Stopping malicious web spiders and Windows exploits with iptables

Tuesday, September 18th, 2001 at 12:00 am | 799 views | trackback url

Stop it cold
Change your logfile names to suit.

#!/bin/sh 
##For whatever they're calling this one now
for LUSER in `grep "winnt" error.log | awk '{print $8}' | 
    sed -e s/]//`; do 
   if [ ! "`/sbin/iptables -L -n | grep $LUSER`" ]; then
      echo "Banning $LUSER with iptables";
      /sbin/iptables -A INPUT -s $LUSER -d 0/0 -j DROP
   fi 
done 

##For our friend CodeRed
for LUSER in `grep "default.ida" access.log | 
    awk '{print $1}' | sed -e s/]//`; do 
   if [ ! "`/sbin/iptables -L -n | grep $LUSER`" ]; then
      echo "Banning $LUSER with iptables";
      /sbin/iptables -A INPUT -s $LUSER -d 0/0 -j DROP
   fi 
done

Last Modified: Tuesday, September 18th, 2001 @ 00:00

Leave a Reply

You must be logged in to post a comment.

Bad Behavior has blocked 185 access attempts in the last 7 days.