]>
git.ipfire.org Git - people/pmueller/ipfire-2.x.git/blob - config/guardian/guardian.pl
2 # based on V 1.7 guardian enhanced for IPFire and snort 2.8
3 # Read the readme file for changes
5 # Enhanced for IPFire by IPFire Team
6 # Added Portscan detection for non syslog system
7 # Added SSH-Watch for SSH-Bruteforce Attacks
8 # An suppected IP will be blocked on all interfaces
12 print "OS shows $OS\n";
17 if (defined($opt_h)) {
18 print "Guardian v1.7 \n";
19 print "guardian.pl [-hd] <-c config>\n";
20 print " -h shows help\n";
21 print " -d run in debug mode (doesn't fork, output goes to STDOUT)\n";
22 print " -c specifiy a configuration file other than the default (/etc/guardian.conf)\n";
28 print "My ip address and interface are: $hostipaddr $interface\n";
30 if ($hostipaddr !~ /\d+\.\d+\.\d+\.\d+/) {
31 print "This ip address is bad : $hostipaddr\n";
32 die "I need a good host ipaddress\n";
35 $networkaddr = $hostipaddr;
36 $networkaddr =~ s/\d+$/0/;
37 $gatewayaddr = `cat /var/ipfire/red/remote-ipaddress 2>/dev/null`;
38 $broadcastaddr = $hostipaddr;
39 $broadcastaddr =~ s/\d+$/255/;
42 print "My gatewayaddess is: $gatewayaddr\n";
44 # This is the target hash. If a packet was destened to any of these, then the
45 # sender of that packet will get denied, unless it is on the ignore list..
47 %targethash = ( "$networkaddr" => 1,
48 "$broadcastaddr" => 1,
49 "0" => 1, # This is what gets sent to &checkem if no
50 # destination was found.
57 if ( -e
$targetfile ) {
61 if (!defined($opt_d)) {
62 print "Becoming a daemon..\n";
64 } else { print "Running in debug mode..\n"; }
66 open (ALERT
, $alert_file) or die "can't open alert file: $alert_file: $!\n";
67 seek (ALERT
, 0, 2); # set the position to EOF.
68 # this is the same as a tail -f :)
70 open (ALERT2
, "/var/log/messages" ) or die "can't open /var/log/messages: $!\n";
71 seek (ALERT2
, 0, 2); # set the position to EOF.
72 # this is the same as a tail -f :)
79 if (defined($opt_d)) {
82 if (/\[\*\*\]\s+(.*)\s+\[\*\*\]/){
85 if (/(\d+\.\d+\.\d+\.\d+):\d+ -\> (\d+\.\d+\.\d+\.\d+):\d+/) {
86 &checkem
($1, $2, $type);
88 if (/(\d+\.\d+\.\d+\.\d+)+ -\> (\d+\.\d+\.\d+\.\d+)+/) {
89 &checkem
($1, $2, $type);
95 if (seek(ALERT2
,0,1)){
98 if ($_=~/.*sshd.*Failed password for .* from.*/) {
99 my @array=split(/ /,$_);
101 if ( $array[11] eq "port" ) {
103 } elsif ( $array[11] eq "from" ) {
108 &checkssh
($temp, "possible SSH-Bruteforce Attack");}
110 # This should catch Bruteforce Attacks with enabled preauth
111 if ($_ =~ /.*sshd.*Received disconnect from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):.*\[preauth\]/) {
112 &checkssh
($1, "possible SSH-Bruteforce Attack, failed preauth");}
116 # Run this stuff every 30 seconds..
117 if ($counter == 30) {
118 &remove_blocks
; # This might get moved elsewhere, depending on how much load
119 # it puts on the system..
