Help with an iptables script and the Code Red worm.

[Ace69]

I have found a script that will log all IPs that try to attack me with the Code Red worm. I want to be able to be able to set up a script that will let me input all of the IPs that I obtain and input them into a banlist of some kind. Something like this command, iptables -A INPUT -s XXX.XXX.XXX.XXX -j DROP. I want to be able to automatically input all of the IPs that I found and put them into the XXX.XXX.XXX.XXX field. Does anyone know of an easy way to do this?

I think this may take a bit because I know nothing about shell scripting and I am just learning the iptables commands.

 

[n0cmonkey]

Best I can say is to grep the log file for hits, then use another script (or the same script) to put a rule in. For checking my IPF logs for code red I use:

grep ",80" /var/logs/ipflog

 

[DaHitman]

I have a page up for code red on my webserver..

http://www.unix-guru.org/codered.html

The pages are generated by a perl script I run every 15mins in CRON...

You can snag a copy here:
http://www.unix-guru.org/redstats.pl

 

[Ace69]

<< Best I can say is to grep the log file for hits, then use another script (or the same script) to put a rule in. For checking my IPF logs for code red I use:

grep ",80" /var/logs/ipflog >>



I have already gotten the lines out, but I just needed to create a ban list of some kind. I would need to go step by step instructions or a simply little script would have to be given to me. 🙂

I downloaded the perl script, Dahitman. I will give it a try.