Mercurial > syslog2iptables
annotate xml/syslog2iptables.in @ 44:9e9f09cf411c
Add fixes for Solaris from sm-archive.
| author | Carl Byington <carl@five-ten-sg.com> |
|---|---|
| date | Sat, 22 Mar 2008 10:58:24 -0700 |
| parents | d9ae11033b4b |
| children | 75361069c6ef |
| rev | line source |
|---|---|
| 11 | 1 <reference> |
| 2 <title>@PACKAGE@</title> | |
| 3 <partintro> | |
| 4 <title>Packages</title> | |
|
44
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
5 |
| 11 | 6 <para>The various source and binary packages are available at <ulink |
| 19 | 7 url="http://www.five-ten-sg.com/@PACKAGE@/packages/">http://www.five-ten-sg.com/@PACKAGE@/packages/</ulink> |
| 12 | 8 The most recent documentation is available at <ulink |
| 9 url="http://www.five-ten-sg.com/@PACKAGE@/">http://www.five-ten-sg.com/@PACKAGE@/</ulink> | |
| 11 | 10 </para> |
|
44
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
11 |
|
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
12 <para>A <ulink |
|
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
13 url="http://www.selenic.com/mercurial/wiki/">Mercurial</ulink> source |
|
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
14 code repository for this project is available at <ulink |
|
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
15 url="http://hg.five-ten-sg.com/@PACKAGE@/">http://hg.five-ten-sg.com/@PACKAGE@/</ulink>. |
|
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
16 </para> |
|
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
17 |
| 11 | 18 </partintro> |
| 19 | |
| 20 <refentry id="@PACKAGE@.1"> | |
| 21 <refentryinfo> | |
|
42
d9ae11033b4b
Add default config to firewall systems that send bounces to non-existant accounts.
Carl Byington <carl@five-ten-sg.com>
parents:
36
diff
changeset
|
22 <date>2008-03-21</date> |
| 11 | 23 </refentryinfo> |
| 24 | |
| 25 <refmeta> | |
| 26 <refentrytitle>@PACKAGE@</refentrytitle> | |
| 27 <manvolnum>1</manvolnum> | |
| 28 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo> | |
| 29 </refmeta> | |
| 30 | |
| 31 <refnamediv id='name.1'> | |
| 32 <refname>@PACKAGE@</refname> | |
| 33 <refpurpose>a simple adaptive firewall</refpurpose> | |
| 34 </refnamediv> | |
| 35 | |
| 36 <refsynopsisdiv id='synopsis.1'> | |
| 37 <title>Synopsis</title> | |
| 38 <cmdsynopsis> | |
| 39 <command>@PACKAGE@</command> | |
| 40 <arg><option>-c</option></arg> | |
| 41 <arg><option>-d <replaceable class="parameter">n</replaceable></option></arg> | |
| 42 </cmdsynopsis> | |
| 43 </refsynopsisdiv> | |
| 44 | |
| 45 <refsect1 id='description.1'> | |
| 46 <title>Description</title> | |
| 12 | 47 |
| 48 <para><command>@PACKAGE@</command> is a simple adaptive firewall. It | |
| 49 maintains the INPUT chain of the <citerefentry> | |
| 50 <refentrytitle>iptables</refentrytitle> <manvolnum>1</manvolnum> | |
| 51 </citerefentry> firewall set based on syslog entries. These syslog | |
| 52 entries are typically generated by your hardware firewall, but they | |
| 53 could come from any source. Any syslog entry that contains a host name | |
| 54 or ip address can be used as input to this package.</para> | |
| 11 | 55 |
| 12 | 56 <para>The <citerefentry> <refentrytitle>@PACKAGE@.conf</refentrytitle> |
| 57 <manvolnum>5</manvolnum> </citerefentry> file specifies the syslog files | |
| 58 to be monitored, and the regular expressions (<citerefentry> | |
| 59 <refentrytitle>regex</refentrytitle> <manvolnum>7</manvolnum> | |
| 60 </citerefentry>) to be applied to new lines in those files. Each | |
| 61 regular expression needs an index to specify the matching substring that | |
| 62 contains either an ip address or host name, and a bucket count which is | |
| 63 added to the leaky bucket for that ip address when a matching line is | |
| 64 read from that syslog file.</para> | |
| 11 | 65 |
| 12 | 66 <para>Each ip address has an associated leaky bucket, which leaks one |
| 67 token per second. Once the bucket contains more than a configurable | |
