hostsblock - an ad- and malware-blocking script for Linux

项目说明

Hostsblock

An ad- and malware-blocking utility for POSIX systems

Contents

1. Description: Features
2. Installation: Dependencies, Arch Linux, Other POSIX
3. Configuration: Edit hostsblock.conf, Enable Timer, Enable Postprocessing
4. Usage: Configuring sudo, Manual Usage, UrlCheck Usage (examples)
5. FAQ
6. News & Bugs: Upgrading to 0.999.8
7. License

Description <a name="description"></a>

Hostsblock is a POSIX-compatible script designed to take ad of the [/etc/hosts][h] file to provide [system-wide blocking][0] of internet ad, malicious domains, trackers, and other undesirable content.

To do so, it downloads a configurable set of blocklists and processes their entries into a single [HOSTS][h] file.

Hostsblock also provides a command-line utility that allows you to configure how indi websites and any other domains contained in that website are handled.

Features <a name="features"></a>

* Enhanced security - Runs as an unpri user instead of root. New: Includes systemd service files that heavily sandbox the background process.

* System-wide blocking - *All non-proxied* connections use the HOSTS file (Proxied connections can be modified to use the HOSTS file)

* Compression-friendly - Can download and process zip- and 7zip-compressed files automatically. (Provided that unzip and p7zip are installed)

* Non-interactive - Can be run as a periodic background job without needing user interaction.

* Extensi - Allows for custom deny & allow listing, redirection, ~~post-processing scripting~~ (now provided configuration), *etc.*

* Bandwith-efficient - *Only* downloads blocklists that have been changed, using *http compression* when a.

* Resource-efficient - *Only* processes blocklists when changes are registered.

* High performance blocking - Only when using *dns caching*.

* Redirection capability - Enchances security by combating DNS cache poisoning.

* Extensi of blocklists included - Allowing the *user* to choose how much or how little is blocked/redirected.

Installation <a name="installation"></a>

Dependencies <a name="depends"></a>

* curl
* A POSIX en (which should already be in place on most Linux, \*BSD, and macOS en, including the following commands: sh (e.g. bash or dash, chmod, cksum, cp, cut, file, find, grep, id, mkdir, mv, rm, sed, sort, tee, touch, tr, wc, and xargs.

#### Optional dependencies for additional features

* sudo to enable the user-friendly wrapper script (highly recommended)

Unarchivers to use archi instead of plain text:

* [unzip][unzip] (for zip archives)
* [p7zip][7zip] (for 7z archives) must include either 7z, 7za, or 7zr executables!

A DNS caching daemon to help *speed up DNS resolutions*:

* dnsmasq (recommended)
* pdnsd (untested)

If you use 127.0.0.1 as your blocking redirect address (redirecturl in hostsblock.conf), a pseudo-server that serves *blank pages* to remo page and speed up page resolution on blocked domains:

* kwakd
* pixelserv

Note that the default configuration gets no benefit from having a pseudo-server

Arch Linux <a name="archinstall"></a>

If you ha installed: yaourt -S hostsblock or yaourt -S hostsblock-git

Or use one of the *AUR* packages:
hostsblock,
hostsblock-git

Don't forget to *enable* and *start* the systemd timer by running this:

For Other POSIX Flavors and Distros <a name="posixinstall"></a>

#### The Best and Easiest Way

Please check with your distribution to see if a package is a. If there is not, ask for it or contribute your own!

If you are a package maintainer, let me know so that I can post the instructions here.

#### The Easy Way

First download the archive here or with curl like so: curl -O "

Unzip the archive, e.g. unzip hostsblock-master.zip

Execute the install.sh script *as root*, which will guide you through installation.

Configuration <a name="config"></a>

By default, the configuration files are included in the /var/lib/hostsblock/config.examples/ directory. Copy them over to /var/lib/hostsblock/ to customize your setup.

