1

I'm a sysadmin intern for a web hosting company and I'm trying to figure out how to get this task accomplished so I'll be as descriptive as possible.

We have /etc/blockedips and /etc/donotblock

I want to create a script that I can eventually setup in cron that will run like once every hour that scans both files and compares them and either a) send an alert out (we use watchdog) or b) automatically removes the IP inside /blockedips that matches what it shouldnt be blocking inside /donotblock as we have a lot of other techs who always add IPs that shouldnt be blocked.

The problem I'm having as I am new to scripting is that I can easily run a simple grep command for straight IP addresses (ie: 76.76.76.76 will easily match across both files) but I cant figure out how to do the following:

Lets say our companies IP block is 99.10.10.0/24. I don't want to put in every single address inside /donotblock, I just want the script to match any IP that is 99.10.10.* and I am drawing a blank on how to accomplish this.

Can someone point me in the right direction with this? Edit: Sample

So the files look like so:

/etc/donotblock

Us

26.225.128.0/18 43.150.128.0/20 44.50.142.0/24 73.16.32.0/20

Everyone Else

184.123.20.10 184.123.20.11

and then

/etc/blocked_ips

76.45.23.1

lets say some tech added into the /blocked_ips

73.16.32.10, I just want the script to look for "73.16.32.*" to make up for that whole subnet.

Speaking to the lead engineer he prefers to just have the script automatically remove the IP inside blocked_ips that match whats in donotblock

Thanks

  • Since I don't know your file's structure (a sample would be very helpful on your original post BTW) a suggestion I can make is, separate IP address octets by / first and see if you have any broader subnet definitions. Then separate it again by . to understand the nature of your IP address (network or a node) then decide how to go forward. Such as replacing /24 at the end of an IP address by .* if this is your wish. – MelBurslan Feb 23 '16 at 14:47
  • Still you can use grep and cut in your script to format the string in the way you like it. But ye, as @MelBurslan say, an sample of the files will be very useful. – Svetlin Tonchev Feb 23 '16 at 15:13
  • Sorry for the late response. So the files look like so: /etc/donotblock #Us# 26.225.128.0/18 43.150.128.0/20 44.50.142.0/24 73.16.32.0/20 ##Everyone Else## 184.123.20.10 184.123.20.11 and then /etc/blocked_ips 76.45.23.1 lets say some tech added into the /blocked_ips 73.16.32.10, I just want the script to look for "73.16.32.*" to make up for that whole subnet. Speaking to the lead engineer he prefers to just have the script automatically remove the IP inside blocked_ips that match whats in donotblock – RaptureVeteran Feb 24 '16 at 6:11
0

The netaddr Python package lets you iterate over IP ranges:

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from netaddr import *

ipset = IPSet(['99.10.10.0/24'])

for ip in ipset:
     print ip

Output:

99.10.10.0
99.10.10.1
99.10.10.2
...
99.10.10.253
99.10.10.254
99.10.10.255

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.