I was wondering is there was any way to be deleted from this Blist.
Or is there some timeout after your IP is deleted if you dont have a compromised computer anymore.

You need the following from CPAN:
Net::IP::Match::XS

Change lines from:
if (!grep { /$IP/ } @{$cfg->{whitelist}}) {

TO:
if (!match_ip( $IP, @{$cfg->{whitelist}})) {

It works well for me so far.

Thanks for a great solution!

BTW, I successfully (8 months) use your script after I succeed adapting it to my needs. You are probably right with suggestion of blocking attackers like in the example above, but I don’t have too much experience with PF and simply afraid some experiments on heavily loaded production server.

What I implemented is 100% transparent and is doing its task well.
Now I can notice only a few BAD attempts daily which is acceptable.

Below I’d like to present my scripts, one might find them useful:

# cat /etc/periodic/hourly/bruteforce_blocker
#!/usr/local/bin/bash
echo>/var/db/www-bruteforce
/etc/rc.d/pf reload
/etc/rc.d/syslogd reload

# cat /usr/local/sbin/apache_syslog
#!/usr/local/bin/perl
# script: apache-access-logger

use Sys::Syslog;
$SERVER_NAME = shift || ‘www’;

$PRIORITY = ‘info’;
$FACILITY = ‘local1′;

Sys::Syslog::setlogsock(‘unix’);
openlog ($SERVER_NAME,’ndelay’, $FACILITY);
while () {
chomp;
syslog($PRIORITY,$_);
}
closelog;

# cat /etc/syslog.conf | grep local1
local1.* /var/log/apache_syslog.log
local1.* |/usr/local/sbin/bruteforceblocker

in apache virtual host
In my apache virtual host conf I have:

SetEnvIf Request_URI “/scripts/scripts” brute_force
CustomLog “|/usr/local/sbin/apache_syslog” combined env=brute_force
CustomLog “/var/log/domain/domain-bruteforce_log” combined env=brute_force

SetEnvIf Request_URI “/includes/includes” brute_force
CustomLog “|/usr/local/sbin/apache_syslog” combined env=brute_force
CustomLog “/var/log/domain/domain-bruteforce_log” combined env=brute_force

my custom bruteforceblocker rules look like this:
/.*www: ($work->{ipv4}|$work->{ipv6}|$work->{fqdn}).*/i ||
/.*ftpd:.*@($work->{ipv4}).*uthentication fail.*/i

the second rule is for pureftpd

Best regards
Norbert

thank you for using my script; however I don’t think it’s a wise idea to use my script for the task you are trying to accomplish. Much more convenient ways would be something like this:

table persist
block quick from

pass inet proto tcp from any to $localnet port {http, https} \
flags S/SA keep state \
(max-src-conn 100, max-src-conn-rate 15/5, \
overload flush global)

together with security/expiretable port to remove old IPs from the table. I hope this helps to you.

I decided to use your scripts to disconnect “crackers” from my server. Although disconnecting is working fine, the time limit doesn’t work and I don;t know why.

Will you find some time helping me.
Below you can find my files, I am running FreeBSD 6.2

In my apache virtual host I have:

SetEnvIf Request_URI “/scripts/scripts” brute_force
CustomLog “|/usr/local/sbin/apache_syslog” combined env=brute_force
CustomLog “/var/log/domain/domain-bruteforce_log” combined env=brute_force

SetEnvIf Request_URI “/includes/includes” brute_force
CustomLog “|/usr/local/sbin/apache_syslog” combined env=brute_force
CustomLog “/var/log/domain/domain-bruteforce_log” combined env=brute_force

in syslog.conf

local1.* |/usr/local/sbin/bruteforceblock
er
local1.* /var/log/apache_syslog.log

in apache_syslog:
#!/usr/local/bin/perl
# script: apache-access-logger

use Sys::Syslog;
$SERVER_NAME = shift || ‘www’;

$PRIORITY = ‘info’;
$FACILITY = ‘local1′;

Sys::Syslog::setlogsock(‘unix’);
openlog ($SERVER_NAME,’ndelay’, $FACILITY);
while () {
chomp;
syslog($PRIORITY,$_);
}
closelog;

and extra rule in your script
# the core process

while () {
if (/.*Failed password.*from ($work->{ipv4}|$work->{ipv6}|$work->{fqdn}) por
t.*/i ||
/.*Invalid user.*from ($work->{ipv4}|$work->{ipv6}|$work->{fqdn})$/i ||
/.*Did not receive identification string from ($work->{ipv4}|$work->{ipv
6}|$work->{fqdn})$/i ||
/.*Bad protocol version identification .* from ($work->{ipv4}|$work->{ip
v6}|$work->{fqdn})$/i ||
/.*User.*from ($work->{ipv4}|$work->{ipv6}|$work->{fqdn}) not allowed be
cause.*/i ||
/.*www: ($work->{ipv4}|$work->{ipv6}|$work->{fqdn}).*/i ) {

table persist file “/var/db/ssh-bruteforce”

pass in log quick proto tcp from 192.60.128.0/22 to any port ssh
block in log quick proto tcp from to any port ssh

Pretty straightforward. If you want to whitelist more CIDRs, you can also use another table for whitelist. I hope it helps you.
I think I can add this to my TODO list, but I am nowadays a bit too much busy so it might take some time to implement by me. By the way, I suppose the implementation shouldn’t be hard using e.g. Net::CIDR perl extension….