• If you are still using CentOS 7.9, it's time to convert to Alma 8 with the free centos2alma tool by Plesk or Plesk Migrator. Please let us know your experiences or concerns in this thread:
    CentOS2Alma discussion

Automatically block attacking ips

ylon

Basic Pleskian
I'm getting a whole lot of attacks it appears and I'd like to automatically perform an nslookup or if it is an ip add it directly to the firewall to block all incoming traffic from these attackers. What is available to allow this type of functionality?

Here is a sample of what I've been seeing in my logs:
Mar 24 06:57:55 domain sshd(pam_unix)[10608]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=61-218-49-243.hinet-ip.hinet.net
Mar 24 06:57:55 domain sshd(pam_unix)[10612]: check pass; user unknown
Mar 24 06:57:55 domain sshd(pam_unix)[10612]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11
Mar 24 06:57:58 domain sshd(pam_unix)[10619]: check pass; user unknown
Mar 24 06:57:58 domain sshd(pam_unix)[10619]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11
Mar 24 06:57:59 domain sshd(pam_unix)[10621]: check pass; user unknown
Mar 24 06:57:59 domain sshd(pam_unix)[10621]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11
Mar 24 06:58:01 domain sshd(pam_unix)[10623]: check pass; user unknown
Mar 24 06:58:01 domain sshd(pam_unix)[10623]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=61-218-49-243.hinet-ip.hinet.net
Mar 24 06:58:02 domain sshd(pam_unix)[10628]: check pass; user unknown
Mar 24 06:58:02 domain sshd(pam_unix)[10628]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11
Mar 24 06:58:02 domain sshd(pam_unix)[10631]: check pass; user unknown
Mar 24 06:58:02 domain sshd(pam_unix)[10631]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11
Mar 24 06:58:06 domain sshd(pam_unix)[10643]: check pass; user unknown
Mar 24 06:58:06 domain sshd(pam_unix)[10643]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11
Mar 24 06:58:06 domain sshd(pam_unix)[10645]: check pass; user unknown
Mar 24 06:58:06 domain sshd(pam_unix)[10645]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11
Mar 24 06:58:07 domain sshd(pam_unix)[10640]: check pass; user unknown
Mar 24 06:58:07 domain sshd(pam_unix)[10640]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=61-218-49-243.hinet-ip.hinet.net
Mar 24 06:58:10 domain sshd(pam_unix)[10649]: check pass; user unknown
Mar 24 06:58:10 domain sshd(pam_unix)[10649]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11
Mar 24 06:58:10 domain sshd(pam_unix)[10650]: check pass; user unknown
Mar 24 06:58:10 domain sshd(pam_unix)[10650]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11
Mar 24 06:58:13 domain sshd(pam_unix)[10654]: check pass; user unknown
Mar 24 06:58:13 domain sshd(pam_unix)[10654]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=61-218-49-243.hinet-ip.hinet.net
Mar 24 06:58:14 domain sshd(pam_unix)[10657]: check pass; user unknown
Mar 24 06:58:14 domain sshd(pam_unix)[10657]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11
Mar 24 06:58:14 domain sshd(pam_unix)[10659]: check pass; user unknown
Mar 24 06:58:14 domain sshd(pam_unix)[10659]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11
Mar 24 06:58:18 domain sshd(pam_unix)[10664]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11 user=mysql
Mar 24 06:58:18 domain sshd(pam_unix)[10666]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11 user=mysql
Mar 24 06:58:18 domain sshd(pam_unix)[10662]: check pass; user unknown
Mar 24 06:58:18 domain sshd(pam_unix)[10662]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=61-218-49-243.hinet-ip.hinet.net
Mar 24 06:58:22 domain sshd(pam_unix)[10669]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11 user=operator
Mar 24 06:58:22 domain sshd(pam_unix)[10670]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11 user=operator
Mar 24 06:58:24 domain sshd(pam_unix)[10673]: check pass; user unknown
Mar 24 06:58:24 domain sshd(pam_unix)[10673]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=61-218-49-243.hinet-ip.hinet.net
Mar 24 06:58:26 domain sshd(pam_unix)[10675]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11 user=adm
Mar 24 06:58:26 domain sshd(pam_unix)[10676]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11 user=adm
Mar 24 06:58:30 domain sshd(pam_unix)[10682]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11 user=apache
Mar 24 06:58:30 domain sshd(pam_unix)[10684]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=210.0.201.11 user=apache
 
I apologize, I had not seen this answer previously that I was given to the same question some time ago:

http://forum.sw-soft.com/showthread.php?s=&threadid=21927&highlight=attacking+ips
 
Back
Top