R1Lover
Verified User
- Joined
- Feb 24, 2007
- Messages
- 446
Thank you!
13447465210001 41.84.204.13 [email protected] 1 dovecot1 Aug 12 06:41:22 webserver dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 18 secs): user=<[email protected]>, method=PLAIN, rip=41.84.204.13, lip=myip, session=<3J1bLwrHewApVMwN>
#!/bin/sh
#give your server a name for easy idenfication
SERVER=`hostname -s`
#where you want the email to be sent to
EMAIL=myemail
echo "IP $value has been blocked by Brute_Force_Notice_IP for making $count failed login attempts
$data
`dig -x $value`" | mail -s "$SERVER: blocked $value for $count failed attempts" $EMAIL
SCRIPT=/usr/local/directadmin/scripts/custom/block_ip.sh
ip=$value $SCRIPT
exit $?;
Edit the script that will enable the ip blocking.
Code:nano /usr/local/directadmin/scripts/custom/block_ip.sh
And put this code
Code:#!/bin/sh /etc/csf/csf.pl -d $ip exit 0
Now, when you will click for block, csf will do all the work automatically and you will be able to manage lists from csf as for everything else.
Regards
Port number is not passed directly, you can see how we detect it in our script:
https://github.com/poralix/directadmin-bfm-csf/blob/master/block_ip.sh
Our set of scripts for CSF/LFD + Directadmin BFM: https://forum.directadmin.com/showthread.php?t=44839
Hello Alex, thank you, I check it and have one doubt, I understand that the data var is exported by directadmin correct?, by other side do you have some example of this value before that you apply your filters?, thank you again.