|
9
|
1 threshold 550;
|
|
3
|
2
|
|
27
|
3 add_command "/sbin/iptables -I INPUT --src %s --jump DROP";
|
|
|
4 remove_command "/sbin/iptables -D INPUT --src %s --jump DROP";
|
|
|
5
|
|
3
|
6 ignore {
|
|
|
7 127.0.0.0/8; // localhost
|
|
1
|
8 };
|
|
|
9
|
|
20
|
10 // file "/var/log/cisco.log" {
|
|
|
11 // pattern "Internet_Firewall denied (tcp|udp) ([^(]*)" {
|
|
|
12 // index 2; // zero based
|
|
|
13 // bucket 200;
|
|
35
|
14 // message "cisco firewall blocked packet";
|
|
20
|
15 // };
|
|
|
16 // };
|
|
3
|
17
|
|
5
|
18 file "/var/log/secure" {
|
|
|
19 pattern "sshd.*Failed password .* from ::ffff:(.*) port" {
|
|
|
20 index 1; // zero based
|
|
9
|
21 bucket 400;
|
|
35
|
22 message "ssh failed password";
|
|
5
|
23 };
|
|
|
24 pattern "sshd.*Failed password .* from (.*) port" {
|
|
|
25 index 1; // zero based
|
|
9
|
26 bucket 400;
|
|
35
|
27 message "ssh failed password";
|
|
5
|
28 };
|
|
|
29 };
|
|
|
30
|
|
20
|
31 file "/var/log/httpd/access_log" {
|
|
|
32 pattern "(.*) - - .* /cgi-bin" {
|
|
|
33 index 1; // zero based
|
|
|
34 bucket 400;
|
|
35
|
35 message "apache cgi-bin reference";
|
|
20
|
36 };
|
|
|
37 pattern "(.*) - - .*/index2.php" {
|
|
|
38 index 1; // zero based
|
|
|
39 bucket 400;
|
|
35
|
40 message "apache index2.php reference";
|
|
20
|
41 };
|
|
|
42 pattern "(.*) - - .*/main.php" {
|
|
|
43 index 1; // zero based
|
|
|
44 bucket 400;
|
|
35
|
45 message "apache main.php reference";
|
|
|
46 };
|
|
|
47 };
|
|
|
48
|
|
|
49 file "/var/log/maillog" {
|
|
|
50 pattern "lost input channel from .* \[(.*)\] .* after mail" {
|
|
|
51 index 1; // zero based
|
|
|
52 bucket 200;
|
|
|
53 message "sendmail spammer dropping connection";
|
|
20
|
54 };
|
|
|
55 };
|
|
|
56
|
|
9
|
57 // file "/var/log/messages" {
|
|
|
58 // pattern "sshd.pam_unix.*authentication failure.*rhost=(.*) user=" {
|
|
|
59 // index 1; // zero based
|
|
|
60 // bucket 300;
|
|
35
|
61 // message "ssh failed password";
|
|
9
|
62 // };
|
|
|
63 // pattern "sshd.pam_unix.*authentication failure.*rhost=(.*)$" {
|
|
|
64 // index 1; // zero based
|
|
|
65 // bucket 300;
|
|
35
|
66 // message "ssh failed password";
|
|
9
|
67 // };
|
|
|
68 // };
|
