diff --git a/scripts/manage-blocked-ips.sh b/scripts/manage-blocked-ips.sh index 5da0aab..9a88989 100755 --- a/scripts/manage-blocked-ips.sh +++ b/scripts/manage-blocked-ips.sh @@ -57,7 +57,11 @@ case "$1" in echo "show table web" | socat stdio "$SOCKET" | awk ' NR>1 { ip = $1 - auth_fail = 0; authz_fail = 0; scanner = 0; repeat_off = 0; manual_bl = 0 + auth_fail = 0 + authz_fail = 0 + scanner = 0 + repeat_off = 0 + manual_bl = 0 if ($0 ~ /gpc\(0\)=([0-9]+)/) { match($0, /gpc\(0\)=([0-9]+)/, arr); auth_fail = arr[1] } if ($0 ~ /gpc\(1\)=([0-9]+)/) { match($0, /gpc\(1\)=([0-9]+)/, arr); authz_fail = arr[1] } diff --git a/scripts/monitor-attacks.sh b/scripts/monitor-attacks.sh index b0c72de..0d9bdbe 100755 --- a/scripts/monitor-attacks.sh +++ b/scripts/monitor-attacks.sh @@ -19,10 +19,20 @@ show_threats() { # Parse the stick table output for array-based GPC values ip = $1 # Look for GPC array values in the data - auth_fail = 0; authz_fail = 0; rate_viol = 0; scanner = 0 - sql_inj = 0; traversal = 0; wp_brute = 0; admin_scan = 0 - shell_att = 0; repeat_off = 0; manual_bl = 0; auto_bl = 0 - glitch_rate = 0; threat_score = 0 + auth_fail = 0 + authz_fail = 0 + rate_viol = 0 + scanner = 0 + sql_inj = 0 + traversal = 0 + wp_brute = 0 + admin_scan = 0 + shell_att = 0 + repeat_off = 0 + manual_bl = 0 + auto_bl = 0 + glitch_rate = 0 + threat_score = 0 # Extract relevant metrics (simplified parsing) if ($0 ~ /gpc\(0\)=([0-9]+)/) {