128 my ($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size,
129 $atime,$mtime,$ctime,$blksize,$blocks) = stat($alert_file);
130 if ($size < $previous_size) { # The filesize is smaller than last
131 close (ALERT
); # we checked, so we need to reopen it
132 open (ALERT
, "$alert_file"); # This should still work in our main while
133 $previous_size=$size; # loop (I hope)
134 write_log
("Log filename changed. Reopening $alert_file\n");
136 $previous_size=$size;
142 my ($source, $dest,$type) = @_;
145 return 1 if ($source eq $hostipaddr);
146 # this should prevent is from nuking ourselves
148 return 1 if ($source eq $gatewayaddr); # or our gateway
149 if ($ignore{$source} == 1) { # check our ignore list..
150 &write_log
("$source\t$type\n");
151 &write_log
("Ignoring attack because $source is in my ignore list\n");
155 # if the offending packet was sent to us, the network, or the broadcast, then
156 if ($targethash{$dest} == 1) {
157 &ipchain
($source, $dest, $type);
159 # you will see this if the destination was not in the $targethash, and the
160 # packet was not ignored before the target check..
162 &write_log
("Odd.. source = $source, dest = $dest - No action done.\n");
163 if (defined ($opt_d)) {
164 foreach $key (keys %targethash) {
165 &write_log
("targethash{$key} = $targethash{$key}\n");
172 my ($source,$type) = @_;
175 return 1 if ($source eq $hostipaddr);
176 # this should prevent is from nuking ourselves
178 return 1 if ($source eq $gatewayaddr); # or our gateway
180 return 0 if ($sshhash{$source} > 4); # allready blocked
182 if ( ($ignore{$source} == 1) ){
183 &write_log
("Ignoring attack because $source is in my ignore list\n");
187 if ($sshhash{$source} == 4 ) {
188 &write_log
("source = $source, blocking for ssh attack.\n");
189 &ipchain
($source, "", $type);
190 $sshhash{$source} = $sshhash{$source}+1;
194 if ($sshhash{$source} eq "" ){
195 $sshhash{$source} = 1;
196 &write_log
("SSH Attack = $source, ssh count only $sshhash{$source} - No action done.\n");
200 $sshhash{$source} = $sshhash{$source}+1;
201 &write_log
("SSH Attack = $source, ssh count only $sshhash{$source} - No action done.\n");
205 my ($source, $dest, $type) = @_;
206 &write_log
("$source\t$type\n");
207 if ($hash{$source} eq "") {
208 &write_log
("Running '$blockpath $source $interface'\n");
209 system ("$blockpath $source $interface");
210 $hash{$source} = time() + $TimeLimit;
212 # We have already blocked this one, but snort detected another attack. So
213 # we should update the time blocked..
214 $hash{$source} = time() + $TimeLimit;
218 sub build_ignore_hash
{
219 # This would cause is to ignore all broadcasts if it
220 # got set.. However if unset, then the attacker could spoof the packet to make
221 # it look like it came from the network, and a reply to the spoofed packet
222 # could be seen if the attacker were on the local network.
223 # $ignore{$networkaddr}=1;
225 # same thing as above, just with the broadcast instead of the network.
