Skip to content

Commit

Permalink
- bump to 1.2.4
Browse files Browse the repository at this point in the history
- update README a bit
- add Max Khan to CREDITS
  • Loading branch information
dgerzo committed Sep 2, 2017
1 parent 5b2abc6 commit f17b79e
Show file tree
Hide file tree
Showing 4 changed files with 16 additions and 16 deletions.
3 changes: 3 additions & 0 deletions CHANGELOG
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
BruteForceBlocker v1.2.4 - Sep 2 2017
- add a new regexp to match failure log entries of recent OpenSSH versions
- contributed by Max Khon

BruteForceBlocker v1.2.3 - Mar 6 2006
- fixed regexp to match fqdn
Expand Down
2 changes: 1 addition & 1 deletion CREDITS
Original file line number Diff line number Diff line change
Expand Up @@ -7,4 +7,4 @@ Thanks to:
- Branislav Gerzo for some perl coding hints and help with code cleanup
- Kan Sasaki who sent me a patch for BruteForceBlocker which allows to
resolve reverze DNS to an IP address

- Max Khon for regexp to match recent OpenSSH failure log entries
21 changes: 9 additions & 12 deletions README
Original file line number Diff line number Diff line change
@@ -1,26 +1,23 @@

BruteForceBlocker v1.2.3
BruteForceBlocker v1.2.4

BruteForceBlocker is a perl script, that works along with pf - OpenBSD's
firewall (Which is also available on FreeBSD since version 5.2 is out).
It's main purpose is to block SSH bruteforce attacks via firewall.
firewall (which is also available on FreeBSD and NetBSD) and its main
purpose is to block SSH bruteforce attacks via firewall.

When this script is running, it checks sshd logs from syslog and looks
for Failed Login attempts - mostly some annoying script attacks, and
for failed login attempts - mostly some annoying script attacks, and
counts number of such attempts.

When given IP reaches configured limit of fails, script puts this IP to
the pf's table and block any further traffic to the that box from given
IP (This also depends on your configuration in pf.conf).
the pf's table and blocks any further traffic from the given IP.

Since the version of BruteForceBlocker 1.2 it is also possible to report
blocked IPs to the project site and share your information with other
users.
Furthermore, the blocked IP is reported to the project site which
enables users to share a list of abusive IPs. The list is publicly
available at http://danger.rulez.sk/projects/bruteforceblocker/blist.php

If you are bored of those automated auth tries, you will be happy with
this script. BruteForceBlocker is easy to use, simple, and effective.

For installation instructions see INSTALL file.

Feel free to send flames / reports or whatever to my e-mail address.

WWW: http://danger.rulez.sk/index.php/bruteforceblocker/
6 changes: 3 additions & 3 deletions bruteforceblocker.pl
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
#!/usr/bin/perl

# BruteForceBlocker v1.2.3
# - Daniel Gerzo <[email protected]>
# BruteForceBlocker by Daniel Gerzo <[email protected]>

use strict;
use warnings;
Expand All @@ -18,6 +17,7 @@
require '/usr/local/etc/bruteforceblocker.conf';

my $work = {
version => '1.2.4',
ipv4 => '(?:\d{1,3}\.){3}\d{1,3}', # regexp to match ipv4 address
ipv6 => '[\da-fA-F:]+', # regexp to match ipv6 address
fqdn => '[\da-z\-.]+\.[a-z]{2,4}', # regexp to match fqdn
Expand Down Expand Up @@ -106,7 +106,7 @@ sub download {
my $url = shift or die "Need url!\n";
# create useragent
my $ua = LWP::UserAgent->new(
agent => 'BruteForceBlocker v1.2.3',
agent => "BruteForceBlocker v$work->{version}",
timeout => 10
);
# send request
Expand Down

0 comments on commit f17b79e

Please sign in to comment.