blockauth/README.md

# blockauth

`Tool that blocks IPs that make ssh connection attempts by reading the auth.log file (rsyslog).`

## Install dependencies (Ubuntu/Debian):

```
sudo apt install iptables ipset rsyslog grep sed
```

## How to install blockauth:

```
git clone https://git.q3aql.dev/q3aql/blockauth.git
cd blockauth
sudo ./install.sh
```

## How to unninstall blockauth:

```
git clone https://git.q3aql.dev/q3aql/blockauth.git
cd blockauth
sudo ./unninstall.sh
```

## How to run service:

  * First, edit the file `/etc/blockauth/blockauth.conf`:

    ```shell
    # Blockauth configuration file
    valid_users="test1 test2"
    always_ip_allowed="192.168.0.1 192.168.0.2"
    blocklist="/etc/blockauth/blocklist.list"
    filelog="/etc/blockauth/blockauth.log"
    max_ip_blocklist="5000"
    block_ports="22,80,443"
    ````

  * Add the service to the system startup and start it:
    
  ```shell
  systemctl enable blockauth
  systemctl start blockauth
  ````

  * IPs using one of the users in `valid_users` variable will never be blocked.
  * IPs of `always_ip_allowed` variable will never be blocked.
  * Variable `max_ip_blocklist` set maximum IPs on blocklist. The blocklist will be reset when the maximum is reached.

## External links:

* [iptables](https://www.netfilter.org/projects/iptables/index.html)
* [rsyslog](https://www.rsyslog.com/)
* [ipset](https://ipset.netfilter.org/)