Auto-dnsbl 1.0 for IPFire 2.27 (x86_64) - Core-Update 182 and later. -------------------------------------------------------------------- Auto-dnsbl monitors the syslog file for incoming SMTP connections and checks the IP address against DNS Blackhole Lists (DNSBL). If the IP address is listed, auto-dnsbl drops any connection with the listed IP Address and generates iptables Drop rules to prevent any re-connection. When an IP Address is blocked auto-dnsbl will send an email message to the system administrator containing details of the blocked IP Address. Auto-dnsbl is based on the auto-dnsbl.pl script found on: https://gist.githubusercontent.com/jikamens/07220fc98361421c2ddfabb5286c14d8 by Jonathan Kamens Rob Brewer -------------------------------------------------------------------------------- auto-dnsbl will install the following new files and links to IPFire: /usr/local/bin/auto-dnsbl.pl /etc/rc.d.init.d/auto-dnsbl /etc/rc.d/rc0.d/K75auto-dnsbl /etc/rc.d/rc3.d/S50auto-dnsbl /etc/rc.d/rc6.d/K75auto-dnsbl This file is patched with log.dat.patch /srv/web/ipfire/cgi-bin/logs.cgi/log.dat An empty file will be created for a whitelist /var/local/whitelist INSTALLATION To Install ---------- 1) Download the installer to /tmp cd /tmp wget https://people.ipfire.org/~helix/auto-dnsbl/install-auto-dnsbl.sh 2) Make it executable: chmod +x install-auto-dnsbl.sh 3) Run the installer: ./install-auto-dnsbl.sh The installer will download the files and install them in the correct places. You can now configure the addon. The installer will try to configure /etc/sysconfig/firewall.local automatically If this fails to do so you will have to do a manual config in sections 2 & 3 below. If configured automatically you should examine firewall.local to ensure the applied rules are correct for your firewall. You should now configure /usr/local/bin/auto-dnsbl.pl as shown in the CONFIGURATION section below. To Uninstall ------------ NOTE.... Uninstall will remove all configured files and settings. You should back up these settings if you need to use them again. 1) If auto-dnsbl is running stop the daemons with /etc/rc.d/init.d/auto-dnsbl stop 2) Download the uninstaller to /tmp cd /tmp wget https://people.ipfire.org/~helix/auto-dnsbl/uninstall-auto-dnsbl.sh 3) Make it executable: chmod +x uninstall-auto-dnsbl.sh 4) Run the uninstaller: ./uninstall-auto-dnsbl.sh The uninstaller will remove the files, links and patch added by the install process and generated by auto-dnsbl. PREREQUISITES 1) Additional requirements This script requires perl-Net-IP-1.26-4 which is available on Pakfire 2) Create new AUTO-DNSBL Chain: /etc/sysconfig/firewall.local needs to be edited to add an additional chain to the FORWARD chain with your favourite text editor: Add to the start section: # Add new chain AUTO-DNSBL /sbin/iptables -N AUTO-DNSBL /sbin/iptables -I FORWARD 5 -j AUTO-DNSBL Add to the stop section: # Remove chain AUTO-DNSBL /sbin/iptables -D FORWARD -j AUTO-DNSBL /sbin/iptables -X AUTO-DNSBL 3) Create iptables Log rule: Incoming SMTP connections are logged to the syslog file (/var/log/messages) with an additional iptables rule which should match the rule used to send SMTP connections to your mail server. This can be little tricky so here is an example: In this case I have a NAT mail server on the green network with an IP Address of 192.168.2.4 Find the forwarding rule with: iptables -S FORWARDFW This will list all your forwarding rules which should include a rule with the port 25 forwarding line "--dport 25" similar to: -A FORWARDFW -d 192.168.2.4/32 -p tcp -m tcp --dport 25 -m limit --limit 2/sec -j ACCEPT Using this information generate an iptables rule to log incoming port 25 connections to syslog with a log prefix of [smtpconnections] iptables -I FORWARDFW -i ppp0 -p tcp -d 192.168.2.4 --dport 25 --syn -j LOG --log-prefix='[smtpconnections] ' (Change the IP Address to suit your network) and add this rule to the 'Start' section of /etc/sysconfig/firewall.local eg # Add firewall rule to log incomming smtpconnections iptables -I FORWARDFW -i ppp0 -p tcp -d 192.168.2.4 --dport 25 --syn -j LOG --log-prefix='[smtpconnections] ' also add the complementry 'Stop' rule to the Stop section. eg # Delete firewall rule to log incomming smtpconnections iptables -D FORWARDFW -i ppp0 -p tcp -d 192.168.2.4 --dport 25 --syn -j LOG --log-prefix='[smtpconnections] ' On completion of steps 2) and 3) re-load firewall.local with the command: /etc/sysconfig/firewall.local reload CONFIGURATION Configuration options can be changed in the header of /usr/local/bin/auto-dnsbl.pl - Only a few will need changing as shown below: my $log_file = 'tail --follow=name /var/log/messages|'; This should be correct for all current IPFire firewalls running syslogd. my $regex = '.*kernel:.*smtpconnections.*IN=ppp0.*SRC=(\d+\.\d+\.\d+\.\d+).DST=192.168.2.4.*DPT=25.