Email sending from brute_force_notice_ip.sh

[TomR]

I setup blocking BFM from DirectAmin with CSF and everything is working fine.

However I would like to see that script brute_force_notice_ip.sh only send mails when an IP is really blocked. Not if it is already blocked by CSF. This gives me a lot of mails which I am not as much interressed as in the first time an IP will be blocked.

I guess a nice solution could be to change the block_ip.sh script with some different exit codes based on the action performed. However I can not figure out how to use that exit code in brute_force_notice_ip.sh.

Another approach would be to send the mails from block_ip.sh and make brute_force_notice_ip.sh obsolete, however this seems not flexible to me.

Please your thoughts and maybe a hint how to use exit codes from block_ip.sh in brute_force_notice_ip.sh

 

[zEitEr]

Hello,

I setup blocking BFM from DirectAmin with CSF and everything is working fine.

How did you do it? Did you follow the guide from directadmin? Or used your own scripts?


Related:

- I trust my brute force attack blocking system, I don't need to see all of the BFM messages.
https://help.directadmin.com/item.php?id=549

 

[TomR]

I used https://help.poralix.com/articles/how-to-block-ips-with-csf-directadmin-bfm

And in the script brute_force_notice_ip.sh I changed some lines about the mail address and subject.
However in the script the mail is alwys sent before the block_ip.sh script is run. So I get mail for each breach, regardless if the IP is already blocked.

I only want mails from the first time an IP is blocked.

Should I be using other scripts? ( Default from DA ). Is my wish covered there?
[h=1][/h]

 

[zEitEr]

Check it here: https://github.com/poralix/directadmin-bfm-csf/blob/master/block_ip.sh

The script exits with 6 if an IP is already blocked, and exits with 0 if an IP was blocked. So you can play with it and check

RETVAL=$?

value in brute_force_notice_ip.sh.