I recently wrote about the creation of a new utility I created to help manage my pf rules called mcblock. Thus far the most useful part has been the automation of rule addition by grokking logs.<\/p>\n
For example, it can parse auth.log on FreeBSD and automatically add entries to my pf rule database. And before adding the entries, it can show you what it would do. For example:<\/p>\n
\r\n# bzcat \/var\/log\/auth.log.0.bz2 | mcblock -O - \r\n109.24.194.41 194 hits\r\n add 109.24.194\/24 30 days\r\n103.25.133.151 3 hits\r\n add 103.25.133\/24 30 days\r\n210.151.42.215 3 hits\r\n add 210.151.42\/24 30 days\r\n<\/pre>\nWhat I’ve done here is uncompress auth.log.0.z2 to stdout and pipe it to mcblock to see what it would do. mcblock shows that it would add three entries to my pf rule database, each with an expiration 30 days in the future. I can change the number of days with the -d command line option:<\/p>\n
\r\n# bzcat \/var\/log\/auth.log.0.bz2 | mcblock -d 60 -O -\r\n109.24.194.41 194 hits\r\n add 109.24.194\/24 60 days\r\n103.25.133.151 3 hits\r\n add 103.25.133\/24 60 days\r\n210.151.42.215 3 hits\r\n add 210.151.42\/24 60 days\r\n<\/pre>\nBy default, mcblock uses a threshold of 3 entries from a given offending IP address in a log file. This can be changed with the -t argument:<\/p>\n
\r\n# bzcat \/var\/log\/auth.log.0.bz2 | mcblock -t 1 -O - \r\n109.24.194.41 194 hits\r\n add 109.24.194\/24 30 days\r\n103.25.133.151 3 hits\r\n add 103.25.133\/24 30 days\r\n210.151.42.215 3 hits\r\n add 210.151.42\/24 30 days\r\n31.44.244.11 2 hits\r\n add 31.44.244\/24 30 days\r\n<\/pre>\nIf I’m happy with these actions, I can tell mcblock to execute them:<\/p>\n
\r\n# bzcat \/var\/log\/auth.log.0.bz2 | mcblock -t 1 -A -\r\n<\/pre>\nAnd then look at one of the entries it added:<\/p>\n
\r\n# mcblock -s 31.44.244\/24\r\n31.44.244.0\/24 2015\/08\/21 - 2015\/09\/20\r\n<\/pre>\nThis particular address space happens to be from Russia, and is allocated as a \/23. So let’s add the \/23:<\/p>\n
\r\n# mcblock -a 31.44.244\/23\r\n<\/pre>\nAnd then see what entries would match 31.44.244.11:<\/p>\n
\r\n# mcblock -s 31.44.244.11\r\n31.44.244.0\/23 2015\/08\/21 - 2015\/09\/20\r\n<\/pre>\nThe \/24 was replaced by a \/23. Let’s edit this entry to add the registry and the country, and extend the time period:<\/p>\n
\r\n# mcblock -e 31.44.244\/23\r\nstart time [2015\/08\/21 04:37]: \r\nend time [2015\/09\/20 04:37]: 2016\/02\/21 04:37\r\nregistry []: RIPE\r\ncountry []: RU\r\nEntry updated.\r\n<\/pre>\nAnd view again:<\/p>\n
\r\n# mcblock -s 31.44.244.11\r\n31.44.244.0\/23 2015\/08\/21 - 2016\/02\/21 RIPE RU\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"I recently wrote about the creation of a new utility I created to help manage my pf rules called mcblock. Thus far the most useful part has been the automation of rule addition by grokking logs. For example, it can parse auth.log on FreeBSD and automatically add entries to my pf rule database. And before … <\/p>\n