Linux-Server-Management-Toolkit

cschantz/Linux-Server-Management-Toolkit

Files

T

cschantz 26c69175cd Add full reputation tracking and auto-blocking for SYN flood attacks

CRITICAL FIX for active SYN flood attacks

PROBLEM:
- SYN_RECV connection monitoring only logged events
- NO reputation scoring for active SYN flood attackers
- NO auto-blocking even with 100+ simultaneous connections
- User report: "server with active attack cant auto block ips"

ROOT CAUSE:
SYN_RECV monitoring (lines 2225-2247) only logged to recent_events
without updating IP_DATA or reputation database. This meant:
- IPs with massive connection counts got no reputation score
- Auto-mitigation engine never saw these IPs
- Manual blocking was the only option

SOLUTION IMPLEMENTED:

1. Full IP Reputation Tracking (lines 2243-2317)
   - Reads/updates IP reputation file (ip_X_X_X_X)
   - Increments hit counter for each detection
   - Adds "SYN_FLOOD" to attack list

2. Progressive Scoring by Connection Count
   - 20-50 connections: +15 points
   - 50-100 connections: +25 points
   - 100+ connections: +40 points per hit
   - Can quickly reach score 100 for instant blocking

3. Advanced Intelligence Integration
   - Attack velocity tracking (rapid successive hits)
   - Attack diversity bonuses (multiple attack vectors)
   - Subnet attack detection (coordinated DDoS)
   - Timing pattern analysis (botnet identification)

4. Reputation Database Logging (line 2325)
   - Logs to IP reputation DB: flag_ip_attack()
   - Persistent tracking across sessions
   - Historical attack data preserved

5. Auto-Mitigation Integration (line 2317)
   - Writes IP data to file for auto_mitigation_engine()
   - Stores block reasons for detailed logging
   - Enables automatic blocking when score >= 80
   - INSTANT blocking when score = 100

ATTACK PROGRESSION EXAMPLE:
- Detection 1 (50 conns): Score 25
- Detection 2 (75 conns): Score 25 + 25 + bonuses = ~60
- Detection 3 (100 conns): Score 60 + 40 + bonuses = 100
- RESULT: INSTANT_BLOCK triggered automatically

This restores full auto-blocking for network-layer attacks.

2025-12-24 19:24:35 -05:00

bot-analyzer.sh

Fix menu standards: Add RED 0 back buttons to remaining 6 menus

2025-12-17 01:34:24 -05:00

enable-cphulk.sh

Fix cPHulk to use SQLite database instead of MySQL

2025-12-11 17:01:17 -05:00

firewall-activity-monitor.sh

Initial commit: Server Management Toolkit v2.0

2025-11-03 18:21:40 -05:00

ip-reputation-manager.sh

Fix final 10 HIGH integer comparisons in live-attack-monitor and ip-reputation-manager