Linux – Block brute-force attack using lastb and iptables

brute-force-attacksfirewalliptableslinuxSecurity

Using linux lastb command, I found that my server is brute-force attacked from many different IPs around the world! I have developed an script to detect brute-force attackers by lastb and block them by iptables. Here is the script:

#!/bin/bash

cd /root/
windowSize=100
tresh=10
lastb | head -n $windowSize | awk '{print $3}' | uniq -c > .ips
nlines=`wc .ips -l | awk '{print $1}'`
END=`expr $nlines - 1 `
for i in `seq 0 $END`;
do
        range=`expr $nlines - $i`
        count=`tail .ips -n $range | head -n 1 | awk '{print $1}'`
        if [ $count -gt $tresh ] ; then
                IP=`tail .ips -n $range | head -n 1 | awk '{print $2}'`
                if [ ! -z .blips ] ; then
                        touch .blips
                fi ;
                blocked=`cat .blips | grep $IP -c`
                if [ $blocked = '0' ] ; then
                        echo blocking $IP
                        iptables -A INPUT -s $IP -j DROP
                        echo $IP >> .blips
                fi ;
        fi;
done
rm .ips

Can it cause any problem if I run this script by crond every hours?

Best Answer

Yes, you are not taking any measures to ensure that the IP addresses you connect to the system from are excluded so you could lock yourself out of the system.

A better solution is to install fail2ban which is widely used to do just what you are trying to do.