Add Bot Blocker - Apache User-Agent blocking manager

Features:
- Enable/disable bot blocking with one click
- Blocks security scanners (nikto, sqlmap, nmap, etc.)
- Blocks aggressive SEO bots (AhrefsBot, SemrushBot, etc.)
- Blocks AI crawlers (GPTBot, Claude-Web, ChatGPT-User, etc.)
- Blocks generic scrapers (Go-http-client, etc.)
- Automatic backups before changes
- Apache syntax validation before applying
- Safe restart with rollback on failure
- View current configuration
- Manage backups and restore

Configuration:
- File: /etc/apache2/conf.d/includes/pre_main_global.conf
- Blocks 24+ malicious bot user-agents
- Returns HTTP 403 Forbidden to blocked bots
- Zero impact on legitimate traffic

Integrated into Security Menu (option 16)

launcher.sh

@@ -139,6 +139,7 @@ show_security_menu() {
     echo ""
     echo -e "  ${YELLOW}13)${NC} 🔒 Enable cPHulk Protection  - Brute force protection"
     echo -e "  ${YELLOW}14)${NC} ⚙️  Optimize CT_LIMIT         - Connection tracking tuning"
+    echo -e "  ${YELLOW}16)${NC} 🤖 Block Malicious Bots      - User-Agent blocking (Apache)"
     echo ""
     echo -e "${BOLD}Analysis Tools:${NC}"
     echo ""
@@ -171,6 +172,7 @@ handle_security_menu() {
             13) run_module "security" "enable-cphulk.sh" ;;
             14) run_module "security" "optimize-ct-limit.sh" ;;
             15) bash "$BASE_DIR/tools/analyze-historical-attacks.sh" ;;
+            16) run_module "security" "bot-blocker.sh" ;;
             0) return ;;
             *) echo -e "${RED}Invalid option${NC}"; sleep 1 ;;
         esac

