This script will parse NGINX- and dmesg-logs and checks the ip addresses found there using the AbuseIPDB and Alienvault-API to see if it is a malicious ip and blocks it if necessary.
- wget https://raw.githubusercontent.com/Billaids/Telegram-IP-Check-Bot/master/check_bot.sh
- chmod +x check_bot.sh
- Enable iptables logging:
sudo iptables -A INPUT -j LOG
sudo iptables -A FORWARD -j LOG
sudo ip6tables -A INPUT -j LOG
sudo ip6tables -A FORWARD -j LOG
- Install jq
sudo apt-get install jq
- Get Telegram Bot API-Key and your CHATID
- Get an AbuseIPDB and Alienvault API-Key
- fill in your MAC-Address from ethernet adapter and server ip etc.
- run bot, if you filled in empty vars.
It might be possible that this script blocks ip-addresses that are actually harmless. It checks for the abusescore from AbuseIPDB and Alienvault (Threadscore), which can result in false-positives.
@KEN @uberhahn