Password?
Enter your email address or user name below and a new password will be sent to the email address associated with your profile.
How to get the most out of the forum

phorum.org