modules/security/bot-blocker.sh

@@ -0,0 +1,497 @@
+#!/bin/bash
+################################################################################
+# Bot Blocker - Apache User-Agent Blocking Manager
+################################################################################
+# Blocks malicious bots, scrapers, and AI crawlers at Apache level
+# Safe implementation with backup, validation, and rollback
+################################################################################
+
+# Source common functions
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../../lib/common-functions.sh" 2>/dev/null || {
+    echo "[ERROR] Cannot load common-functions.sh"
+    exit 1
+}
+
+# Detect control panel and system (optional)
+if type -t detect_system &>/dev/null; then
+    detect_system
+fi
+
+# Configuration
+APACHE_CONF="/etc/apache2/conf.d/includes/pre_main_global.conf"
+BACKUP_DIR="/root/.bot-blocker-backups"
+MARKER_START="# BEGIN Bot Blocker - Managed by Server Toolkit"
+MARKER_END="# END Bot Blocker"
+
+# Default bot list (security scanners, aggressive SEO bots, AI crawlers)
+DEFAULT_BOT_LIST="nikto|nmap|masscan|sqlmap|havij|acunetix|nessus|burp|metasploit|AhrefsBot|SemrushBot|MJ12bot|DotBot|Meta-ExternalAgent|Go-http-client|ChatGPT-User|GPTBot|Google-Extended|anthropic-ai|Claude-Web|CCBot|Omgilibot|FacebookBot|Bytespider|PerplexityBot"
+
+################################################################################
+# Helper Functions
+################################################################################
+
+check_apache_installed() {
+    if ! command -v httpd &>/dev/null; then
+        print_error "Apache is not installed"
+        return 1
+    fi
+    return 0
+}
+
+check_apache_config_exists() {
+    local conf_dir=$(dirname "$APACHE_CONF")
+
+    if [ ! -d "$conf_dir" ]; then
+        print_warning "Apache config directory doesn't exist: $conf_dir"
+        echo ""
+        read -p "Create directory? (yes/no): " create_dir
+        if [ "$create_dir" = "yes" ]; then
+            mkdir -p "$conf_dir"
+            print_success "Created directory: $conf_dir"
+        else
+            return 1
+        fi
+    fi
+
+    if [ ! -f "$APACHE_CONF" ]; then
+        print_info "Config file doesn't exist, will be created: $APACHE_CONF"
+        touch "$APACHE_CONF"
+    fi
+
+    return 0
+}
+
+is_bot_blocking_enabled() {
+    if [ ! -f "$APACHE_CONF" ]; then
+        return 1
+    fi
+
+    grep -q "$MARKER_START" "$APACHE_CONF" 2>/dev/null
+}
+
+create_backup() {
+    mkdir -p "$BACKUP_DIR"
+
+    local backup_file="$BACKUP_DIR/pre_main_global.conf.$(date +%Y%m%d_%H%M%S)"
+
+    if [ -f "$APACHE_CONF" ]; then
+        cp "$APACHE_CONF" "$backup_file"
+        print_success "Backup created: $backup_file"
+        echo "$backup_file"
+    else
+        # No existing file to backup
+        echo ""
+    fi
+}
+
+validate_apache_syntax() {
+    print_info "Validating Apache configuration..."
+
+    if httpd -t 2>&1 | grep -q "Syntax OK"; then
+        print_success "Apache configuration syntax is valid"
+        return 0
+    else
+        print_error "Apache configuration has syntax errors:"
+        echo ""
+        httpd -t 2>&1 | grep -v "Syntax OK"
+        return 1
+    fi
+}
+
+restart_apache() {
+    print_info "Restarting Apache..."
+
+    if systemctl restart httpd; then
+        print_success "Apache restarted successfully"
+        return 0
+    else
+        print_error "Failed to restart Apache"
+        return 1
+    fi
+}
+
+restore_backup() {
+    local backup_file="$1"
+
+    if [ -f "$backup_file" ]; then
+        cp "$backup_file" "$APACHE_CONF"
+        print_success "Configuration restored from backup"
+        restart_apache
+    else
+        print_error "Backup file not found: $backup_file"
+    fi
+}
+
+################################################################################
+# Core Functions
+################################################################################
+
+enable_bot_blocking() {
+    print_banner "Enable Bot Blocking"
+
+    # Check prerequisites
+    if ! check_apache_installed; then
+        press_enter
+        return 1
+    fi
+
+    if ! check_apache_config_exists; then
+        press_enter
+        return 1
+    fi
+
+    # Check if already enabled
+    if is_bot_blocking_enabled; then
+        print_warning "Bot blocking is already enabled"
+        echo ""
+        read -p "Re-apply configuration? (yes/no): " reapply
+        if [ "$reapply" != "yes" ]; then
+            return 0
+        fi
+        disable_bot_blocking_silent
+    fi
+
+    echo ""
+    echo "Bot Blocking Configuration:"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo ""