Editing hostsblock.conf <a name="hostblockconf"></a>

Most of the hostsblock configuration is done in the [hostsblock.conf][conf]. This file is commented really well, so please read through it before first use:

Enable the systemd service <a name="enabletimer"></a>

Don't forget to *enable* and *start* the systemd timer with:

Configure Postprocessing <a name="enablepostprocess"></a>

Hostsblock does not write to /etc/hosts or manipulate any DNS caching daemons anymore. Instead, it will just compile a hosts-formatted file to /var/lib/hostsblock/hosts.block. To make this file actually do work, you have one of two options:

#### OPTION 1: Using a DNS Caching Daemon (Here: dnsmasq)

Using a DNS caching daemon like dnsmasq offers better performance.

To use hostsblock together with dnsmasq, configure dnsmasq as DNS caching daemon.
Please refer to your distribution's manual. For ArchLinux read the following:
Wiki section.

After that, add the following line to dnsmasq.conf (usually under /etc/dnsmasq.conf) so that dnsmasq will reference the file:

Enable and start hostsblock-dnsmasq-restart.path:

This has systemd watch the target file /var/lib/hostsblock/hosts.block for changes and then restart dnsmasq whenever they are found.

#### OPTION 2: Copy /var/lib/hostsblock/hosts.block to /etc/hosts

It is possible to have systemd o /etc/hosts with the generated file.

Configure hostshead= in hostsblock.conf to make sure you don't remove the default system loopback address(es), e.g.:

Then put your necessary loopback entries in /var/lib/hostsblock/hosts.head. For example, you can copy over your existing /etc/hosts to this file:

Enable and start hostsblock-hosts-clobber.path:

This has systemd watch the target file /var/lib/hostsblock/hosts.block for changes and then copy /var/lib/hostsblock/hosts.block to /etc/hosts.

Usage <a name="usage"></a>

In its normal systemd-job configuration, hostsblock requires no interaction from the user aside from the steps above. If, however, you want to manually run the process, or to use the UrlCheck tool (hostsblock -c URL), you need to configure sudo:

Configuring sudo <a name="sudo"></a>

Because hostsblock executes as a heavily sandboxed unpri user (instead of root), you must configure sudo to allow other users to manually execute it.

To do so, edit sudoers by typing sudo and add the following line to the end:

Add any users you want to be able to manually execute or use the urlcheck mode to the hostsblock group:

The wrapper script installed in your PATH will automatically use sudo to execute the main script as the user hostsblock.

hostsblock [OPTION...] - download and combine HOSTS files <a name="manual"></a>

Without the -c URL option, hostsblock will check to see if its monitored blocklists ha. If it detects changes (or if forced by the -u flag), it will download the changed blocklist(s) and recompile the target HOSTS file.

hostsblock [OPTION...] -c URL [COMMANDS...] - Manage how URL is handled <a name="urlcheck"></a>

With the -c URL flag option, hostsblock can check and manipulate how it handles specific domains.

*Note: The hostsblock-urlcheck symlink is now officially depreciated. Use hostsblock -c instead.*

In addition to the abo, the following commands and subcommands can be used with hostsblock -c URL:

Note that the -o subcommand turns a command into its opposite, e.g.

hostsblock -c URL -b -o unblocks URL

hostsblock -c URL -e -o removes URL from the denylist

hostsblock -c URL -a -o removes URL from the allowlist

#### Examples: <a name="examples"></a>

Once you ha sudo, you can execute the following as any user in the hostsblock group:

##### See if " is blocked, denylisted, allowlisted, or redirected by hostsblock:

##### Do the same thing for any of the sites referenced on this page:

##### Do the same thing for any of the sites referenced on this page that are presently blocked:

##### Block the domain containing " (that is, "github.com"):

Note that "blocking" (and "unblocking", i.e. -b -o) a domain only works until the next time hostsblock refreshes /var/lib/hostsfile/hosts.block, unless you use a blocklist that does include it. To permanently block this domain, use the denylist (-e) command.

##### Permanently block (denylist) the domain containing " (that is, "github.com"):

Note that "denylisting" on its own will not block the target domain until hostblock refreshes. You can combine both "blocking" and "denylisting" in one command, however:

##### Permanently and immediately block the domain containing " (that is, "github.com"):

##### Temporarily unblock all blocked domains on " (helpful if the page isn't working quite right):

##### Interactively scan through " prompting you if you want the domains referenced therein to be blocked, denylisted, or allowlisted

FAQ <a name="faq"></a>

* Why isn't it working with Chrome/Chromium?

