diff --git a/blacklist b/blacklist new file mode 100644 index 00000000..5bda6f2b --- /dev/null +++ b/blacklist @@ -0,0 +1,42 @@ +#!/bin/bash +# Found here +IP_TMP=/tmp/ip.tmp +IP_BLACKLIST=/etc/ip-blacklist.conf +IP_BLACKLIST_TMP=/tmp/ip-blacklist.tmp +IP_BLACKLIST_CUSTOM=/etc/ip-blacklist-custom.conf # optional +list="chinese nigerian russian lacnic exploited-servers" +BLACKLISTS=( +"http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1" # Project Honey Pot Directory of Dictionary Attacker IPs +"http://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.1.1.1" # TOR Exit Nodes +"http://www.maxmind.com/en/anonymous_proxies" # MaxMind GeoIP Anonymous Proxies +"http://danger.rulez.sk/projects/bruteforceblocker/blist.php" # BruteForceBlocker IP List +"http://rules.emergingthreats.net/blockrules/rbn-ips.txt" # Emerging Threats - Russian Business Networks List +"http://www.spamhaus.org/drop/drop.lasso" # Spamhaus Don't Route Or Peer List (DROP) +"http://cinsscore.com/list/ci-badguys.txt" # C.I. Army Malicious IP List +"http://www.openbl.org/lists/base.txt" # OpenBL.org 30 day List +"http://www.autoshun.org/files/shunlist.csv" # Autoshun Shun List +"http://lists.blocklist.de/lists/all.txt" # blocklist.de attackers +) +for i in "${BLACKLISTS[@]}" +do + curl "$i" > $IP_TMP + grep -Po '(?:\d{1,3}\.){3}\d{1,3}(?:/\d{1,2})?' $IP_TMP >> $IP_BLACKLIST_TMP +done +for i in `echo $list`; do + # Download + wget --quiet http://www.wizcrafts.net/$i-iptables-blocklist.html + # Grep out all but ip blocks + cat $i-iptables-blocklist.html | grep -v \< | grep -v \: | grep -v \; | grep -v \# | grep [0-9] > $i.txt + # Consolidate blocks into master list + cat $i.txt >> $IP_BLACKLIST_TMP +done + +sort $IP_BLACKLIST_TMP -n | uniq > $IP_BLACKLIST +rm $IP_BLACKLIST_TMP +wc -l $IP_BLACKLIST + +ipset flush blacklist +egrep -v "^#|^$" $IP_BLACKLIST | while IFS= read -r ip +do + ipset add blacklist $ip +done diff --git a/blocklist.txt b/blocklist.txt deleted file mode 100644 index f0c4b4f2..00000000 --- a/blocklist.txt +++ /dev/null @@ -1,7 +0,0 @@ -http://lists.blocklist.de/lists/ssh.txt -http://lists.blocklist.de/lists/bruteforcelogin.txt -http://lists.blocklist.de/lists/imap.txt -http://lists.blocklist.de/lists/mail.txt -http://lists.blocklist.de/lists/postfix.txt -http://lists.blocklist.de/lists/apache.txt -http://lists.blocklist.de/lists/email.txt diff --git a/install.sh b/install.sh index 80fda002..29cae284 100755 --- a/install.sh +++ b/install.sh @@ -11,12 +11,12 @@ if [[ $EUID -ne 0 ]]; then echo exit fi -cp sync-fail2ban /etc/cron.daily/sync-fail2ban -mkdir /etc/iptables -cp blocklist.txt /etc/iptables/blocklist.txt -chmod a+x /etc/cron.daily/sync-fail2ban -time /etc/cron.daily/sync-fail2ban echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections apt-get update +apt-get install -y ipset +ipset create blacklist hash:net +cp blacklist /etc/cron.daily/blacklist +chmod a+x /etc/cron.daily/blacklist +time /etc/cron.daily/blacklist apt-get install -y iptables-persistent