<commit_before>#!/bin/sh
# ====================================================================
# Written by <NAME>
# for www.plugins-da.net
# block_ip.sh script to run BFM (Directadmin) with CSF/LFD
# ====================================================================
# Version: 0.1.6 Sun May  1 16:52:02 NOVT 2016
# Last modified: Sun May  1 16:52:02 NOVT 2016
# ====================================================================
# Version: 0.1.5 Mon Apr 25 11:30:01 NOVT 2016
# Changes: A switcher USE_PORT_SELECTED_BLOCK added
# ====================================================================
# Version: 0.1.4 Thu Jan 14 19:20:39 NOVT 2016
# Changes: grep replaced with egrep to support old format of
#          /root/block_ips.txt, when IP comes w/out date.
#          A switcher CSF_GREP_API_CALL added
# ====================================================================
#
USE_PORT_SELECTED_BLOCK=1;  # SET TO 1 OR 0
                            # 1: TO BAN ACCESS ONLY TO A PORT WHICH
                            #    WAS BRUTEFORCED
                            # 0: TO BLOCK ACCESS TO ALL PORTS
                            #
                            # NOTICE: MANUAL TRIGGER FROM DIRECTADMIN
                            # WILL STILL BLOCK ACCESS TO ALL PORTS
                            # FOR AN IP

CSF_GREP_API_CALL=0;        # SET TO 1 TO USE API CALL TO CSF
                            # WHEN SEARCHING AN IP AGAINST BLOCKLIST
                            # SET TO 0 (ZERO) TO GREP A FILE DIRECTLY
                            # 1 - MORE ACCURATE, USE csf
                            # 0 - MORE SPEEDY, USE egrep
# ====================================================================

BF="/root/blocked_ips.txt";
EF="/root/exempt_ips.txt";
SLF="/usr/local/directadmin/data/admin/brute_skip.list";
CAF="/etc/csf/csf.allow";
CATF="/var/lib/csf/csf.tempallow";
CDF="/etc/csf/csf.deny";
CDTF="/var/lib/csf/csf.tempban";

CSF="/usr/sbin/csf";

FTP_PORTS="20 21";
SSH_PORTS="22";
WEB_PORTS="80 443";
EXIM_PORTS="25 465 587";
DOVECOT_PORTS="110 143 993 995";
DIRECTADMIN_PORTS="2222";

function detect_attacked_service()
{
    # FTP
    c=`echo "${data}" | grep -c ftpd[1,2]=`;
    if [ "${c}" -gt "0" ]; then
        echo "${FTP_PORTS}";
        return 0;
    fi;

    # SSH
    c=`echo "${data}" | grep -c ssh[1,2]=`;
    if [ "${c}" -gt "0" ]; then
        echo "${SSH_PORTS}";
        return 0;
    fi;

    # WEB
    c=`echo "${data}" | grep -c wordpress[1,2]=`;
    if [ "${c}" -gt "0" ]; then
        echo "${WEB_PORTS}";
        return 0;
    fi;

    # EXIM
    c=`echo "${data}" | grep -c exim[1,2]=`;
    if [ "${c}" -gt "0" ]; then
        echo "${EXIM_PORTS}";
        return 0;
    fi;

    # DOVECOT
    c=`echo "${data}" | grep -c dovecot[1,2]=`;
    if [ "${c}" -gt "0" ]; then
        echo "${DOVECOT_PORTS}";
        return 0;
    fi;

    # DIRECTADMIN
    c=`echo "${data}" | grep -c directadmin[1,2]=`;
    if [ "${c}" -gt "0" ]; then
        echo "${DIRECTADMIN_PORTS}";
        return 0;
    fi;

    echo "0";
    return 1;
}

if [ -z "${ip}" ];
then
    echo "[ERROR] We've got no IP to block! Terminating...";
    exit 1;
fi;

if [ ! -x "${CSF}" ] || [ ! -f "${CDF}" ];
then
    echo "[ERROR] CSF/LFD was not found on your server! Terminating...";
    exit 2;
fi;

[ -e "${BF}" ] || touch "${BF}";
[ -e "${EF}" ] || touch "${EF}";


# SHOULD WE NEED TO BLOCK ACCESS ONLY TO SELECTED PORTS
# WE NEED FIRST DETECT WHAT SERVICE IS UNDER A BRUTEFORCE ATTACK
if [ "${USE_PORT_SELECTED_BLOCK}" == "1" ];
then
    TTL=`/usr/local/directadmin/directadmin c | grep unblock_brute_ip_time= | cut -d\= -f2`;
    TTL=$((TTL*3*60)); # It is Directadmin which unblocks IP, so we need to have enough long TTL
                       # so that Directadmin have a chance to unblock it
                       # Additionaly convert minutes to seconds *60
    BLOCK_PORTS="";

