first

getOthers

@@ -0,0 +1,20 @@
+#!/bin/bash
+# run this every 10 mins
+# if someone knocks at the apache server for a non-existing url, 3 times - then block
+
+ERRORFILE='/tmp/badurls_apache2.log'
+rm -f ${ERRORFILE}
+touch ${ERRORFILE}
+
+awk -vDate=`date -d'now-10 minutes' +[%d/%b/%Y:%H:%M:%S` '$4 > Date {print Date, $0}' /var/log/apache2/access.log | while read -r LINE; do
+    STATUZ=$( echo ${LINE} | awk -F' ' '{print $10;}')
+
+    if [[ "${STATUZ}" == '"-"' ]] || [[ ${STATUZ} -gt 399 ]]; then
+        echo ${LINE} >>${ERRORFILE}
+        # echo ${LINE}
+        IP=$(echo ${LINE} | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b")
+        addEvent.sh "BLOCK,${IP},10,30,Fishing for URL in apache2"
+    fi
+done
+
+cat ${ERRORFILE} | wc -l