feriman22/portscan-protection

This script helps to avoid portscanning on Linux systems.

Portscan Protection (Linux)

Description

Hackers and unskilled script-users often scan servers for open ports. If they find one, such as your SSH port, they will attempt to crack it. This script helps protect Linux systems with built-in firewall protection (iptables) from portscan attacks by automatically blocking the IP address of any attacker who attempts to access ports too quickly.

The menu before install

The menu after install

Installation

1. Install cURL, iptables and ipset:

• Ubuntu/Debian:

  • sudo apt update && sudo apt install curl iptables ipset -y

• RedHat/CentOS:

  • sudo yum install curl iptables ipset -y

2. Install Portscan Portection directly from GitHub:

curl -s https://raw.githubusercontent.com/Feriman22/portscan-protection/master/portscan-protection.sh | sudo bash /dev/stdin -i

If you run it without argument, you have few options:

1. Install # Available only if not installed yet
2. Uninstall # Available only if already installed
3. Edit Whitelist # Available only if already installed
4. Verify
5. Update from GitHub # Available only if already installed
6. Quit

The Install process copies the script to the /usr/local/sbin folder and then creates a new cron rule in the file called portscan-protection in the /etc/cron.d folder. It is executed once by itself to enable the ipset/iptable rules, and every startup, so your server is protected at all times.

The Uninstall process removes the script from the /usr/local/sbin folder, removes the crontab entry and deletes ipset/iptable rules. WARNING! After this step, you can no longer run the script from the /usr/local/sbin folder!

The Edit Whitelist option allow to add IPv4 addresses to the whitelist. Add one IP per line to this file. These IP addresses will be never blocked. Note: Only IPv4 addresses are supported.

The Verify process checks the crontab entry, the location of the script, the execution permission, the ipset/iptables commands and the active firewall rules.

The Update from GitHub process updates the installed script. You cannot update it before the installation!

Daily use

Nothing to do! Just install the script and enjoy the protection! If you want to run the script again, just type portscan-protection.sh as root user.

If you want to use this script somewhere else (e.g. in an OS installer script), there are some arguments:

-i, --install
Install the script

-u, --uninstall
Uninstall the script without confirmation

-v, --verify
Verify the installation

-up, --update
Update the script from GitHub

--cron
Run the script like the crontab does. It will only set ipset/iptable rules and auto-update the script if not disabled. No output.

Exit codes:

Exit code	What does it mean?
0	Everything was fine (no error)
5	Not enough permission. Run as root or with sudo
6	ipset command not found
7	iptables command not found
8	GitHub is not available
9	Answered No at Uninstall
10	curl, iptables or ipset command not found
130	Script canceled by ctrl + c

How to update

The script will automatically update itself after reboot. If you want to disable it, modify the 7th line in the script.
However you can update it manually by running the script and choose "Update the script" or run with --update argument like this:
/usr/local/sbin/portscan-protection.sh --update

Roadmap

• Use systemd service if available. If not, set cronjob
• Reinstall function
• Easier way to disable auto-update function
• Verify that the root's cron is enabled or not
• Adding support for nftables
• Support custom SSH port

Changelog

26-06-2023

• Use command -v instead of which
• Code simplification
• Small bugfixes

14-03-2023

• Fix bug #9

16-08-2022

• Bugfix: iptables flush has been removed
• Using printf instead of echo -e
• Small text modifications

05-04-2021

• Whitelist editor improved
• Installer not copied twice on the server thanks to direct install from GitHub
• cURL, iptables and ipset command verification (Exit code 10)
• Small text modifications

04-04-2021

• Whitelist function
• Use cURL instead of wget
• Smarter way to update
• Different menus before and after install
• Shorter code (combine similar if structures in one for cycle)
• Replace original installer with symlink to avoid confusing
• Small bugfixes

01-02-2021

• Bugfix: ipset and iptable commands are not found on CentOS systems
• Bugfix: Crontab syntax was wrong
• Bugfix: Run update process only if new version available

28-04-2020

• Error codes have been added

26-04-2020

• More efficient update process

15-04-2020

• Update option added
• Auto-update function added
• Check for an update at the startup of the script
• Remove ipset and iptable rules at uninstalling
• Arguments added (-i, --install, -u, --uninstall, -v, --verify, -up, --update, --cron)
• Activate/remove ipset and iptable rules with variables
• The test condition for install has been improved
• Small typos fixed

14-04-2020

• Copy the script in /usr/local/sbin directory instead of /root
• Use variables for menu selection instead of touch temp files
• Insert cron entry in /etc/cron.d folder instead of the main cron file
• Code review & cleanup
• Small bugs fixed

13-04-2020

• Initial release

Do not forget

If you found my work helpful, I would greatly appreciate it if you could make a donation through PayPal to support my efforts in improving and fixing bugs or creating more awesome scripts. Thank you!

portscan-protection's Issues

System has not been booted with systemd as init system (PID 1). Can't operate.

