Block Brute-Force requests with Firewall Daemon from Bash Script
Firewall Daemon can help to protect against ongoing brute force attacks by detecting attempted attacks on the Linux host. To permanently protect the host from suspicious sources they can be blocked. The following bash script prevent from suspicious requests by append the IP address as argument and set it to reject using firewall-cmd.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
#!/bin/bash # use in a script to reject a source ip given as an argument if [[ $# -eq 0 ]] ; then echo "No argument supplied" echo "use: reject [source ip address]" exit 0 fi echo "$1 to reject" firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="'$1'" reject' firewall-cmd --reload sleep 1 systemctl restart fail2ban sleep 3 firewall-cmd --list-all iptables -vnL |
The script was written on Debian 10 (buster), on Debian firewalld has to be installed first, as well as on Ubuntu 20. On CentOS Linux 7/8 (Core) and Fedora 30 or higher firewalld is standard and the script can be used.
Fail2ban (failure leads to ban) is an IPS framework developed in Python to prevent attacks. It runs on all Unixoid OS that is based on a managable packet filter system or a firewall such as iptables or firewalld on Linux.
line 13, if available and executed, the addresses banned by fail2ban are restored to their previously active state after firewalld has been processed. If fail2ban is not applied, lines 12-14 can be deleted.
|
1 2 |
./reject.sh 12.34.56.78 |
Run the script with append die source IP to reject suspicious requests through the firewall.
The locked IP address can be removed with the following command line in the bash shell.
|
1 2 3 |
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="12.34.56.78" reject' firewall-cmd --reload |
Two commands to display the current state of firewall rules.
|
1 2 3 |
firewall-cmd --list-all iptables -vnL |
