Linux-Server-Management-Toolkit

cschantz/Linux-Server-Management-Toolkit

Files

T

cschantz 1ee883aa4d Fix auto-blocking: Add missing quick_block_ip() + instant block for score 100

USER REPORT:
- IPs hitting reputation 100 not being auto-blocked
- Auto-blocking appears completely broken

ROOT CAUSE ANALYSIS:
1. Missing quick_block_ip() function (called at line 1758 but never defined)
2. Auto-mitigation engine lacked score validation (empty/non-numeric scores failed silently)
3. No differentiation between score 80-99 vs 100 (instant block)

FIXES APPLIED:

1. Added quick_block_ip() function (lines 888-901)
   - Wrapper around block_ip_temporary()
   - Used by ET detection and auto-mitigation engine
   - Background-compatible, IPset-optimized

2. Added score validation in auto_mitigation_engine() (lines 2687-2689)
   - Validates score is not empty
   - Validates score is numeric
   - Defaults to 0 if invalid
   - Prevents silent failures in integer comparison

3. Added INSTANT blocking for score 100 (lines 2694-2713)
   - Score 100 = immediate IPset block
   - Labeled as "INSTANT_BLOCK" in logs
   - Uses quick_block_ip() for speed
   - Separate from regular auto-block (score 80-99)

4. Maintained existing auto-block for score >= 80 (lines 2715-2734)
   - Regular 1-hour temporary block
   - Labeled as "AUTO_BLOCK" in logs
   - Uses block_ip_temporary()

BLOCKING TIERS NOW:
- Score 100: INSTANT_BLOCK (immediate IPset, highest priority)
- Score 80-99: AUTO_BLOCK (1-hour temp block)
- Score 60-79: Manual blocking recommended (user presses 'b')
- Score < 60: Monitoring only

This restores the original auto-blocking behavior that was broken.

2025-12-24 19:21:55 -05:00

bot-analyzer.sh

Fix menu standards: Add RED 0 back buttons to remaining 6 menus

2025-12-17 01:34:24 -05:00

enable-cphulk.sh

Fix cPHulk to use SQLite database instead of MySQL

2025-12-11 17:01:17 -05:00

firewall-activity-monitor.sh

Initial commit: Server Management Toolkit v2.0

2025-11-03 18:21:40 -05:00

ip-reputation-manager.sh

Fix final 10 HIGH integer comparisons in live-attack-monitor and ip-reputation-manager