* Because they bypass the system's DNS settings and use their own.

To force them to use the system's DNS settings, refer to this
superuser.com question.

* Hostsblock's systemd job fails with error "FAILED TO COMPILE BLOCK/REDIRECT ENTRIES FROM [...]" and leaves an empty hosts.block.new file.

* You may have a blank line with a single space in your allowlist. Hostsblock matches that line with the space in between the IP address and the domain name that every single line has, i.e. it matches every single would-be entry in your target file. Remove the empty line, and hostsblock will function as expected.

News & Bugs <a name="news"></a>

* Issue Tracker
* Arch Linux AUR
* Arch Linux Forum

Upgrading to 0.999.8 <a name="upgrade09998"></a>

For existing hostsblock users, please note the following changes in 0.999.8:

#### Changes in hostsblock.conf

Due to the shift to POSIX-shell compatibility, the list of blocklists to be downloaded cannot be held in hostsblock.conf via the blocklists= parameter. Instead, this parameter contains the path to a file that contains the list of URLs, e.g. /var/lib/hostsblock/block.urls.

The new block.urls file is simply a newline separated list of URLs *without quotations*. Whitespace and text after # are ignored. An example block.urls file could look like this:

See the example block.urls in the /var/lib/hostsblock/config.examples directory for details.

#### No more postprocessing within script

Due to enhanced security and sandboxing, hostsblock no longer handles postprocessing on its own. Instead, users should use other systemd capabilities to replace the postprocess() {} functionality.

Hostsblock comes with systemd service files that replicate the most common scenarios. See the directions above for instructions on how to enable them.

#### Changes with sudo

sudo is no longer as widely used as before. The main systemd service no longer requires it. You only need it if you want to use the hostsblock -c URL (urlcheck) utility. See the abo for details.

#### Other Caveats
* The hostsblock-urlcheck symlink is depreciated. Please use hostsblock -c URL instead.
* In UrlCheck mode, large hosts files will generate large temporary cache files that will eat up a lot of temporary storage. If you have a machine with little RAM (<6GB) and want to block a lot of domains, consider changing your $tmpdir to an HDD- or SSD-backed filesystem instead of the default tmpfs under /tmp.
* UrlCheck mode will not be able to provide information on which blocklist blocked which domains anymore (annotation feature removed)
* Hostsblock uses 0.0.0.0 as default redirection IP address instead of 127.0.0.1. 0.0.0.0 theoretically offers better performance without the need of a pseudo-server.

#### Other Changes from 0.999.7 to 0.999.8
##### Systemd Job Impro
* Systemd service now heavily hardened and sandboxed for enhanced security
* Fixed simultaneous download feature so that it actually does what it is supposed to
* Added processing support for source blocklists that just list domain names to be blocked, e.g. ads.google.com instead of 0.0.0.0 ads.google.com
* Added support to read directly from zip and 7z files containing a single file without decompressing to a cache
* Optimized filters used to process domains with impro
* If run with dash instead of bash, hostsblock has significant performance impro
* Remo feature to reduce dependencies and o processing demands
* expanded list of potential blocklists (see block.urls)

##### POSIX-Compatibility Impro
* Supports POSIX shells (dash, ash, zsh) instead of just bash
* Remo utilities, relies only on POSIX options
* Should now run on \*BSD and macOS (and perhaps e and iOS!) if proper POSIX en are installed. *UNTESTED*

##### UrlCheck Mode Impro
* User-facing command now a wrapper script that handles sudo execution for the user, reducing configuration demands
* Significant performance impro by moving from incremental to mass handling of domain names
* Added noninteracti -s (status), -b (block), -e (denylist), -a (allowlist), -b -o (unblock), -e -o (dedenylist), -a -o (deallowlist)
* Interactive and noninteracti can now recursively handle URLs contained in target page (with -r subcommand), and e just blocked domains (with -k subcommand)
* To minimize repeated writes, changes to target hosts file now don't write to file until after the whole process completes

License <a name="license"></a>

Hostsblock is licensed under GNU GPL

[h]:
[0]:
[conf]:
[unzip]:
[7zip]:

项目信息

开发语言：Shell

Star 数：231

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕an ad- and malware-blocking script for Linux展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。