[Unit]
Description=Service for protect attacks of brute force ssh's

[Service]
Type=simple
ExecStart=/etc/sshield/sshield.sh
ExecStop=/etc/sshield/sshield.sh stop
RemainAfterExit=yes
Restart=always

[Install]
WantedBy=multi-user.target

Type=simple

ExecStart=/etc/sshield/sshield.sh

ExecStop=/etc/sshield/sshield.sh stop

if [[ $1 == "stop" ]];then
        kill -9 $$
fi

<VirtualHost *:80>
        # The ServerName directive sets the request scheme, hostname and port that
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request's Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.
        #ServerName www.example.com

        ServerAdmin webmaster@localhost
        DocumentRoot /home/webserver

        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf
</VirtualHost>
<VirtualHost *:8080>
        ServerName GTE
        ServerAdmin webmaster@localhost
        #ServerAlias pruebas2.local
        DocumentRoot /home/gte/
        ErrorLog ${APACHE_LOG_DIR}/error_gte.log
        CustomLog ${APACHE_LOG_DIR}/access_gte.log combined
</VirtualHost>
<VirtualHost *:8000>
        ServerName wordpress
        ServerAdmin webmaster@localhost
        DocumentRoot /home/wordpress/
        ErrorLog ${APACHE_LOG_DIR}/error_wordpress.log
        CustomLog ${APACHE_LOG_DIR}/access_wordpress.log combined
</VirtualHost>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

<VirtualHost *:80>
        # The ServerName directive sets the request scheme, hostname and port that
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request's Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.
        #ServerName www.example.com

        ServerAdmin webmaster@localhost
        DocumentRoot /home/webserver

        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf
</VirtualHost>
<VirtualHost *:8080>
        ServerName GTE
        ServerAdmin webmaster@localhost
        #ServerAlias pruebas2.local
        DocumentRoot /home/gte/
        ErrorLog ${APACHE_LOG_DIR}/error_gte.log
        CustomLog ${APACHE_LOG_DIR}/access_gte.log combined
</VirtualHost>
<VirtualHost *:8000>
        ServerName wordpress
        ServerAdmin webmaster@localhost
        DocumentRoot /home/wordpress/
        ErrorLog ${APACHE_LOG_DIR}/error_wordpress.log
        CustomLog ${APACHE_LOG_DIR}/access_wordpress.log combined
</VirtualHost>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

[     1.492033] Spectre V2 : Spectre mitigation: LFENCE not serializing, switching to generic retpoline

[     10.974097] rt10192ee: Polling FW ready fail!! REG_MCVFWOL:0x00000304. count = 3001
[     12.065251] rt10192ee: Polling FW ready fail!! REG_MCVFWOL:0x00000306. count = 3001

Oct 20 22:34:23 servheredia su: pam_unix(su:session): session opened for user root by administrador(uid=0)

Oct 20 22:21:36 servheredia sshd[3883]: Accepted password for administrador from 192.168.0.3 port 55592 ssh2

/etc/network/interfaces

# interfaces(5) file used by ifup(8) and ifdown(8)

# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'

# Include files from /etc/network/interfaces.d:
#xsource-directory /etc/network/interfaces.d/wlan0
#localhost
allow-hotplug wlan0
auto lo
iface lo inet loopback
#wlan0
iface wlan0 inet static
 address 192.168.0.2/24
 network 192.168.0.0
 broadcast 192.168.0.255
 gateway 192.168.0.1
 dns-nameservers 8.8.8.8 8.8.4.4
 wpa-ssid xxxxxx
 wpa-psk xxxxxxxxxxxxxxxxxxxx

root@servheredia:~# ping google.es
ping: google.es: Fallo temporal en la resolución del nombre

root@servheredia:~# apt-get update
Err:1 http://raspbian.raspberrypi.org/raspbian buster InRelease                  
  Fallo temporal al resolver «raspbian.raspberrypi.org»
Err:2 http://archive.raspberrypi.org/debian buster InRelease                     
  Fallo temporal al resolver «archive.raspberrypi.org»
Leyendo lista de paquetes... Hecho       
W: Fallo al obtener http://raspbian.raspberrypi.org/raspbian/dists/buster/InRelease  Fallo temporal al resolver «raspbian.raspberrypi.org»
W: Fallo al obtener http://archive.raspberrypi.org/debian/dists/buster/InRelease  Fallo temporal al resolver «archive.raspberrypi.org»
W: No se han podido descargar algunos archivos de índice, se han omitido, o se han utilizado unos antiguos en su lugar.

root@servheredia:~# exit
exit
administrador@servheredia:~ $ sudo su
sudo: unable to resolve host servheredia: Fallo temporal en la resolución del nombre
┼─────────────────────────────────────────────────────────────────────────────────────┼
│                                    IPS BLOQUEADAS                                   │
┼─────────────────────────────────────────────────────────────────────────────────────┼

/etc/resolv.conf

# Generated by resolvconf
nameserver 8.8.8.8
nameserver 8.8.4.4

*filter
:INPUT DROP [9048:4904870]
:FORWARD DROP [0:0]
:OUTPUT DROP [5753:7485333]
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 22 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 21 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT
COMMIT

iptables -I INPUT -p tcp --dport 20 -j ACCEPT #le digo que en el puerto de entrada si hay un paquete con el puerto de destino 20 lo acepte
iptables -I INPUT -p tcp --sport 20 -j ACCEPT #si el origen del puerto es 20
iptables -I OUTPUT -p tcp --sport 20 -j ACCEPT #si el puerto de origen es 20
iptables -I OUTPUT -p tcp --dport 20 -j ACCEPT #si el puerto de destino es 20