+    echo "This will block the following types of bots:"
+    echo ""
+    echo "  🔴 Security Scanners:"
+    echo "     nikto, nmap, masscan, sqlmap, havij, acunetix, nessus, burp, metasploit"
+    echo ""
+    echo "  🟡 Aggressive SEO Bots:"
+    echo "     AhrefsBot, SemrushBot, MJ12bot, DotBot"
+    echo ""
+    echo "  🟣 AI Crawlers:"
+    echo "     ChatGPT-User, GPTBot, Google-Extended, Claude-Web, anthropic-ai"
+    echo ""
+    echo "  🔵 Generic Scrapers:"
+    echo "     Go-http-client, Meta-ExternalAgent, CCBot, Omgilibot, FacebookBot,"
+    echo "     Bytespider, PerplexityBot"
+    echo ""
+    echo "Configuration file: $APACHE_CONF"
+    echo ""
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo ""
+    read -p "Proceed with enabling bot blocking? (yes/no): " confirm
+
+    if [ "$confirm" != "yes" ]; then
+        echo "Cancelled."
+        press_enter
+        return 0
+    fi
+
+    # Create backup
+    echo ""
+    local backup_file=$(create_backup)
+
+    # Add bot blocking rules
+    echo ""
+    print_info "Adding bot blocking rules..."
+
+    # Build the configuration with variables expanded
+    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
+
+    cat >> "$APACHE_CONF" <<EOF
+
+# BEGIN Bot Blocker - Managed by Server Toolkit
+# Blocks malicious bots, scrapers, and AI crawlers
+# Last updated: ${timestamp}
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteCond %{HTTP_USER_AGENT} "(${DEFAULT_BOT_LIST})" [NC]
+    RewriteRule ^ - [F,L]
+</IfModule>
+# END Bot Blocker
+
+EOF
+
+    print_success "Bot blocking rules added"
+
+    # Validate syntax
+    echo ""
+    if ! validate_apache_syntax; then
+        print_error "Configuration validation failed!"
+        echo ""
+        read -p "Rollback to previous configuration? (yes/no): " rollback
+        if [ "$rollback" = "yes" ] && [ -n "$backup_file" ]; then
+            restore_backup "$backup_file"
+        fi
+        press_enter
+        return 1
+    fi
+
+    # Restart Apache
+    echo ""
+    if restart_apache; then
+        echo ""
+        print_success "═══════════════════════════════════════════════════════"
+        print_success "Bot blocking enabled successfully!"
+        print_success "═══════════════════════════════════════════════════════"
+        echo ""
+        echo "What happens now:"
+        echo "  ✓ Blocked bots receive HTTP 403 Forbidden"
+        echo "  ✓ Legitimate traffic is unaffected"
+        echo "  ✓ Configuration survives Apache restarts"
+        echo ""
+        echo "To disable: Use option 2 from the menu"
+        echo ""
+    else
+        print_error "Failed to restart Apache"
+        if [ -n "$backup_file" ]; then
+            echo ""
+            read -p "Rollback to previous configuration? (yes/no): " rollback
+            if [ "$rollback" = "yes" ]; then
+                restore_backup "$backup_file"
+            fi
+        fi
+    fi
+
+    press_enter
+}
+
+disable_bot_blocking_silent() {
+    # Silent version for internal use (re-apply scenario)
+    if [ -f "$APACHE_CONF" ]; then
+        sed -i "/$MARKER_START/,/$MARKER_END/d" "$APACHE_CONF"
+    fi
+}
+
+disable_bot_blocking() {
+    print_banner "Disable Bot Blocking"
+
+    # Check if enabled
+    if ! is_bot_blocking_enabled; then
+        print_warning "Bot blocking is not currently enabled"
+        press_enter
+        return 0
+    fi
+
+    echo ""
+    echo "This will remove bot blocking rules from:"
+    echo "  $APACHE_CONF"
+    echo ""
+    read -p "Proceed with disabling bot blocking? (yes/no): " confirm
+
+    if [ "$confirm" != "yes" ]; then
+        echo "Cancelled."
+        press_enter
+        return 0
+    fi
+
+    # Create backup
+    echo ""
+    local backup_file=$(create_backup)
+
+    # Remove bot blocking rules
+    echo ""
+    print_info "Removing bot blocking rules..."
+
+    sed -i "/$MARKER_START/,/$MARKER_END/d" "$APACHE_CONF"
+
+    print_success "Bot blocking rules removed"
+
+    # Validate syntax
+    echo ""
+    if ! validate_apache_syntax; then
+        print_error "Configuration validation failed!"
+        echo ""
+        read -p "Rollback to previous configuration? (yes/no): " rollback
+        if [ "$rollback" = "yes" ] && [ -n "$backup_file" ]; then
+            restore_backup "$backup_file"
+        fi
+        press_enter
+        return 1
+    fi
+
+    # Restart Apache
+    echo ""
+    if restart_apache; then
+        echo ""
+        print_success "Bot blocking disabled successfully"
+        echo ""
+    else
+        print_error "Failed to restart Apache"
+        if [ -n "$backup_file" ]; then
+            echo ""
