Brutus- Brutus Server

#!/bin/bash

# designed for PFSense, meant to work with apt package 'portsentry'
# this script works by placing hostile external IP's into a null-route in the router's manual table.
# note that it'll only block scanning / hostile IP's externally, you can still reach them
#       from the inside, ie, the null-route is only effective for inbound requets to WAN

# target=source IP, port=touch detected on port, mode=atcp,tcp,audp,udp
#KILL_ROUTE="/etc/portsentry/instructrouter.sh $TARGET$ $PORT$ $MODE$"
# note : root's public key needs to be in pfsense user 'admin'
# $hoursold = after these hours, unblock IP address
# usage:
#       instructrouter.sh r
#       instructrouter.sh 1.2.3.4
# updated 100517 to use routing table instead of reconstructing config.xml, infinitely superior
#       copy ssh key into pfsense admin account

homedir=/etc/portsentry
blocklog=$homedir/blocklog.log
curdate=$(date +%m%d%y.%H%M%S)
curdateepoch=$(date +%s) # epoch time used for numerical comparison to find old records
tmpfolder="/tmp/$(basename $0).$$"
remuser="root" #root is actually called admin on pfsense
fwrouter=192.168.1.1
binlogger=/usr/bin/logger
hoursold=48
alertemail="[email protected]"

function statusis {
        echo "status : $1"
        $binlogger -t PORTSENTRY: $1
}

function mailout {
        grep PORTSENTRY /tmp/log/syslog | tail -n10 > $tmpfolder/sysout
        mail -s BrutusError $alertemail < $tmpfolder/sysout
}

function traperr {
        if [ $? -ne 0 ]; then
                errdata=$1
                statusis "Error found, $errdata"
                mailout
                exit 1
        fi
}

function cleanup {
        rm -rf $tmpfolder
}

mkdir $tmpfolder
case $1 in
        "")
                echo "Help : append with ip address to block or 'r' to remove stale"
                statusis "exiting due to null parameter"
                mailout
                cleanup
                exit 1
        ;;
        r)
                if [ -n "$2" ]; then
                        rmip="$2"
                        # remove the IP provided via command line
                        ssh -f [email protected]$fwrouter "route del $rmip" 2>&1 > /dev/null
                        cleanup
                        exit 0
                else
                        if [ ! -f $blocklog ] || [ -z "$(cat $blocklog)" ]; then
                                statusis "Nothing in the blocklog, exiting"
                                exit 0
                        fi

                        # figure out from $blocklog which IP's are more than $hoursold and remove from fw
                        while read blockline; do  #blockline format : ip blockdate blockepoch
                                lesshrsold=$(date --date "now -$hoursold hours" +%s)
                                if [ $(echo $blockline | cut -d " " -f3) -lt $lesshrsold ]; then
                                        rmip=$(echo $blockline | cut -d " " -f1)
                                        # the -f is crucial lest the script abort after an ssh error if route missing
                                        ssh -f [email protected]$fwrouter "route del $rmip" 2>&1 > /dev/null
                                fi
                        done < $blocklog
                        cleanup
                        exit 0
                fi
        ;;
        *)
                iptoblock=$1
                ssh [email protected]$fwrouter "route add $iptoblock 127.0.0.1 -blackhole"
                if [ $? -ne 0 ]; then
                        statusis "can't add IP to $fwrouter, exiting"
                        exit 1
                fi
                echo "$iptoblock $curdate $curdateepoch" >> $blocklog
                cleanup
                exit 0
        ;;
esac