| 68 threshold number of tokens, that ip address is added to the INPUT chain | |
| 69 with a DROP target. When the bucket is drained to zero, that ip address | |
| 70 is removed from the INPUT chain.</para> | |
| 71 | |
| 72 <para>The discussion has focused on syslog files, but any ascii text | |
| 73 file can be used, so long as some other process appends lines to that | |
| 74 file, and those lines containing hostname or ip addresses can be matched | |
| 75 with some regular expression.</para> | |
| 76 | |
| 77 <para>Considering syslog files in particular, these are normally rotated | |
| 78 via logrotate. <command>@PACKAGE@</command> properly detects and | |
| 79 handles this case by closing the old file, and reopening the newly | |
| 80 created file.</para> | |
| 11 | 81 </refsect1> |
| 82 | |
| 83 <refsect1 id='options.1'> | |
| 84 <title>Options</title> | |
| 85 <variablelist> | |
| 86 <varlistentry> | |
| 87 <term>-c</term> | |
| 88 <listitem> | |
| 89 <para> | |
| 90 Load the configuration file, print a cannonical form | |
| 91 of the configuration on stdout, and exit. | |
| 92 </para> | |
| 93 </listitem> | |
| 94 </varlistentry> | |
| 95 <varlistentry> | |
| 96 <term>-d <replaceable class="parameter">n</replaceable></term> | |
| 97 <listitem> | |
| 98 <para> | |
| 99 Set the debug level to <replaceable class="parameter">n</replaceable>. | |
| 100 </para> | |
| 101 </listitem> | |
| 102 </varlistentry> | |
| 103 </variablelist> | |
| 104 </refsect1> | |
| 105 | |
| 16 | 106 <refsect1 id='usage.1'> |
| 11 | 107 <title>Usage</title> |
| 108 <para><command>@PACKAGE@</command> -d 2</para> | |
| 109 </refsect1> | |
| 110 | |
| 16 | 111 <refsect1 id='configuration.1'> |
| 11 | 112 <title>Configuration</title> |
| 113 <para> | |
| 114 The configuration file is documented in <citerefentry> | |
| 115 <refentrytitle>@PACKAGE@.conf</refentrytitle> <manvolnum>5</manvolnum> | |
| 12 | 116 </citerefentry>. Any change to the config file will cause it to be |
| 117 reloaded within three minutes. | |
| 11 | 118 </para> |
| 119 </refsect1> | |
| 120 | |
| 24 | 121 <refsect1 id='todo.1'> |
| 122 <title>TODO</title> | |
| 123 <para> | |
| 124 The following ideas are under consideration. | |
| 125 </para> | |
| 126 <para> | |
| 127 Add a configuration option for the iptables table name in the | |
| 128 pattern statement. This implies handling multiple tables, so each | |
| 129 table needs its own map of ip addresses and bucket values. | |
| 130 </para> | |
| 131 </refsect1> | |
| 132 | |
| 16 | 133 <refsect1 id='copyright.1'> |
| 11 | 134 <title>Copyright</title> |
| 135 <para> | |
| 31 | 136 Copyright (C) 2007 by 510 Software Group <carl@five-ten-sg.com> |
| 11 | 137 </para> |
| 138 <para> | |
| 139 This program is free software; you can redistribute it and/or modify it | |
| 140 under the terms of the GNU General Public License as published by the | |
| 31 | 141 Free Software Foundation; either version 3, or (at your option) any |
| 11 | 142 later version. |
| 143 </para> | |
| 144 <para> | |
| 145 You should have received a copy of the GNU General Public License along | |
| 146 with this program; see the file COPYING. If not, please write to the | |
| 147 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. | |
| 148 </para> | |
| 149 </refsect1> | |
| 31 | 150 |
| 151 <refsect1 id='version.1'> | |
|
42
d9ae11033b4b
Add default config to firewall systems that send bounces to non-existant accounts.
Carl Byington <carl@five-ten-sg.com>
parents:
36
diff
changeset
|
152 <title>Version</title> |
| 31 | 153 <para> |
|
42
d9ae11033b4b
Add default config to firewall systems that send bounces to non-existant accounts.
Carl Byington <carl@five-ten-sg.com>
parents:
36
diff
changeset
|
154 @VERSION@ |
| 31 | 155 </para> |
| 156 </refsect1> | |
| 11 | 157 </refentry> |
| 158 | |
| 159 | |
| 160 <refentry id="@PACKAGE@.conf.5"> | |
| 161 <refentryinfo> | |
|
42
d9ae11033b4b
Add default config to firewall systems that send bounces to non-existant accounts.
