1 # http-ban
2 
3 Hey! It's just a simple script I'm testing as I don't want a huge HTTP
4 filter solution. It targets httpd(4) log format and pfctl(8).
5 
6 It's messy and harsh to read. Sorry about this. Written it a while ago
7 and yet updating it a bit, removing unused code.
8 
9 Feel free to try it and share enhancements/ideas around!
10 
11 For me it has been quite effective.
12 
13 # Installation
14 
15 1. Create a user
16 
17 	# useradd -u 404 -s /sbin/nologin -d /var/empty _httpban
18 
19 2. Install the script
20 
21 	# install -m 755 -o root -g bin http-ban.sh /usr/local/bin/http-ban
22 
23 3. Give the required permissions in /etc/doas.conf
24 
25 	# cat /etc/doas.conf
26 	permit nopass _httpban cmd /bin/cat args /var/www/logs/access.log
27 	permit nopass _httpban cmd /usr/bin/zcat args /var/www/logs/access.log.*gz
28 	permit nopass _httpban cmd /sbin/pfctl args -t players -T show
29 	permit nopass _httpban cmd /sbin/pfctl args -t players -T add -f-
30 	permit nopass _httpban cmd /sbin/pfctl args -t players -T delete -f-
31 
32 4. Create a <players> table in /etc/pf.conf
33 
34 	# cat /etc/pf.conf
35 	table <players> persist
36 	block in quick on egress from <players>
37 
38 3. Run it as _httpban (here every 5 minutes)
39 
40 	# crontab -eu _httpban
41 	*/5 * * * * -s http-ban
42 
43 # TODO
44 
45 - [ ] parametrize the table name, as <players> is not really a good name
46 - [ ] remove unused filter functions
47 - [ ] make it more pleasant to read / give the impression I'm mentally saner
48 
49 WORK branch: I have no idea if it works. Probably not yet. Need more
50 time to test and yet tired.