Syslog or View Blacklist Logs

[TagleRock]

A few of our customers are getting excessive blacklisted IPs due to failed authentications. I would would like to implement an automated method of permanently blocking those IPs. The best way to do this I believe would be to use syslog to send the logs elsewhere on the network and then do the blacklist in real time. From what I understand though 3CX still has not yet implemented a syslog function (correct me if I'm wrong). If that is the case and they haven't, does anyone know of a way to view the list or logs of blacklisted IP's from CLI? My plan would be to just have a script run every 5 minutes or so check if an IP is already in the list, and add it to iptables if it isn't.

I'm using a script from a user that posted about this a few years back but I'm guessing some things may have changed since then because it doesn't seem to be working. I haven't changed much about it except for line 20 where it checks if the IP is already in iptables. The original command didn't work. Left all comments intact so the original creator of the script is credited.

Hoping that since this script was posted 3CX has made some of this stuff easier.

EDIT: Forgot to put version and system info.

Version: 18.0 Update 8
OS: Debian

#!/bin/bash
# Script to check eventlog in postgres db for 3cx for IP's that were banned
# this script then add the IP to iptables
# This script is ment to be added to crontab
# Written by Chris Wianecki
# contact me via email [email protected]


while read line
  do
    first_var=`echo "$line" | awk 'BEGIN { FS="|" } { print $1 }'`
    sixth_var=`echo "$line" | awk 'BEGIN { FS="|" } { print $6 }'`

    if expr $first_var + 0 > /dev/null 2>&1
    then

        if [[ !  -z  $first_var  ]]; then
            if [[ $sixth_var = *"Too many failed authentications"* ]]; then
                IPAddressToBan=`echo $sixth_var | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'`
                if nft list table ip filter | grep -q "$IPAddressToBan"
                then
                    echo "IP already found in IPTables"
                else
                    echo "Adding $IPAddressToBan to IPTables to DROP any connections for that IP to 3CX server."
                    /sbin/iptables -A INPUT -s "$IPAddressToBan" -j DROP
                    /sbin/iptables -L -n | grep "$IPAddressToBan"
                fi
            fi
        fi
    fi

  done < <(cd /tmp; sudo -u phonesystem -H -- psql -d database_single -c "SELECT *  FROM eventlog")

 

[TagleRock]

So after a bit of work I was able to create a script using the general idea of the one created by Chris Wianecki but with a different approach.

This requires some pre-requisites though. You have to create the "username" specified on line 11, make it a sudoer, give it superuser rights to the 3cx database in the hba_file, modify permissions on the log directory to give the user you created rights to it, and setup the crontab for it (in my case it runs every 30 minutes and clears the log i created every week). Oh and I found that Debian images provided by 3CX do not have iptables installed so you have to install it with apt-get. It has nftables I think but I don't know enough about the syntax to script anything with it, except where i had to (line 12 for example).

It's not perfect and I'm sure someone more well versed in bash could come up with something better, but it works and since deploying it on two servers I've already seen a big decrease in blacklist emails.

One thing to note about this script is that it has no way of telling the difference between legitimate and malicious IP's. For example if a user enters their password wrong and gets their PC blacklisted and the entry is not removed before the script fires they'll be added to the IP tables and have to be manually removed.

#!/bin/bash
#This script was created by TagleRock on 3CX forums
#This script is to be used AT YOUR OWN RISK!!

thedate=$(date)
echo "--------------------!!SCRIPT LOG SECTION FOR $thedate BEGIN!!--------------------"

#date=$(date '+%Y-%m-%d--%H:%M:%S')
#echo "$date"

blist=$(sudo -u username psql -d database_single -c "SELECT ipaddr FROM blacklist WHERE blocktype=0")
table=$(nft list table ip filter | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')

echo "$table" > /usr/nflist.txt
echo "$blist" > /usr/3cxblist.txt
sed '/ipaddr/d' /usr/3cxblist.txt > /usr/temp.txt && mv /usr/temp.txt /usr/3cxblist.txt
sed '/-----------------/d' /usr/3cxblist.txt > /usr/temp.txt && mv /usr/temp.txt /usr/3cxblist.txt
sed -i '$ d' /usr/3cxblist.txt

while read line; do
    if grep -q "$line" /usr/nflist.txt
    then
        echo ""
        echo "IP $line already found in IPTables"
        echo ""
    else
        echo ""
        echo "Adding $line to IPTables to DROP any inbound connections from that IP to 3CX"
        echo ""
        iptables -A INPUT -s "$line" -j DROP
    fi
done < /usr/3cxblist.txt

rm /usr/3cxblist.txt
rm /usr/nflist.txt

echo "--------------------!!SCRIPT LOG SECTION END!!--------------------"
echo ""