annotate syslog2iptables.conf @ 28:6465d8640489

make add/remove commands configureable
author carl
date Sun, 12 Feb 2006 11:10:21 -0800
parents 28fec0c67646
children d2ceebcf6595
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
9
d76f9ff42487 initial coding
carl
parents: 5
diff changeset
1 threshold 550;
3
8fe310e5cd44 initial coding
carl
parents: 1
diff changeset
2
27
28fec0c67646 make add/remove commands configureable
carl
parents: 21
diff changeset
3 add_command "/sbin/iptables -I INPUT --src %s --jump DROP";
28fec0c67646 make add/remove commands configureable
carl
parents: 21
diff changeset
4 remove_command "/sbin/iptables -D INPUT --src %s --jump DROP";
28fec0c67646 make add/remove commands configureable
carl
parents: 21
diff changeset
5
3
8fe310e5cd44 initial coding
carl
parents: 1
diff changeset
6 ignore {
8fe310e5cd44 initial coding
carl
parents: 1
diff changeset
7 127.0.0.0/8; // localhost
1
551433a01cab initial coding
carl
parents:
diff changeset
8 };
551433a01cab initial coding
carl
parents:
diff changeset
9
20
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
10 // file "/var/log/cisco.log" {
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
11 // pattern "Internet_Firewall denied (tcp|udp) ([^(]*)" {
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
12 // index 2; // zero based
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
13 // bucket 200;
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
14 // };
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
15 // };
3
8fe310e5cd44 initial coding
carl
parents: 1
diff changeset
16
5
276c4edc8521 initial coding
carl
parents: 4
diff changeset
17 file "/var/log/secure" {
276c4edc8521 initial coding
carl
parents: 4
diff changeset
18 pattern "sshd.*Failed password .* from ::ffff:(.*) port" {
276c4edc8521 initial coding
carl
parents: 4
diff changeset
19 index 1; // zero based
9
d76f9ff42487 initial coding
carl
parents: 5
diff changeset
20 bucket 400;
5
276c4edc8521 initial coding
carl
parents: 4
diff changeset
21 };
276c4edc8521 initial coding
carl
parents: 4
diff changeset
22 pattern "sshd.*Failed password .* from (.*) port" {
276c4edc8521 initial coding
carl
parents: 4
diff changeset
23 index 1; // zero based
9
d76f9ff42487 initial coding
carl
parents: 5
diff changeset
24 bucket 400;
5
276c4edc8521 initial coding
carl
parents: 4
diff changeset
25 };
276c4edc8521 initial coding
carl
parents: 4
diff changeset
26 };
276c4edc8521 initial coding
carl
parents: 4
diff changeset
27
20
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
28 file "/var/log/httpd/access_log" {
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
29 pattern "(.*) - - .* /cgi-bin" {
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
30 index 1; // zero based
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
31 bucket 400;
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
32 };
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
33 pattern "(.*) - - .*/index2.php" {
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
34 index 1; // zero based
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
35 bucket 400;
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
36 };
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
37 pattern "(.*) - - .*/main.php" {
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
38 index 1; // zero based
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
39 bucket 400;
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
40 };
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
41 };
0d65c3de34fd add better logging
carl
parents: 9
diff changeset
42
9
d76f9ff42487 initial coding
carl
parents: 5
diff changeset
43 // file "/var/log/messages" {
d76f9ff42487 initial coding
carl
parents: 5
diff changeset
44 // pattern "sshd.pam_unix.*authentication failure.*rhost=(.*) user=" {
d76f9ff42487 initial coding
carl
parents: 5
diff changeset
45 // index 1; // zero based
d76f9ff42487 initial coding
carl
parents: 5
diff changeset
46 // bucket 300;
d76f9ff42487 initial coding
carl
parents: 5
diff changeset
47 // };
d76f9ff42487 initial coding
carl
parents: 5
diff changeset
48 // pattern "sshd.pam_unix.*authentication failure.*rhost=(.*)$" {
d76f9ff42487 initial coding
carl
parents: 5
diff changeset
49 // index 1; // zero based
d76f9ff42487 initial coding
carl
parents: 5
diff changeset
50 // bucket 300;
d76f9ff42487 initial coding
carl
parents: 5
diff changeset
51 // };
d76f9ff42487 initial coding
carl
parents: 5
diff changeset
52 // };