I recently wrote about the creation of a new utility I created to help manage my pf rules called mcblock. Thus far the most useful part has been the automation of rule addition by grokking logs.
For example, it can parse auth.log on FreeBSD and automatically add entries to my pf rule database. And before adding the entries, it can show you what it would do. For example:
# bzcat /var/log/auth.log.0.bz2 | mcblock -O - 109.24.194.41 194 hits add 109.24.194/24 30 days 103.25.133.151 3 hits add 103.25.133/24 30 days 210.151.42.215 3 hits add 210.151.42/24 30 days
What I’ve done here is uncompress auth.log.0.z2 to stdout and pipe it to mcblock to see what it would do. mcblock shows that it would add three entries to my pf rule database, each with an expiration 30 days in the future. I can change the number of days with the -d command line option:
# bzcat /var/log/auth.log.0.bz2 | mcblock -d 60 -O - 109.24.194.41 194 hits add 109.24.194/24 60 days 103.25.133.151 3 hits add 103.25.133/24 60 days 210.151.42.215 3 hits add 210.151.42/24 60 days
By default, mcblock uses a threshold of 3 entries from a given offending IP address in a log file. This can be changed with the -t argument:
# bzcat /var/log/auth.log.0.bz2 | mcblock -t 1 -O - 109.24.194.41 194 hits add 109.24.194/24 30 days 103.25.133.151 3 hits add 103.25.133/24 30 days 210.151.42.215 3 hits add 210.151.42/24 30 days 31.44.244.11 2 hits add 31.44.244/24 30 days
If I’m happy with these actions, I can tell mcblock to execute them:
# bzcat /var/log/auth.log.0.bz2 | mcblock -t 1 -A -
And then look at one of the entries it added:
# mcblock -s 31.44.244/24 31.44.244.0/24 2015/08/21 - 2015/09/20
This particular address space happens to be from Russia, and is allocated as a /23. So let’s add the /23:
# mcblock -a 31.44.244/23
And then see what entries would match 31.44.244.11:
# mcblock -s 31.44.244.11 31.44.244.0/23 2015/08/21 - 2015/09/20
The /24 was replaced by a /23. Let’s edit this entry to add the registry and the country, and extend the time period:
# mcblock -e 31.44.244/23 start time [2015/08/21 04:37]: end time [2015/09/20 04:37]: 2016/02/21 04:37 registry []: RIPE country []: RU Entry updated.
And view again:
# mcblock -s 31.44.244.11 31.44.244.0/23 2015/08/21 - 2016/02/21 RIPE RU