+            read -p "Rollback to previous configuration? (yes/no): " rollback
+            if [ "$rollback" = "yes" ]; then
+                restore_backup "$backup_file"
+            fi
+        fi
+    fi
+
+    press_enter
+}
+
+view_configuration() {
+    print_banner "Current Bot Blocking Configuration"
+
+    if ! is_bot_blocking_enabled; then
+        print_warning "Bot blocking is not currently enabled"
+        echo ""
+        echo "Use option 1 to enable bot blocking"
+        press_enter
+        return 0
+    fi
+
+    echo ""
+    echo "Status: ${GREEN}Enabled${NC}"
+    echo "Config file: $APACHE_CONF"
+    echo ""
+    echo "Current rules:"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+
+    # Extract and display bot blocking section
+    sed -n "/$MARKER_START/,/$MARKER_END/p" "$APACHE_CONF"
+
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo ""
+
+    # Parse and display bot list
+    local bot_list=$(sed -n "/$MARKER_START/,/$MARKER_END/p" "$APACHE_CONF" | grep "RewriteCond.*HTTP_USER_AGENT" | sed 's/.*"(\(.*\))".*/\1/')
+
+    if [ -n "$bot_list" ]; then
+        echo "Blocked User-Agents:"
+        echo ""
+        echo "$bot_list" | tr '|' '\n' | nl | column -t
+        echo ""
+    fi
+
+    press_enter
+}
+
+test_configuration() {
+    print_banner "Test Apache Configuration"
+
+    echo ""
+    print_info "Running Apache syntax check..."
+    echo ""
+
+    if validate_apache_syntax; then
+        echo ""
+        print_success "Configuration is valid and ready to apply"
+    else
+        echo ""
+        print_error "Configuration has errors - fix before applying"
+    fi
+
+    echo ""
+    press_enter
+}
+
+manage_backups() {
+    print_banner "Backup Management"
+
+    if [ ! -d "$BACKUP_DIR" ] || [ -z "$(ls -A "$BACKUP_DIR" 2>/dev/null)" ]; then
+        print_warning "No backups found"
+        echo ""
+        echo "Backups are created automatically when you enable/disable bot blocking"
+        press_enter
+        return 0
+    fi
+
+    echo ""
+    echo "Available backups:"
+    echo ""
+
+    local count=1
+    while IFS= read -r backup; do
+        local size=$(du -h "$backup" | cut -f1)
+        local date=$(basename "$backup" | sed 's/pre_main_global.conf.//')
+        echo "  $count) $date ($size)"
+        count=$((count + 1))
+    done < <(ls -t "$BACKUP_DIR"/*.conf.* 2>/dev/null)
+
+    echo ""
+    echo "  0) Back to menu"
+    echo ""
+    read -p "Select backup to restore (or 0 to cancel): " selection
+
+    if [ "$selection" = "0" ]; then
+        return 0
+    fi
+
+    local backup_file=$(ls -t "$BACKUP_DIR"/*.conf.* 2>/dev/null | sed -n "${selection}p")
+
+    if [ -z "$backup_file" ]; then
+        print_error "Invalid selection"
+        press_enter
+        return 1
+    fi
+
+    echo ""
+    echo "Selected backup: $(basename "$backup_file")"
+    echo ""
+    read -p "Restore this backup? (yes/no): " confirm
+
+    if [ "$confirm" = "yes" ]; then
+        restore_backup "$backup_file"
+        echo ""
+        print_success "Backup restored successfully"
+    fi
+
+    press_enter
+}
+
+################################################################################
+# Main Menu
+################################################################################
+
+show_menu() {
+    clear
+    print_banner "Bot Blocker - Apache User-Agent Management"
+
+    # Show status
+    if is_bot_blocking_enabled; then
+        echo -e "Status: ${GREEN}●${NC} Enabled"
+    else
+        echo -e "Status: ${RED}○${NC} Disabled"
+    fi
+
+    echo ""
+    echo -e "${BOLD}Configuration:${NC}"
+    echo ""
+    echo "  1) Enable Bot Blocking   - Block malicious bots and scrapers"
+    echo "  2) Disable Bot Blocking  - Remove blocking rules"
+    echo "  3) View Configuration    - Show current rules"
+    echo ""
+    echo -e "${BOLD}Maintenance:${NC}"
+    echo ""
+    echo "  4) Test Configuration    - Validate Apache syntax"
+    echo "  5) Manage Backups        - View and restore backups"
+    echo ""
+    echo "  0) Back to Security Menu"
+    echo ""
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo -n "Select option: "
+}
+
+main() {
+    while true; do
+        show_menu
+        read -r choice
+
+        case $choice in
+            1) enable_bot_blocking ;;
+            2) disable_bot_blocking ;;
+            3) view_configuration ;;
+            4) test_configuration ;;
+            5) manage_backups ;;
+            0)
+                clear
+                exit 0
+                ;;
+            *)
+                echo ""
+                print_error "Invalid option"
+                sleep 1
+                ;;
+        esac
+    done
+}
+
+# Run main menu
+main