226 # $ignore{$broadcastaddr}=1;
228 $ignore{$gatewayaddr}=1;
229 $ignore{$hostipaddr}=1;
230 if ($ignorefile ne "") {
231 open (IGNORE
, $ignorefile);
235 next if (/\#/); #skip comments
236 next if (/^\s*$/); # and blank lines
241 &write_log
("Loaded $count addresses from $ignorefile\n");
243 &write_log
("No ignore file was loaded!\n");
249 $opt_c = "/etc/guardian.conf";
253 die "Need a configuration file.. please use to the -c option to name a configuration file\n";
256 open (CONF
, $opt_c) or die "Cannot read the config file $opt_c, $!\n";
259 next if (/^\s*$/); #skip blank lines
260 next if (/^#/); # skip comment lines
261 if (/LogFile\s+(.*)/) {
264 if (/Interface\s+(.*)/) {
266 if ( $interface eq "" ) {
267 $interface = `cat /var/ipfire/ethernet/settings | grep RED_DEV | cut -d"=" -f2`;
270 if (/AlertFile\s+(.*)/) {
273 if (/IgnoreFile\s+(.*)/) {
276 if (/TargetFile\s+(.*)/) {
279 if (/TimeLimit\s+(.*)/) {
282 if (/HostIpAddr\s+(.*)/) {
285 if (/HostGatewayByte\s+(.*)/) {
286 $hostgatewaybyte = $1;
290 if ($alert_file eq "") {
291 print "Warning! AlertFile is undefined.. Assuming /var/log/snort.alert\n";
292 $alert_file="/var/log/snort.alert";
294 if ($hostipaddr eq "") {
295 print "Warning! HostIpAddr is undefined! Attempting to guess..\n";
296 $hostipaddr = `cat /var/ipfire/red/local-ipaddress`;
297 print "Got it.. your HostIpAddr is $hostipaddr\n";
299 if ($ignorefile eq "") {
300 print "Warning! IgnoreFile is undefined.. going with default ignore list (hostname and gateway)!\n";
302 if ($hostgatewaybyte eq "") {
303 print "Warning! HostGatewayByte is undefined.. gateway will not be in ignore list!\n";
305 if ($logfile eq "") {
306 print "Warning! LogFile is undefined.. Assuming debug mode, output to STDOUT\n";
310 print "Warning! Logfile is not writeable! Engaging debug mode, output to STDOUT\n";
314 foreach $mypath (split (/:/, $ENV{PATH
})) {
315 if (-x
"$mypath/guardian_block.sh") {
316 $blockpath = "$mypath/guardian_block.sh";
318 if (-x
"$mypath/guardian_unblock.sh") {
319 $unblockpath = "$mypath/guardian_unblock.sh";
323 if ($blockpath eq "") {
324 print "Error! Could not find guardian_block.sh. Please consult the README. \n";
327 if ($unblockpath eq "") {
328 print "Warning! Could not find guardian_unblock.sh. Guardian will not be\n";
329 print "able to remove blocked ip addresses. Please consult the README file\n";
331 if ($TimeLimit eq "") {
332 print "Warning! Time limit not defined. Defaulting to absurdly long time limit\n";
333 $TimeLimit = 999999999;
339 my $date = localtime();
340 if (defined($opt_d)) { # we are in debug mode, and not daemonized
341 print STDOUT
$message;
343 open (LOG
, ">>$logfile");
344 print LOG
$date.": ".$message;
356 &write_log
("Guardian process id $$\n");
357 $home = (getpwuid($>))[7] || die "No home directory!\n";
358 chdir($home); # go to my homedir
359 setpgrp(0,0); # become process leader
363 print "Testing...\n";
367 sub sig_handler_setup
{
368 $SIG{INT
} = \
&clean_up_and_exit
; # kill -2
369 $SIG{TERM
} = \
&clean_up_and_exit
; # kill -9
370 $SIG{QUIT
} = \
&clean_up_and_exit
; # kill -3
371 # $SIG{HUP} = \&flush_and_reload; # kill -1
377 foreach $source (keys %hash) {
378 if ($hash{$source} < $time) {
379 &call_unblock
($source, "expiring block of $source\n");
380 delete ($hash{$source});
386 my ($source, $message) = @_;
387 &write_log
("$message");
388 system ("$unblockpath $source $interface");
391 sub clean_up_and_exit
{
393 &write_log
("received kill sig.. shutting down\n");
394 foreach $source (keys %hash) {
395 &call_unblock
($source, "removing $source for shutdown\n");
400 sub load_targetfile
{
402 open (TARG
, "$targetfile") or die "Cannot open $targetfile\n";
405 next if (/\#/); #skip comments
406 next if (/^\s*$/); # and blank lines
411 print "Loaded $count addresses from $targetfile\n";
416 print "Scanning for aliases on $interface and add them to the target hash...";
418 open (IFCONFIG
, "/sbin/ip addr show $interface |");
419 my @lines = <IFCONFIG
>;
422 foreach $line (@lines) {
423 if ( $line =~ /inet (\d+\.\d+\.\d+\.\d+)/) {
425 print " got $ip on $interface ... ";
426 $targethash{'$ip'} = "1";