edit
Project description
This project will do something useful and needed for my website.
This script will parse my apache logs looking for bots hitting 404 trying to probe possible security holes.
Any bot/ip that hits more than 25 404 errors gets banned, if it's not already listed as a reject in the public firewall zone.
Open the file that contains the allow list
Here, instead of using an allow list, I build a list of current rejected ip's with a firewall-cmd command.
firewall-cmd --list-all-zones |grep reject|grep source|awk '{print$4}'|sed "sx.*=.xx"|sed "sx\"xx"|sort -n > rejects.txt
[TODO]Add that to python in a subprocess.
Read the file contents
The rejected ip's are read in from the file that was returned by the firewall-cmd command.
Convert the string into a list
The string built is then split into a list.
Iterate through the remove list
Get a list of ip's to ban, checking first that they aren't already banned, then banning them if it's a new ip to the list of shame.
grep 404 /var/log/httpd/ssl_request_log|awk '{print$2}'|grep -v ::|sort -n|uniq -c|sort -n|sed "sx^ *xx"|sed "sx x,x" >
new-possible-rejects.txt
Remove IP addresses that are on the remove list
Ban that bugger
Update the file with the revised list of IP addresses
Save the list of rejected ip's currently in the firewall.
Summary
The original project was simple and I needed an automated way to get rid of all the bots hitting my website with 404 errors.