1 d2c27298 2024-01-30 xs # http-ban
 2 d2c27298 2024-01-30 xs 
 3 d2c27298 2024-01-30 xs Hey! It's just a simple script I'm testing as I don't want a huge HTTP
 4 d2c27298 2024-01-30 xs filter solution. It targets httpd(4) log format and pfctl(8).
 5 d2c27298 2024-01-30 xs 
 6 d2c27298 2024-01-30 xs It's messy and harsh to read. Sorry about this. Written it a while ago
 7 d2c27298 2024-01-30 xs and yet updating it a bit, removing unused code.
 8 d2c27298 2024-01-30 xs 
 9 d2c27298 2024-01-30 xs Feel free to try it and share enhancements/ideas around!
10 d2c27298 2024-01-30 xs 
11 d2c27298 2024-01-30 xs For me it has been quite effective.
12 d2c27298 2024-01-30 xs 
13 d2c27298 2024-01-30 xs # Installation
14 d2c27298 2024-01-30 xs 
15 ec44cb77 2024-01-30 xs 1. Create an user
16 d2c27298 2024-01-30 xs 
17 d2c27298 2024-01-30 xs 	# useradd -u 404 -s /sbin/nologin -d /var/empty _httpban
18 d2c27298 2024-01-30 xs 
19 d2c27298 2024-01-30 xs 2. Install the script
20 d2c27298 2024-01-30 xs 
21 d2c27298 2024-01-30 xs 	# install -m 755 -o root -g bin http-ban.sh /usr/local/bin/http-ban
22 d2c27298 2024-01-30 xs 
23 d2c27298 2024-01-30 xs 3. Give the required permissions in /etc/doas.conf
24 d2c27298 2024-01-30 xs 
25 d2c27298 2024-01-30 xs 	# cat /etc/doas.conf
26 d2c27298 2024-01-30 xs 	permit nopass _httpban cmd /bin/cat args /var/www/logs/access.log
27 d2c27298 2024-01-30 xs 	permit nopass _httpban cmd /usr/bin/zcat args /var/www/logs/access.log.*gz
28 d2c27298 2024-01-30 xs 	permit nopass _httpban cmd /sbin/pfctl args -t players -T show
29 d2c27298 2024-01-30 xs 	permit nopass _httpban cmd /sbin/pfctl args -t players -T add -f-
30 d2c27298 2024-01-30 xs 	permit nopass _httpban cmd /sbin/pfctl args -t players -T delete -f-
31 d2c27298 2024-01-30 xs 
32 d2c27298 2024-01-30 xs 4. Create a <players> table in /etc/pf.conf
33 d2c27298 2024-01-30 xs 
34 d2c27298 2024-01-30 xs 	# cat /etc/pf.conf
35 d2c27298 2024-01-30 xs 	table <players> persist
36 d2c27298 2024-01-30 xs 	block in quick on egress from <players>
37 d2c27298 2024-01-30 xs 
38 d2c27298 2024-01-30 xs 3. Run it as _httpban (here every 5 minutes)
39 d2c27298 2024-01-30 xs 
40 d2c27298 2024-01-30 xs 	# crontab -eu _httpban
41 d2c27298 2024-01-30 xs 	*/5 * * * * -s http-ban
42 d2c27298 2024-01-30 xs 
43 d2c27298 2024-01-30 xs # TODO
44 d2c27298 2024-01-30 xs 
45 d2c27298 2024-01-30 xs - [ ] parametrize the table name, as <players> is not really a good name
46 d2c27298 2024-01-30 xs - [ ] remove unused filter functions
47 d2c27298 2024-01-30 xs - [ ] make it more pleasant to read / give the impression I'm mentally saner
48 3115cd3d 2024-01-30 xs 
49 3115cd3d 2024-01-30 xs WORK branch: I have no idea if it works. Probably not yet. Need more
50 3115cd3d 2024-01-30 xs time to test and yet tired.