cschantz 526fb23ad0 Add centralized IP reputation tracking system
Created a comprehensive IP reputation system that tracks IPs across all
toolkit scripts with tags/attack types, scores, and detailed analytics.

NEW FILES:
- lib/ip-reputation.sh: Core reputation library with optimized database
  * Fast lookup using pipe-delimited file format
  * Attack type tagging system (bitmask: SQL, XSS, RCE, Bot, Scanner, etc.)
  * Reputation scoring (0-100) based on hits and attack severity
  * GeoIP country lookup integration
  * Automatic cleanup of old entries
  * Thread-safe with file locking

- modules/security/ip-reputation-manager.sh: Interactive management tool
  * Query individual IPs with full details
  * View top malicious/active IPs
  * Database statistics and analytics
  * Manual IP flagging/whitelisting
  * Import IPs from logs
  * Export to readable reports
  * Live monitoring mode

INTEGRATION:
All security and analysis scripts now use the centralized reputation system:

- modules/website/500-error-tracker.sh:
  * Tracks IPs generating 500 errors
  * Tags bots/scanners with BOT/SCANNER flags
  * Background processing for performance

- modules/security/live-attack-monitor.sh:
  * Maps attack types to reputation flags
  * Tracks SSH bruteforce, SQL injection, XSS, DDoS, etc.
  * Real-time reputation updates

- modules/website/website-error-analyzer.sh:
  * Tags filtered bots in error analysis
  * Builds IP reputation from website errors

- launcher.sh:
  * Added IP Reputation Manager to Bot & Traffic Analysis menu
  * Menu option 4 in Security > Analysis > Bot & Traffic Analysis

KEY FEATURES:
✓ Centralized IP tracking across ALL scripts
✓ Multi-tag system (IP can have multiple attack types)
✓ Reputation scores increase with more tags/attacks
✓ Country tracking via GeoIP
✓ Optimized for high-volume traffic (attacks with 1000s of IPs)
✓ Fast lookups even during DDoS
✓ Background processing doesn't slow down analysis
✓ Database cleanup/maintenance tools
✓ Export for reports and sharing

BENEFITS:
- Single source of truth for IP reputation
- Scripts share intelligence (bot detected in one script = flagged for all)
- Track IPs across time and multiple attack vectors
- Identify repeat offenders with multiple attack types
- Make blocking decisions based on comprehensive data
- Performance optimized with file locking and background updates
2025-11-05 18:45:55 -05:00
2025-11-03 18:41:30 -05:00
2025-11-03 18:14:51 -05:00

Linux Server Management Toolkit

Comprehensive cPanel/Linux server management suite with modular architecture and intelligent security features.

📦 Directory Structure

server-toolkit/
├── launcher.sh                          # Main menu system
├── README.md                            # This file
│
├── modules/                             # Modular scripts organized by category
│   ├── security/                        # 🛡️ Security & Threat Analysis
│   │   ├── bot-analyzer.sh             # Full bot/threat analysis
│   │   ├── live-attack-monitor.sh      # Real-time attack monitoring dashboard
│   │   ├── ssh-attack-monitor.sh       # SSH brute force detection
│   │   ├── web-traffic-monitor.sh      # Web traffic monitoring
│   │   ├── firewall-activity-monitor.sh # CSF/iptables monitoring
│   │   ├── enable-cphulk.sh            # cPHulk enablement with CSF whitelist import
│   │   └── tail-*.sh                   # Various log monitoring scripts
│   │
│   ├── diagnostics/                     # 🔍 System Diagnostics
│   │   └── system-health-check.sh      # Comprehensive health analysis
│   │
│   └── performance/                     # 📊 Performance Analysis
│       ├── hardware-health-check.sh    # Hardware diagnostics
│       ├── mysql-query-analyzer.sh     # MySQL performance analysis
│       └── network-bandwidth-analyzer.sh # Network analysis
│
├── lib/                                 # Shared libraries
│   ├── common-functions.sh             # Reusable functions
│   ├── system-detect.sh                # System type detection
│   ├── user-manager.sh                 # User account management
│   ├── mysql-analyzer.sh               # MySQL utilities
│   └── reference-db.sh                 # Cross-module intelligence sharing
│
├── config/                              # Configuration files
│   ├── settings.conf                   # Main configuration
│   ├── whitelist-ips.txt               # IP whitelist
│   └── whitelist-user-agents.txt       # User-Agent whitelist
│
└── tools/                               # Utility scripts
    ├── diagnostic-report.sh            # Generate system reports
    └── test-*.sh                       # Testing utilities

🚀 Quick Start

Installation & Running

# Download and run in one command
curl -sL https://git.mull.lol/cschantz/Linux-Server-Management-Toolkit/archive/main.tar.gz | tar xz && cd linux-server-management-toolkit && bash launcher.sh

Or if already downloaded:

bash /root/server-toolkit/launcher.sh

Key Features

🛡️ Security & Threat Analysis

  • 3-Mode Security Menu: Analysis / Actions / Live Monitoring
  • Live Attack Monitor: Real-time SOC dashboard with threat classification
  • Intelligent cPHulk Setup: Auto-imports CSF whitelists from all sources
  • Multi-Source Monitoring: SSH, Web, Firewall, cPHulk integration

🔍 System Diagnostics

  • Comprehensive Health Checks: Hardware, services, security posture
  • Smart Recommendations: Context-aware suggestions based on findings
  • cPanel/WHM Integration: Native support for cPanel environments

📊 Session Intelligence

  • Reference Database: Cross-module data sharing (.sysref)
  • No Historical Tracking: Session-based intelligence only
  • "Download, Run, Fix, Delete": Designed for one-time troubleshooting

🎯 Usage Examples

Security Analysis with Live Monitoring

bash launcher.sh
# Select: Security & Threat Analysis
# Select: Live Monitoring & Alerts
# Select: Live Network Security Monitor

Enable cPHulk with CSF Whitelist

bash launcher.sh
# Select: Security & Threat Analysis
# Select: Security Actions & Fixes
# Select: Authentication Security
# Select: Enable cPHulk Protection

System Health Check

bash launcher.sh
# Select: System Diagnostics
# Select: System Health Check

🔧 Configuration

Edit the configuration file:

nano /root/server-toolkit/config/settings.conf

🔒 Security Considerations

  • Run as root: Most modules require root access
  • Credentials stored safely: Git credentials in ~/.git-credentials (outside project)
  • No sensitive data in repo: .gitignore excludes keys, tokens, credentials
  • Test first: Try on non-production environments first

📊 Recent Updates (v2.0)

  • Complete security menu restructure (3-mode hierarchy)
  • Live network security monitoring dashboard
  • Intelligent cPHulk enablement with multi-source CSF whitelist discovery
  • Real-time threat detection and classification
  • Reference database for cross-module intelligence
  • Git repository integration

🙏 Credits

Built for comprehensive cPanel/Linux server management with a focus on security and intelligent automation.


Version: 2.0.0 Repository: https://git.mull.lol/cschantz/Linux-Server-Management-Toolkit

S
Description
No description provided
Readme MIT 18 MiB
Languages
Shell 100%