debian/ossec-hids/var/ossec/active-response/bin/host-deny.sh

   1 #!/bin/sh
   2 # Adds an IP to the /etc/hosts.deny file
   3 # Requirements: sshd and other binaries with tcp wrappers support
   4 # Expect: srcip
   5 # Author: Daniel B. Cid
   6 # Last modified: Nov 09, 2005
   7
   8 ACTION=$1
   9 USER=$2
  10 IP=$3
  11
  12 LOCAL=`dirname $0`;
  13 cd $LOCAL
  14 cd ../
  15 PWD=`pwd`
  16 LOCK="${PWD}/host-deny-lock"
  17 LOCK_PID="${PWD}/host-deny-lock/pid"
  18 UNAME=`uname`
  19
  20
  21 # This number should be more than enough (even if a hundred
  22 # instances of this script is ran together). If you have
  23 # a really loaded env, you can increase it to 75 or 100.
  24 MAX_ITERATION="50"
  25
  26
  27 # Lock function
  28 lock()
  29 {
  30     i=0;
  31     # Providing a lock.
  32     while [ 1 ]; do
  33         mkdir ${LOCK} > /dev/null 2>&1
  34         MSL=$?
  35         if [ "${MSL}" = "0" ]; then
  36             # Lock acquired (setting the pid)
  37             echo "$$" > ${LOCK_PID}
  38             return;
  39         fi
  40
  41         # Getting currently/saved PID locking the file
  42         C_PID=`cat ${LOCK_PID} 2>/dev/null`
  43         if [ "x" = "x${S_PID}" ]; then
  44             S_PID=${C_PID}
  45         fi
  46
  47         # Breaking out of the loop after X attempts
  48         if [ "x${C_PID}" = "x${S_PID}" ]; then
  49             i=`expr $i + 1`;
  50         fi
  51
  52         sleep $i;
  53
  54         i=`expr $i + 1`;
  55
  56         # So i increments 2 by 2 if the pid does not change.
  57         # If the pid keeps changing, we will increments one
  58         # by one and fail after MAX_ITERACTION
  59         if [ "$i" = "${MAX_ITERATION}" ]; then
  60             echo "`date` Unable to execute. Locked: $0" \
  61                         >> ${PWD}/ossec-hids-responses.log
  62
  63             # Unlocking and exiting
  64             unlock;
  65             exit 1;
  66         fi
  67     done
  68 }
  69
  70 # Unlock function
  71 unlock()
  72 {
  73     rm -rf ${LOCK}
  74 }
  75
  76
  77 # Logging the call
  78 echo "`date` $0 $1 $2 $3 $4 $5" >> ${PWD}/../logs/active-responses.log
  79
  80
  81 # IP Address must be provided
  82 if [ "x${IP}" = "x" ]; then
  83     echo "$0: Missing argument <action> <user> (ip)"
  84     exit 1;
  85 fi
  86
  87
  88 # Checking for invalid entries (lacking "." or ":", etc)
  89 echo "${IP}" | egrep "\.|\:" > /dev/null 2>&1
  90 if [ ! $? = 0 ]; then
  91     echo "`date` Invalid ip/hostname entry: ${IP}" >> ${PWD}/../logs/active-responses.log
  92     exit 1;
  93 fi
  94
  95
  96 # Adding the ip to hosts.deny
  97 if [ "x${ACTION}" = "xadd" ]; then
  98     # Looking for duplication
  99     IPKEY=$(grep -w "${IP}" /etc/hosts.deny)
 100     if [ ! -z "$IPKEY" ]; then
 101         echo "IP ${IP} already exists on host.deny..." >> ${PWD}/../logs/active-responses.log
 102         exit 1
 103     fi
 104     lock;
 105     echo "${IP}" | grep "\:" > /dev/null 2>&1
 106     if [ $? = 0 ]; then
 107         IP="[${IP}]"
 108     fi
 109     if [ "X$UNAME" = "XFreeBSD" ]; then
 110         echo "ALL : ${IP} : deny" >> /etc/hosts.allow
 111     else
 112         echo "ALL:${IP}" >> /etc/hosts.deny
 113     fi
 114     unlock;
 115     exit 0;
 116
 117
 118 # Deleting from hosts.deny
 119 elif [ "x${ACTION}" = "xdelete" ]; then
 120     lock;
 121     TMP_FILE=`mktemp ${PWD}/ossec-hosts.XXXXXXXXXX`
 122     if [ "X${TMP_FILE}" = "X" ]; then
 123         # Cheap fake tmpfile, but should be harder then no random data
 124         TMP_FILE="${PWD}/ossec-hosts.`cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -1 `"
 125     fi
 126     echo "${IP}" | grep "\:" > /dev/null 2>&1
 127     if [ $? = 0 ]; then
 128         IP="\[${IP}\]"
 129     fi
 130     if [ "X$UNAME" = "XFreeBSD" ]; then
 131         cat /etc/hosts.allow | grep -v "ALL : ${IP} : deny$"> ${TMP_FILE}
 132         mv ${TMP_FILE} /etc/hosts.allow
 133     else
 134         cat /etc/hosts.deny | grep -v "ALL:${IP}$"> ${TMP_FILE}
 135         cat ${TMP_FILE} > /etc/hosts.deny
 136         rm ${TMP_FILE}
 137     fi
 138     unlock;
 139     exit 0;
 140
 141
 142 # Invalid action
 143 else
 144     echo "$0: invalid action: ${ACTION}"
 145 fi
 146
 147 exit 1;