*'; The IP Address for the destination should e changed to match IP Address of your mail server (DST=XXX.XXX.XXX.XXX) my $state_file = '/run/auto-dnsbl.state'; This should be correct for all current IPFire firewalls. my @dnsbls = ('zen.spamhaus.org', 'bl.spamcop.net'); Additional DNSBL's can be added here (comma separated list with the blocklist in single quotes '') but for email I find zen.spamhaus.org and bl.spamcop.net will catch 99% of offending IP addresses. my $block_for = 60 * 60; # Block for one hour (3600 seconds) The block_for time can be changed for user preference. From experience typically SMTP probes rarely last for more than a few seconds and the longest attack I've seen was for about 20 mins. A setting of 1hr should be more than adequate for most users. my $whitelist = '/var/ipfire/auto-dnsbl/whitelist'; Location of Whitelist. Can be set set to alternative location if required. The IP addresses of regular emails such as from mailing lists can be added to the whitelist file to reduce lookups of the DNSBL servers. These can be an individual address, a CIDR or an IP range. Comments starting with a '#' are ignored. my $chain = "AUTO-DNSBL"; This should be correct for all current IPFire firewalls. It is possible to use the 'CUSTOM' chains provided auto-dnsbl has exclusive use to them. my $to = 'postmaster@example.com'; Change postmaster@example.com to the email address of person who should receive Ban notifications from auto-dnsbl. Note you need to have a working email server set up in: "Mail Service" on the IPFire System Menu. OPERATION The installation will adds the SysVinit file /etc/rc.d/init.d/auto-dnsbl and associated links to run levels so auto-dnsbl will be started and stopped during the boot/shutdown process. Starting auto-dnsbl will generate 3 processes which run in daemon mode: a) /usr/bin/perl /usr/local/bin/auto-dnsbl.pl b) tail --follow=name /var/log/messages (The auto-dnsbl daemon which monitors the syslog file for incomming SMPT connections) c) auto-dnsbl-expire (This is a child process which Unbans blocked IP Address after the $block_for time has expired) Start - Stop The program will be started at system boot but should be started and stopped with the init file to ensure that all child processes are removed. To stop auto-dnsbl: /etc/rc.d/init.d/auto-dnsbl stop To start dnsbl: /etc/rc.d/init.d/auto-dnsbl start To reload the program after any configuration changes: /etc/rc.d/init.d/auto-dnsbl restart System Logs The installation adds an entry to the System Logs menu (Auto-dnsbl) where the log entries can be viewed eg: 12:05:07 auto-dnsbl : Skipping (Found in Whitelist): 66.35.60.131 11:53:42 auto-dnsbl : Skipping (Found in Whitelist): 81.3.27.42 11:05:07 auto-dnsbl : Skipping (Found in Whitelist): 66.35.60.131 10:47:37 auto-dnsbl : UNBAN: 164.160.33.250 10:39:37 auto-dnsbl : Skipping (Found in Whitelist): 82.195.75.100 10:05:06 auto-dnsbl : Skipping (Found in Whitelist): 66.35.60.131 09:57:08 auto-dnsbl : Skipping (Found in Whitelist): 82.195.75.100 09:47:28 auto-dnsbl : BAN: 164.160.33.250 09:39:36 auto-dnsbl : UNBAN: 91.73.247.158 09:21:41 auto-dnsbl : Skipping (Found in Whitelist): 82.195.75.100 09:05:06 auto-dnsbl : Skipping (Found in Whitelist): 66.35.60.131 08:38:58 auto-dnsbl : BAN: 91.73.247.158 08:05:05 auto-dnsbl : Skipping (Found in Whitelist): 66.35.60.131 07:46:49 auto-dnsbl : Skipping (Found in Whitelist): 82.195.75.100 Email When a DNSBL Ban is generated the program will send an email to the administrator (set in $to above) with the following information: A list of which DNSBLs the IP Address is found A whois lookup of the banned IP Address. eg: Hi, The IP 5.249.163.13 has just been banned by AUTO-DNSBL. Here is more information about 5.249.163.13.: Found in the following blacklists : 5.249.163.13 not listed by sbl.spamhaus.org 5.249.163.13 listed by xbl.spamhaus.org 5.249.163.13 not listed by pbl.spamhaus.org 5.249.163.13 not listed by bl.spamcop.net 5.249.163.13 not listed by psbl.surriel.com 5.249.163.13 not listed by dul.dnsbl.sorbs.net % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See https://apps.db.ripe.net/docs/HTML-Terms-And-Conditions % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '5.249.160.0 - 5.249.167.255' % Abuse contact for '5.249.160.0 - 5.249.167.255' is 'abuse@zap-hosting.com' inetnum: 5.249.160.0 - 5.249.167.255 netname: DE-ZAP-HOSTING5-20120914 country: DE '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' Use the email to identify any false positives (I haven't found any to date) and add the IP to the Whitelist if necessary. If you don't need the email notification comment out the "&mail($to, $ip);" line at the end of the script like this: # &mail($to, $ip); PERFORMANCE The packet that generates the kernel Log entry [smptconnections] will have already passed through the FORWARD chain BLOCK rules before being detected by auto-dnsbl. This prevents unnecessary DNS lookups on the RBLDNS servers for IP addresses that have already been blocked. After detection of a BAN the program generates 3 Iptables rules in the new AUTO-DNSBL chain near the top of the FORWARD chain These rules LOG any new connections from the banned IP with "DROP-AUTO-DNSBL" and DROP any further input and output connections to that IP Address. In addition any existing input and output connections are deleted with conntrack. The ban will be implemented as soon as the RBLDNS servers respond which is usually less then 1 second. The BAN rules are automatically deleted after the $block_for time (see above) has expired. The incoming [smptconnections] LOG entry in /var/log/messages cannot be avoided whilst IPFire is running syslogd. Should IPFire choose to install rsyslogd in the future (proposed but apparently abandoned) the LOG entries could be filtered off to an alternative log file and remove the entries from /var/log/messages. DISCLAIMER This is not an official IPFire addon and although it has been substantially tested by the author has not been tested and certified by IPFire. Use at your own risk. SEE ALSO The original auto-dnsbl can be found at: https://gist.github.com/jikamens/07220fc98361421c2ddfabb5286c14d8 with many thanks to Jonathan Kamens