<commit_before>#!/bin/bash

# autoban is a tool to parse through auth-log and ban IPs attempting to brute force ssh access
#
# WARNING: DO NOT USE THIS TOOL AS A PRIMARY DEFENSE. USE THIS TOOL AT YOUR OWN RISK
#
# This tool looks for IPs that have failed to log in 10 or more times (by default) and bans them using iptables
# 
# This tool requires superuser privileges
#
# Author: <NAME> <<EMAIL>>
# GitHub: <https://github.com/jdmoore>
# Last Edited: November 22, 2016
#
# This software is covered by the Apache2 license http://www.apache.org/licenses/LICENSE-2.0.txt

# [ Configurations ]
# Directory in which logs will be created
logdir="/var/log/autoban/"
# Maximum number of retries an IP can fail at root login before being banned, a la fail2ban <http://www.fail2ban.org/>
maxretry=10

# Confirm superuser privileges
if [ $(id -u) != "0" ]; then
	echo "User $USER does not have privileges to run this command"
	echo Exiting >> $logfile
	exit 1
fi 

# Generate log directory if necessary
if [ ! -d "$logdir" ]; then
	echo "Creating log directory: $logdir"
	mkdir /var/log/autoban/
fi

# Generate date stamp
stamp=$(date | awk '{print $2 "-" $3 "-" $6}')

# Set logfile path
logfile="${logdir}autoban-${stamp}"

# Date entry
date >> $logfile

# Get list of IPs that failed to log into root
grep "Failed.password.for" /var/log/auth.log | grep root | awk '{print $11}' | sort -u > /root/possibleOffenders.txt

# Read list of possible offenses
while read -r posOff
do
	# Count the number of times an IP failed to log into root
    accessCount=$(grep "Failed.password.for" /var/log/auth.log | grep $posOff | wc | awk '{print $1}')
    if (( "$accessCount" > 10 )); then
    	# Add IPs to the ban list if they've failed an unreasonable number of times
    	echo "Definite abuse: $posOff added to list for $accessCount attempts" >> $logfile
    	echo $posOff >> /root/tmp.txt
    else
    	# Otherwise, flag them
    	echo "Possible abuse: $posOff tried $accessCount times" >> $logfile
    fi
done <"/root/possibleOffenders.txt"


# Get list of IPs that failed to log into invalid accounts
grep "Failed.password.for" /var/log/auth.log | grep invalid | awk '{print $13}' | sort -u >> /root/tmp.txt

# Remove duplicates
sort -u /root/tmp.txt > /root/offendingIPs.txt

# Get list of banned IPs
banned=$(iptables -S | grep "j.DROP" | awk '{print $4}')

# Check offending IPs against the list of banned IPs
while read -r offender
do
    # Skip IPs that are already banned
    if [[ $banned == *"${offender}"* ]]; then
    	#echo "Match found for $offender in banned IPs" >> $logfile
    	continue
    fi
   
    # Ban any IP not already banned
    echo "NO MATCH for $offender. Banning..." >> $logfile
    iptables -A INPUT -s $offender -j DROP

done <"/root/offendingIPs.txt"

# Clean up
rm /root/tmp.txt
rm /root/possibleOffenders.txt
rm /root/offendingIPs.txt<commit_msg>Omit "message repeated" from autoban root attempt log<commit_after>#!/bin/bash

# autoban is a tool to parse through auth-log and ban IPs attempting to brute force ssh access
#
# WARNING: DO NOT USE THIS TOOL AS A PRIMARY DEFENSE. USE THIS TOOL AT YOUR OWN RISK
#
# This tool looks for IPs that have failed to log in 10 or more times (by default) and bans them using iptables
# 
# This tool requires superuser privileges
#
# Author: <NAME> <<EMAIL>>
# GitHub: <https://github.com/jdmoore>
# Last Edited: November 22, 2016
#
# This software is covered by the Apache2 license http://www.apache.org/licenses/LICENSE-2.0.txt

# [ Configurations ]
# Directory in which logs will be created
logdir="/var/log/autoban/"
# Maximum number of retries an IP can fail at root login before being banned, a la fail2ban <http://www.fail2ban.org/>
maxretry=10

# Confirm superuser privileges
if [ $(id -u) != "0" ]; then
	echo "User $USER does not have privileges to run this command"
	echo Exiting >> $logfile
	exit 1
fi 

# Generate log directory if necessary
if [ ! -d "$logdir" ]; then
	echo "Creating log directory: $logdir"
	mkdir /var/log/autoban/
fi

# Generate date stamp
stamp=$(date | awk '{print $2 "-" $3 "-" $6}')

# Set logfile path
logfile="${logdir}autoban-${stamp}"

# Date entry
date >> $logfile

# Get list of IPs that failed to log into root
grep "Failed.password.for" /var/log/auth.log | grep root | grep -v "message.repeated" | awk '{print $11}' | sort -u > /root/possibleOffenders.txt

# Read list of possible offenses
while read -r posOff
do
	# Count the number of times an IP failed to log into root
    accessCount=$(grep "Failed.password.for" /var/log/auth.log | grep $posOff | wc | awk '{print $1}')
    if (( "$accessCount" > 10 )); then
    	# Add IPs to the ban list if they've failed an unreasonable number of times
    	echo "Definite abuse: $posOff added to list for $accessCount attempts" >> $logfile
    	echo $posOff >> /root/tmp.txt
    else
    	# Otherwise, flag them
    	echo "Possible abuse: $posOff tried $accessCount times" >> $logfile
    fi
done <"/root/possibleOffenders.txt"


# Get list of IPs that failed to log into invalid accounts
grep "Failed.password.for" /var/log/auth.log | grep invalid | awk '{print $13}' | sort -u >> /root/tmp.txt

# Remove duplicates
sort -u /root/tmp.txt > /root/offendingIPs.txt

# Get list of banned IPs
banned=$(iptables -S | grep "j.DROP" | awk '{print $4}')

# Check offending IPs against the list of banned IPs
while read -r offender
do
    # Skip IPs that are already banned
    if [[ $banned == *"${offender}"* ]]; then
    	#echo "Match found for $offender in banned IPs" >> $logfile
    	continue
    fi
   
    # Ban any IP not already banned
    echo "NO MATCH for $offender. Banning..." >> $logfile
    iptables -A INPUT -s $offender -j DROP

done <"/root/offendingIPs.txt"

# Clean up
rm /root/tmp.txt
rm /root/possibleOffenders.txt
rm /root/offendingIPs.txt
{'fraction_non_alphanumeric': 0.11631914526968809, 'fraction_numerical': 0.009650180940892641, 'mean_word_length': 3.4714946070878274, 'pattern_counts': {'":': 0, '<': 17, '<?xml version=': 0, '>': 51, 'https://': 2, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7347338', 'n_tokens_mistral': 1986, 'n_tokens_neox': 1890, 'n_words': 753}