    # We should have data= from Directadmin in order to detect 
    # what service was bruteforced
    # If there was no data= passed to the script we set USE_PORT_SELECTED_BLOCK to 0
    if [ -z "${data}" ];
    then
        USE_PORT_SELECTED_BLOCK=0;
    else
        BLOCK_PORTS=`detect_attacked_service`;<commit_msg>A support for TTL=0 (in Directadmin) added<commit_after>#!/bin/sh
# ====================================================================
# Written by <NAME>
# for www.plugins-da.net
# block_ip.sh script to run BFM (Directadmin) with CSF/LFD
# ====================================================================
# Version: 0.1.7 Mon Aug  8 18:06:23 +07 2016
# Last modified: Mon Aug  8 18:06:23 +07 2016
# ====================================================================
# Version: 0.1.7 Mon Aug  8 18:06:23 +07 2016
# Bugfix:  A support for TTL=0 (in Directadmin) added
# ====================================================================
# Version: 0.1.5 Mon Apr 25 11:30:01 NOVT 2016
# Changes: A switcher USE_PORT_SELECTED_BLOCK added
# ====================================================================
# Version: 0.1.4 Thu Jan 14 19:20:39 NOVT 2016
# Changes: grep replaced with egrep to support old format of
#          /root/block_ips.txt, when IP comes w/out date.
#          A switcher CSF_GREP_API_CALL added
# ====================================================================
#
USE_PORT_SELECTED_BLOCK=1;  # SET TO 1 OR 0
                            # 1: TO BAN ACCESS ONLY TO A PORT WHICH
                            #    WAS BRUTEFORCED
                            # 0: TO BLOCK ACCESS TO ALL PORTS
                            #
                            # NOTICE: MANUAL TRIGGER FROM DIRECTADMIN
                            # WILL STILL BLOCK ACCESS TO ALL PORTS
                            # FOR AN IP

CSF_GREP_API_CALL=0;        # SET TO 1 TO USE API CALL TO CSF
                            # WHEN SEARCHING AN IP AGAINST BLOCKLIST
                            # SET TO 0 (ZERO) TO GREP A FILE DIRECTLY
                            # 1 - MORE ACCURATE, USE csf
                            # 0 - MORE SPEEDY, USE egrep
# ====================================================================

BF="/root/blocked_ips.txt";
EF="/root/exempt_ips.txt";
SLF="/usr/local/directadmin/data/admin/brute_skip.list";
CAF="/etc/csf/csf.allow";
CATF="/var/lib/csf/csf.tempallow";
CDF="/etc/csf/csf.deny";
CDTF="/var/lib/csf/csf.tempban";

CSF="/usr/sbin/csf";

FTP_PORTS="20 21";
SSH_PORTS="22";
WEB_PORTS="80 443";
EXIM_PORTS="25 465 587";
DOVECOT_PORTS="110 143 993 995";
DIRECTADMIN_PORTS="2222";

function detect_attacked_service()
{
    # FTP
    c=`echo "${data}" | grep -c ftpd[1,2]=`;
    if [ "${c}" -gt "0" ]; then
        echo "${FTP_PORTS}";
        return 0;
    fi;

    # SSH
    c=`echo "${data}" | grep -c ssh[1,2]=`;
    if [ "${c}" -gt "0" ]; then
        echo "${SSH_PORTS}";
        return 0;
    fi;

    # WEB
    c=`echo "${data}" | grep -c wordpress[1,2]=`;
    if [ "${c}" -gt "0" ]; then
        echo "${WEB_PORTS}";
        return 0;
    fi;

    # EXIM
    c=`echo "${data}" | grep -c exim[1,2]=`;
    if [ "${c}" -gt "0" ]; then
        echo "${EXIM_PORTS}";
        return 0;
    fi;

    # DOVECOT
    c=`echo "${data}" | grep -c dovecot[1,2]=`;
    if [ "${c}" -gt "0" ]; then
        echo "${DOVECOT_PORTS}";
        return 0;
    fi;

    # DIRECTADMIN
    c=`echo "${data}" | grep -c directadmin[1,2]=`;
    if [ "${c}" -gt "0" ]; then
        echo "${DIRECTADMIN_PORTS}";
        return 0;
    fi;

    echo "0";
    return 1;
}

if [ -z "${ip}" ];
then
    echo "[ERROR] We've got no IP to block! Terminating...";
    exit 1;
fi;

if [ ! -x "${CSF}" ] || [ ! -f "${CDF}" ];
then
    echo "[ERROR] CSF/LFD was not found on your server! Terminating...";
    exit 2;
fi;

[ -e "${BF}" ] || touch "${BF}";
[ -e "${EF}" ] || touch "${EF}";


# SHOULD WE NEED TO BLOCK ACCESS ONLY TO SELECTED PORTS
# WE NEED FIRST DETECT WHAT SERVICE IS UNDER A BRUTEFORCE ATTACK
if [ "${USE_PORT_SELECTED_BLOCK}" == "1" ];
then
    TTL=`/usr/local/directadmin/directadmin c | grep unblock_brute_ip_time= | cut -d\= -f2`;

    if [ ${TTL} == "0" ];
    then
        TTL="1825d";       # If TTL=0 then IP should be blocked forever
                           # here we set TTL to 5 years = 365d * 5
    else
        TTL=$((TTL*3*60)); # It is Directadmin which unblocks IP, so we need to have enough long TTL
                           # so that Directadmin have a chance to unblock it
                           # Additionaly convert minutes to seconds *60
    fi;
    BLOCK_PORTS="";

    # We should have data= from Directadmin in order to detect 
    # what service was bruteforced
    # If there was no data= passed to the script we set USE_PORT_SELECTED_BLOCK to 0
    if [ -z "${data}" ];
    then
        USE_PORT_SELECTED_BLOCK=0;
    else
        BLOCK_PORTS=`detect_attacked_service`;
{'fraction_non_alphanumeric': 0.22805429864253393, 'fraction_numerical': 0.03472850678733032, 'mean_word_length': 2.333710407239819, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 8, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1005771', 'n_tokens_mistral': 3231, 'n_tokens_neox': 2851, 'n_words': 863}