Uninstalled with the given command and now nothing working in my system! Need help! Ubuntu 20.04

Conflict with docker iptable rules

Since you're clearing existing iptable rules before adding your own, you'll break applications that already added those rules.
It would be more useful to append your own rules to the existing ruleset.
As an example of conflict, I can point to docker.
According to the docker site, you may need to add rules to DOCKER-USER chain.
Thank you for your time.

--cron not working as expected on CentOS 8

Hi there,
very nice tool, works very great "if it is working" 👍

I ran into issues on CentOS 8 where "/usr/sbin" is not part of the Cron daemon path system wide.
The issue is not new to me, even on Debian or Ubuntu based systems I had the path issues multiple times in the past with different applications.

What happens, when the default installation is done and the server got rebooted:

/usr/local/sbin/portscan-protection.sh: line 84: ipset: command not found
/usr/local/sbin/portscan-protection.sh: line 84: ipset: command not found
/usr/local/sbin/portscan-protection.sh: line 85: ipset: command not found
/usr/local/sbin/portscan-protection.sh: line 85: ipset: command not found
/usr/local/sbin/portscan-protection.sh: line 86: iptables: command not found
/usr/local/sbin/portscan-protection.sh: line 86: iptables: command not found
/usr/local/sbin/portscan-protection.sh: line 87: iptables: command not found
/usr/local/sbin/portscan-protection.sh: line 87: iptables: command not found
/usr/local/sbin/portscan-protection.sh: line 88: iptables: command not found
/usr/local/sbin/portscan-protection.sh: line 88: iptables: command not found
/usr/local/sbin/portscan-protection.sh: line 89: iptables: command not found
/usr/local/sbin/portscan-protection.sh: line 89: iptables: command not found

Bypassing this issue is easy:

@reboot root PATH=/usr/sbin:$PATH; sleep 30 && /usr/local/sbin/portscan-protection.sh --cron

In my eyes, it would be great, if the path modification is done within your script, or better, if your script can search for the used applications to avoid conflicts for differences within different distributions.

Github not available

Hey,
nice to see a new update.
The latest 2021 version had a bug:

root@serv ~ # ./portscan-protection.sh

Portscan Protection

Author: Feriman
URL: https://github.com/Feriman22/portscan-protection
Open GitHub page to read the manual and check new releases
Version: 01-02-2021
New version available!
If you found it useful, please donate via PayPal: https://paypal.me/BajzaFerenc

1) Install
2) Uninstall
3) Verify
4) Update
5) Quit
Please enter your choice: 4
GitHub is not available now. Try again later.
root@serv ~ #

I had to manually download the file from the repo. You may want to check if the update process is working fine. I can't test it anymore as the version is up-to-date.

OS: Debian 11
CURL installed.

[Question] Help on Opening port 443, 80 and 22. Close all ports and protect from scan!

Is it possible to open the HTTP(s) port and SSH ports while using this script and protect against from the port scans, especially from nmap scans?

It doesn't start after reboot on Centos 9

Hi,

After installation this script add itself to /etc/cron.d for auto-restart after reboot. But it doesn't works after 30 seconds or 30 minutes.
Now I added this functionality to /etc/rc.d/rc.local - it works like that.
You should fix this issue I think.

Iptables rules of script lock me out when using WinSCP

Server: Ubuntu 18.04.2 LTS, OS at home: Win 10 Pro

WinSCP is a FTP client for Windows. Whenever I log in there and list a directory, all is fine. But shortly after starting a transfer, I become locked out from my server. This lock remains appearantly for hours. To access the server again, only changing my dynamic ISP IP address helps.

Another thing: my dynamic ISP IP address appears from time to time in scanned_ports with mail ports and my Webmin port. Seems to have no effect, its only weird.

A whitelist would be highly appreciated.

Bad username on Debian 10

This script works as expected, however the cron job does not seem to be running properly as journalctl -xb reports a cron error:

Error: bad username; while reading /etc/cron.d/portscan-protection
(*system*portscan-protection) ERROR (Syntax error, this crontab file will be ignored)

Script breaks functionality of the server

So I tried this script on my VPN servers, as I sell to customers in China and I want to block probing from the great firewall. It does what it supposed to do, but it breaks functionality of one of the 2 protocols used by servers (ShadowsocksR). My servers are unable to connect to the Master server when the script is active to pull client information, so it breaks the API. The other thing is I notice, it is throwing local host (127.0.0.1) into IPSet, specifically on a port used by the other protocol (v2ray) however v2ray functionality isn't disabled.
Suggestion, add some sort of whitelist or exclusion feature so I can add domains or IP addresses to be excluded/white listed from being banned by your script.

The other issue is there is no addition to crontab for the script to start after a reboot.

Blocked Ips

hello
how can i check the blocked ips ?or i want remove some ips from the blocked list ?