57 lines
1.4 KiB
Markdown
57 lines
1.4 KiB
Markdown
# blockauth
|
|
|
|
`Tool that blocks IPs that make ssh connection attempts by reading the auth.log file (rsyslog).`
|
|
|
|
## Install dependencies (Ubuntu/Debian):
|
|
|
|
```
|
|
sudo apt install iptables ipset rsyslog grep sed
|
|
```
|
|
|
|
## How to install blockauth:
|
|
|
|
```
|
|
git clone https://gitlab.com/q3aql/blockauth.git
|
|
cd blockauth
|
|
sudo ./install.sh
|
|
```
|
|
|
|
## How to unninstall blockauth:
|
|
|
|
```
|
|
git clone https://gitlab.com/q3aql/blockauth.git
|
|
cd blockauth
|
|
sudo ./unninstall.sh
|
|
```
|
|
|
|
## How to run service:
|
|
|
|
* First, edit the file `/etc/blockauth/blockauth.conf`:
|
|
|
|
```shell
|
|
# Blockauth configuration file
|
|
valid_users="test1 test2"
|
|
always_ip_allowed="192.168.0.1 192.168.0.2"
|
|
blocklist="/etc/blockauth/blocklist.list"
|
|
filelog="/etc/blockauth/blockauth.log"
|
|
max_ip_blocklist="5000"
|
|
block_ports="22,80,443"
|
|
````
|
|
|
|
* Add the service to the system startup and start it:
|
|
|
|
```shell
|
|
systemctl enable blockauth
|
|
systemctl start blockauth
|
|
````
|
|
|
|
* IPs using one of the users in `valid_users` variable will never be blocked.
|
|
* IPs of `always_ip_allowed` variable will never be blocked.
|
|
* Variable `max_ip_blocklist` set maximum IPs on blocklist. The blocklist will be reset when the maximum is reached.
|
|
|
|
## External links:
|
|
|
|
* [iptables](https://www.netfilter.org/projects/iptables/index.html)
|
|
* [rsyslog](https://www.rsyslog.com/)
|
|
* [ipset](https://ipset.netfilter.org/)
|