fixed email formatting, fixed log inclusion in email, quieted firewall-cmd output, fixed escaped quoting in command buffering

Author: Todd Stein

auto-blockip.journald

@@ -37,10 +37,10 @@ blockIP() { # input is a string
 	# if we've seen fewer than $MOLE_LIMIT attackers from this /24
 	if [[ $(firewall-cmd --list-rich-rules | egrep -c "$same_subnet_match_string") -lt $MOLE_LIMIT ]]; then
 		# we only want to block the IP
-		local ip_search_string="^rule family=\"ipv4\" source address=\"($escaped_ip|${escaped_ip%.*}.0/24)\" reject$"
+		local ip_search_string="^rule family=\\\"ipv4\\\" source address=\\\"($escaped_ip|${escaped_ip%.*}.0/24)\\\" reject$"
 		local command="
 			if ! firewall-cmd --list-rich-rules | egrep -q \"$ip_search_string\"; then
-				firewall-cmd --add-rich-rule=\"rule family='ipv4' source address='$ip' reject\"
+				firewall-cmd -q --add-rich-rule=\"rule family='ipv4' source address='$ip' reject\"
 			fi
 		"
 	else
@@ -49,7 +49,7 @@ blockIP() { # input is a string
 		local subnet_search_string="^rule family=\"ipv4\" source address=\"${subnet//./\.}\" reject$"
 		local command="
 			if ! firewall-cmd --list-rich-rules | egrep -q \"$subnet_search_string\"; then
-				firewall-cmd --add-rich-rule=\"rule family='ipv4' source address='$subnet' reject\"
+				firewall-cmd -q --add-rich-rule=\"rule family='ipv4' source address='$subnet' reject\"
 			fi
 		"
 	fi
@@ -119,23 +119,13 @@ sendMail() { # no input
 	fi
 
 	body="$(printf "%s\n\n\n%s\n\n\n%s" "$heading" "$whois" "$log")"
-	body="$heading\n\n\n$whois\n\n\n$log"
-
-	(
-		echo "From: cron@$HOSTNAME"
-		echo "To: ${EMAIL_ADDRESS}"
-		echo "Subject: ${subject}"
-		echo "Content-Type: text/html"
-		echo "MIME-Version: 1.0"
-		echo ""
-		echo "${body}"
-	) | /usr/sbin/sendmail -t
+
+	mail -s "$subject" "$EMAIL_ADDRESS" <<<"$body"
 }
 
 
 # generate list of possible attackers
-attackers=$(last_n_minutes.journald $LOOK_BACK | egrep 'sshd\[[0-9]+\]:.*(Failed password|Invalid user)' | egrep -o '\bfrom ([0-9]{1,3}\.){3}[0-9]{1,3}\b' | sort | uniq -c | sort -nr | awk -v m=$MAX_ALLOWED_FAILURES -F '[= ]+' '{if ($2>m) {print $NF} else {exit}}')
-
+attackers=$(journalctl --since "$LOOK_BACK minutes ago" | egrep 'sshd\[[0-9]+\]:.*(Failed password|Invalid user)' | egrep -o '\bfrom ([0-9]{1,3}\.){3}[0-9]{1,3}\b' | sort | uniq -c | sort -nr | awk -v m=$MAX_ALLOWED_FAILURES -F '[= ]+' '{if ($2>m) {print $NF}}')
 
 for rhost in $attackers; do
 
@@ -157,7 +147,7 @@ for rhost in $attackers; do
 		blockIP $ip
 
 		# grab full secure history of $rhost
-		log=$(last_n_minutes.journald $LOOK_BACK | grep -E "\b${rhost//./\.}\b")
+		log=$(journalctl --since "24 hours ago" | grep -E "\b${rhost//./\.}\b")
 
 		# set $whois and $country
 		getWhoisAndCountry $ip