alanorth/ansible-personal
1
0
Fork 0
Code Issues 4 Pull Requests Projects Releases Wiki Activity
919fbbbcd9
ansible-personal/roles/common/files/abusers-ipv6.xml

13 lines
444 B
XML
Raw Normal View History

roles/common: Add ipsets of abusive IPs to firewalld This uses the ipsets feature of the Linux kernel to create lists of IPs (though could be MACs, IP:port, etc) that we can block via the existing firewalld zone we are already using. In my testing it works on CentOS 7, Ubuntu 16.04, and Ubuntu 18.04. The list of abusive IPs currently comes from HPC's systemd journal, where I filtered for hosts that had attempted and failed to log in over 100 times. The list is formatted with tidy, for example: $ tidy -xml -iq -m -w 0 roles/common/files/abusers-ipv4.xml See: https://firewalld.org/2015/12/ipset-support
2019-10-05 11:28:30 +02:00
<?xml version="1.0" encoding="utf-8"?>
roles/common: Update list of abusive IP addresses This comes from the AbuseIPDB with a confidence level of 95%. I use the following command to download and sort the IPs: $ curl -G https://api.abuseipdb.com/api/v2/blacklist -d confidenceMinimum=95 -H "Key: $ABUSEIPDB_API_KEY" -H "Accept: text/plain" | sort > /tmp/ips.txt I manually remove the IPv6 addresses and save them to a different filr, then I add the XML formatting to files and run them through tidy.
2019-10-26 17:09:18 +02:00
<ipset type="hash:ip">
<option name="family" value="inet6" />
roles/common: Fix short name of abusers-ipv6 ipset
2019-10-17 21:04:00 +02:00
<short>abusers-ipv6</short>
roles/common: Add ipsets of abusive IPs to firewalld This uses the ipsets feature of the Linux kernel to create lists of IPs (though could be MACs, IP:port, etc) that we can block via the existing firewalld zone we are already using. In my testing it works on CentOS 7, Ubuntu 16.04, and Ubuntu 18.04. The list of abusive IPs currently comes from HPC's systemd journal, where I filtered for hosts that had attempted and failed to log in over 100 times. The list is formatted with tidy, for example: $ tidy -xml -iq -m -w 0 roles/common/files/abusers-ipv4.xml See: https://firewalld.org/2015/12/ipset-support
2019-10-05 11:28:30 +02:00
<description>A list of abusive IPv6 addresses.</description>
roles/common: Update list of abusive IP addresses This comes from the AbuseIPDB with a confidence level of 95%. I use the following command to download and sort the IPs: $ curl -G https://api.abuseipdb.com/api/v2/blacklist -d confidenceMinimum=95 -H "Key: $ABUSEIPDB_API_KEY" -H "Accept: text/plain" | sort > /tmp/ips.txt I manually remove the IPv6 addresses and save them to a different filr, then I add the XML formatting to files and run them through tidy.
2019-10-26 17:09:18 +02:00
<entry>2001:41d0:1000:e68::</entry>
<entry>2001:bc8:4734:a70d::1</entry>
<entry>240e:f7:4f01:c::3</entry>
<entry>2607:5300:60:520a::</entry>
<entry>2607:5300:60:6d87::</entry>
<entry>2a03:7380:380f:4:20c:29ff:fe20:15b5</entry>
roles/common: Add ipsets of abusive IPs to firewalld This uses the ipsets feature of the Linux kernel to create lists of IPs (though could be MACs, IP:port, etc) that we can block via the existing firewalld zone we are already using. In my testing it works on CentOS 7, Ubuntu 16.04, and Ubuntu 18.04. The list of abusive IPs currently comes from HPC's systemd journal, where I filtered for hosts that had attempted and failed to log in over 100 times. The list is formatted with tidy, for example: $ tidy -xml -iq -m -w 0 roles/common/files/abusers-ipv4.xml See: https://firewalld.org/2015/12/ipset-support
2019-10-05 11:28:30 +02:00
</ipset>
Reference in New Issue Copy Permalink