Package: sephiroth
SephirothA Python3 script to build cloud block lists for servers.RequirementsPython 3.8SetupPythonIt is recommended to install sephiroth into a virtual environment. From a brand new Ubuntu 18.04 machine, the setup flow should look something like this:sudoapt-getinstallpython3python3-pip&&python-mpipinstallpipenv
mkdirsephiroth&&cdsephiroth
pipenvinstallsephirothYou can also get the always-latest updates by cloning directly from the repository.gitclonehttps://github.com/0xdade/sephiroth.gitcdsephiroth
pipenvinstall.DockerAlternatively, we provide aDockerfilewith build and run instructions, or you can fetch the latest version fromdockerhub:dockerpull0xdade/sephiroth
dockerrun--rm-v$(pwd):/app/outputsephiroth-snginx-tgcpUsageSephiroth provides a built in help menu through the use of Python's argparse library. It tells you which commands are required, as well as other options.sephirothonmaster[!]on🐳v19.03.12viasephirothvia🐍3.8.3
➜sephiroth--help
usage:Sephiroth[-h]-s{nginx,apache,iptables,ip6tables}-t{aws,azure,gcp,asn,file,oci,tor}[-aASN][-fFILENAME][-rREDIR_TARGET][-p][--no-ipv6][--compacted][-V]Sephirothismadetohelpblockclouds.

optionalarguments:-h,--helpshowthishelpmessageandexit-s{nginx,apache,iptables,ip6tables},--server{nginx,apache,iptables,ip6tables}Typeofservertobuildblocklistfor-t{aws,azure,gcp,asn,file,oci,tor,do},--target{aws,azure,gcp,asn,file,oci,tor,do}Targetstoblock-aASN,--asnASNASNtoblockinAS####format-fFILENAME,--fileFILENAMEFilestoblockaddressesfrom-rREDIR_TARGET,--redirREDIR_TARGETPlacetoredirectrequeststo.(apache)-p,--proxyUsingPROXYProtocol?(nginx)--no-ipv6Excludeipv6addressesfromtheblocklistwhereapplicable--compactedCompactneighboringcidrranges.Thisproducessmallerfilesizesbutlosesdetailabouteachrange.-V,--versionshowprogram'sversionnumberandexitFormoreinformation,assistance,ortosubmitapullrequest,pleasevisithttps://github.com/0xdade/sephiroth.Examplesephirothonmaster[!?]on🐳v19.03.8viasephirothtook7s
➜sephiroth-snginx-tasn-aAS15169-aAS31337-taws(asn)FetchingIPrangesfromapi.hackertarget.comfor2ASNs(aws)FetchingIPrangesfromAmazon
Yournginxblocklistforasn,awscanbefoundatoutput/2020-06-07_002847_nginx_asn_aws.conf

Pleaseaddthislineto/etc/nginx/nginx.confbeforetheVirtualHostConfigs.include/mnt/c/Users/dade/Desktop/sephiroth/output/2020-06-07_002847_nginx_asn_aws.conf;Thenyoucanusethe$block_ipvariableinyoursiteconfiglikeso:if($block_ip){return302https://example.com;}Supported Serversnginx- Makes use of nginx'sngx_http_geo_modulewhich comes with the nginx package in Ubuntu 18.04. Optionally supports the use ofproxy_protocol, in the event that you are using a PROXY-enabled redirector.apache- Generates a mod_rewrite rule set to do conditional redirects based on cloud ip ranges. Does not (to my knowledge) supportproxy_protocolusage. Requires-r REDIR_TARGETfor the RewriteRuleiptables- Generates a set of iptables DROP rules to block access from listed IPv4 ranges.ip6tables- Generates a set of ip6tables DROP rules to block access from listed IPv6 ranges.Supported ProvidersWhile Sephiroth began as a cloud blocking script, it became apparent that there were plenty of other sources of ip addresses that might be useful, and so we expanded. This is the list of currently supported providers.aws- Amazon Web Services. Obtained via thedocumented download process.azure- Azure Cloud. Fetched via a two part process. Fetch the html ofthe download pageand then parse the html to get thefailoverLinkanchor tag. That JSON is then downloaded.gcp- Google Cloud Platform. Fetches thecloud.jsonas documented via thedocs.oci- Oracle Cloud Infrastructure. Fetched via thedocumented download processasn- Lookup IP ranges by ASN. UsesHackertargetAPI to make fetching results painless. Limited to 100 ASN lookups per day per source IP.file- Read line-separated list of addresses from one or more files. Lines that begin with # are ignored and lines that contain a # after the address save the comment into the output.tor- Fetch the bulk list of Tor exit nodes from the torproject.org website and add them to the list.do- Digital Ocean. Fetched fromgoogle.csvas documented on thePlatform page.AcknowledgementsThese are resources I found while building sephiroth that I thought were quite helpfulcuri0usJack'smod_rewrite rules gistEnjen ASN Blocklist-ExampleLicenseDO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE 
                    Version 2, December 2004 

 Copyright (C) 2004 Sam Hocevar <sam@hocevar.net> 

 Everyone is permitted to copy and distribute verbatim or modified 
 copies of this license document, and changing it is allowed as long 
 as the name is changed. 

            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE 
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 

  0. You just DO WHAT THE FUCK YOU WANT TO.