Tiki link spammers

FEATURE(dnsbl, `relays.ordb.org', `Rejected -- see http://ordb.org/ for reason')dnl
FEATURE(dnsbl, `sbl-xbl.spamhaus.org', `Rejected -- see http://www.spamhaus.org/SBL for reason')dnl
FEATURE(dnsbl, `bl.spamcop.net', `Rejected -- see http://spamcop.net for reason')dnl
FEATURE(dnsbl, `dnsbl.sorbs.net', `554 Rejected see http://dnsbl.sorbs.net')dnl
FEATURE(dnsbl, `list.dsbl.org', `Rejected -- see http://dsbl.org for reason')dnl
FEATURE(dnsbl, `block.rhs.mailpolice.com', `Rejected -- see http://rhs.mailpolice.com')dnl
FEATURE(dnsbl, `cbl.abuseat.org', `Rejected -- see http://cbl.abuseat.org')dnl
FEATURE(dnsbl, `l1.spews.dnsbl.sorbs.net', `Rejected -- see http://spews.org')dnl

watch "iwlist eth1 scan 2>/dev/null|grep -o \"Signal level=[0-9-]* dBm\"|head -n 1 | festival --tts"

# List your hosts (hostname, or FQDN) separated with spaces
HOSTS="hewey dewey lewey"

# Base file name
KEYFILE=authorized_keys

# Wipe out old temp file
rm $KEYFILE.new
# Collect (concatenate) public RSA keys from all hosts
# If you have errors, you may either be lacking the key -- use "ssh-keygen -t rsa"
# Of you might have a key that has changed (remove the offending key)
for i in $HOSTS ; do {
  echo "Host: $i"
  ssh $i cat .ssh/id_rsa.pub >>$KEYFILE.new
} ; done

chmod go-rw $KEYFILE.new

# Push newly built collection of all keys into all hosts
for i in $HOSTS ; do {
  echo "Host: $i"
  scp -p $KEYFILE.new $i:.ssh/$KEYFILE
} ; done

#!/usr/bin/perl

# Chain INPUT (policy DROP 6290 packets, 2646K bytes)
# num   pkts bytes target     prot opt in     out     source               destination
# 1       15  1232 droplog    tcp  --  *      *       151.164.60.251       0.0.0.0/0          tcp dpt:22
# 2        6   448 droplog    tcp  --  *      *       151.164.60.251       0.0.0.0/0          tcp dpt:22
# 3        5   384 droplog    tcp  --  *      *       210.0.137.196        0.0.0.0/0          tcp dpt:22

my $num, $pkts, $bytes, $target, $prot, $opt, $in, $out, $source, $destination, $prot2, $port;
my $p_prot, $p_source, $p_destination, $p_prot2, $p_port;

my @cmds;

foreach (`iptables -vnL INPUT --line-numbers`) {
  ($num, $pkts, $bytes, $target, $prot, $opt, $in, $out, $source, $destination, $prot2, $port) = split;
  if ($target eq "droplog") {
    if ($p_prot eq $prot && $p_source eq $source && $p_destination eq $destination && $p_prot2 eq $prot2 && $p_port eq $port) {
      push @cmds, "iptables -D INPUT $num"
    }
  }
  $p_prot = $prot;
  $p_source = $source;
  $p_destination = $destination;
  $p_prot2 = $prot2;
  $p_port = $port;
}

while ($val = pop @cmds) {
  print "$val\n";
  `$val`
}

!/usr/bin/perl

# NOTE: Your wget needs to be at least v1.8 to handle PHP based pages
# NOTE: Could use Algorithm::Diff -- if it was more widely available

use strict;
use DBI();

my $debug = 0;

# Connect to sites database
my $dbh = DBI->connect("DBI:mysql:database=floyd;host=localhost", "USERNAME", "PASSWORD", {'RaiseError' => 1});

# Query out of the sites database all proper domains (not subdomains), that have verify flag set to yes
my $sth = $dbh->prepare("SELECT domain,page,contact FROM sites WHERE verify = 'Y' AND domain NOT LIKE '%.%.%'");
$sth->execute();

while (my $ref = $sth->fetchrow_hashref()) {
   my $domain = $ref->{'domain'};
   $debug && print "$domain\t";
   my $page = `wget -q -O - $domain`;
   my $orig = $ref->{'page'};
   if ($orig) {
      if ($orig eq $page) {
         $debug && print "Complete match\n";
      } else {
         open(OUTFILE1, ">/tmp/verify1.$$.txt") or die "Can't open /tmp/verify1.txt: $!";
         print OUTFILE1 $orig;
         close(OUTFILE1);
         open(OUTFILE2, ">/tmp/verify2.$$.txt") or die "Can't open /tmp/verify2.txt: $!";
         print OUTFILE2 $page;
         close(OUTFILE2);
         my $res = `diff -abBdw /tmp/verify1.$$.txt /tmp/verify2.$$.txt`;
         my $count = () = $res =~ /\n/g;
         $debug && print "CHANGE LINES: $count\t\t";
         if ($count {'contact'}\nCc: root\nFrom: root\n";
            print MAIL "Subject: Warning: your site $domain index page has changed substantially ($count)\n\n";
            print MAIL "diff of the original page:\n$res\n";
            close MAIL;
         }
      }
   } else {
      $debug && print "No imprint -- storing initial\n";
      $dbh->do("UPDATE sites SET page = " . $dbh->quote($page) . " WHERE domain = " . $dbh->quote($domain));
   }
}
unlink("/tmp/verify1.$$.txt");
unlink("/tmp/verify2.$$.txt");
$sth->finish();

$dbh->disconnect();

CREATE TABLE floyd.sites (
        domain          VARCHAR(64)     NOT NULL PRIMARY KEY,
        verify          CHAR(1)         NOT NULL,
        path            VARCHAR(64)     NOT NULL,
        contact         VARCHAR(64)     NOT NULL,
        email           VARCHAR(64)     NOT NULL,
        aliases         VARCHAR(255),
        created         DATE,
        expires         DATE,
        page            TEXT
);

perlcode my $ssh_regex = '.*sshd.*authentication failure.*rhost=([^ ]+)';
perlcode my $secure_ssh_regex = '.*sshd.*Failed password.*from ([^ ]+)';
perlcode my $ftp_regex = '.*ftp.*authentication failure.*rhost=([^ ]+)';
perlcode my $xmlrpc_regex = '([^ ]+).*POST .*xmlrpc.php';

watchfor   /.*/ and /$ssh_regex/
        echo
        throttle threshold 4:60
        exec "iptables -I INPUT 1 -s $1 -p tcp --dport 22 -j droplog"

watchfor  /.*/ and /$secure_ssh_regex/
        echo
        throttle threshold 4:60
        exec "iptables -I INPUT 1 -s $1 -p tcp --dport 22 -j droplog"

watchfor  /.*/ and /$ftp_regex/
        echo
        throttle threshold 4:60
        exec "iptables -I INPUT 1 -s $1 -p tcp --dport 21 -j droplog"

watchfor /.*/ and /$xmlrpc_regex/
        echo
        throttle threshold 4:60
        exec "iptables -I INPUT 1 -s $1 -p tcp --dport 80 -j droplog"

swatch --tail-file="/var/log/messages /var/log/secure /var/log/httpd/access_log"