Carl Byington <carl@five-ten-sg.com>
parents:
36
diff
changeset
|
162 <date>2008-03-21</date> |
| 11 | 163 </refentryinfo> |
| 164 | |
| 165 <refmeta> | |
| 166 <refentrytitle>@PACKAGE@.conf</refentrytitle> | |
| 167 <manvolnum>5</manvolnum> | |
| 168 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo> | |
| 169 </refmeta> | |
| 170 | |
| 171 <refnamediv id='name.5'> | |
| 172 <refname>@PACKAGE@.conf</refname> | |
| 173 <refpurpose>configuration file for @PACKAGE@</refpurpose> | |
| 174 </refnamediv> | |
| 175 | |
| 176 <refsynopsisdiv id='synopsis.5'> | |
| 177 <title>Synopsis</title> | |
| 178 <cmdsynopsis> | |
| 179 <command>@PACKAGE@.conf</command> | |
| 180 </cmdsynopsis> | |
| 181 </refsynopsisdiv> | |
| 182 | |
| 183 <refsect1 id='description.5'> | |
| 184 <title>Description</title> | |
| 185 <para>The <command>@PACKAGE@.conf</command> configuration file is | |
| 27 | 186 specified by this partial bnf description. The entire config file |
| 187 is case sensitive. All the keywords are lower case. | |
| 188 </para> | |
| 11 | 189 |
| 190 <literallayout class="monospaced"><![CDATA[ | |
| 27 | 191 CONFIG := {THRESHOLD | ADD-CMD | REM-CMD | IGNORE | FILE}+ |
| 11 | 192 THRESHOLD := "threshold" THRESHOLD-INTEGER-VALUE ";" |
| 27 | 193 ADD-CMD := "add_command" IPT-CMD ";" |
| 194 REM-CMD := "remove_command" IPT-CMD ";" | |
| 11 | 195 IGNORE := "ignore" "{" IG-SINGLE+ "};" |
| 196 IG-SINGLE := IP-ADDRESS "/" CIDR-BITS ";" | |
| 197 FILE := "file" FILENAME "{" PATTERN+ "};" | |
| 35 | 198 PATTERN := "pattern" REGULAR-EXPRESSION "{" {INDEX | BUCKET | MESSAGE}+ "};" |
| 11 | 199 INDEX := "index" REGEX-INTEGER-VALUE ";" |
| 29 | 200 BUCKET := "bucket" BUCKET-ADD-INTEGER-VALUE ";" |
| 35 | 201 MESSAGE := "message" REASON ";" |
| 202 REASON := string to appear in syslog messages | |
| 27 | 203 IPT-CMD := string containing exactly one %s replacement token for |
| 29 | 204 the ip address]]></literallayout> |
| 11 | 205 </refsect1> |
| 206 | |
| 207 <refsect1 id='sample.5'> | |
| 208 <title>Sample</title> | |
| 209 <literallayout class="monospaced"><![CDATA[ | |
| 210 threshold 550; | |
| 211 | |
| 27 | 212 add_command "/sbin/iptables -I INPUT --src %s --jump DROP"; |
| 213 remove_command "/sbin/iptables -D INPUT --src %s --jump DROP"; | |
| 214 | |
| 11 | 215 ignore { |
| 216 127.0.0.0/8; // localhost | |
| 217 }; | |
| 218 | |
| 219 file "/var/log/cisco.log" { | |
| 220 pattern "Internet_Firewall denied (tcp|udp) ([^(]*)" { | |
| 221 index 2; // zero based | |
| 222 bucket 200; | |
| 35 | 223 message "cisco firewall blocked packet"; |
| 11 | 224 }; |
| 225 }; | |
| 226 | |
| 227 file "/var/log/secure" { | |
| 228 pattern "sshd.*Failed password .* from ::ffff:(.*) port" { | |
| 229 index 1; // zero based | |
| 230 bucket 400; | |
| 35 | 231 message "ssh failed password"; |
| 11 | 232 }; |
| 233 pattern "sshd.*Failed password .* from (.*) port" { | |
| 234 index 1; // zero based | |
| 235 bucket 400; | |
| 35 | 236 message "ssh failed password"; |
| 237 }; | |
| 238 }; | |
| 239 | |
| 240 file "/var/log/httpd/access_log" { | |
| 241 pattern "(.*) - - .* /cgi-bin" { | |
| 242 index 1; // zero based | |
| 243 bucket 400; | |
| 244 message "apache cgi-bin reference"; | |
| 245 }; | |
| 246 pattern "(.*) - - .*/index2.php" { | |
| 247 index 1; // zero based | |
| 248 bucket 400; | |
| 249 message "apache index2.php reference"; | |
| 250 }; | |
| 251 pattern "(.*) - - .*/main.php" { | |
| 252 index 1; // zero based | |
| 253 bucket 400; | |
| 254 message "apache main.php reference"; | |
| 255 }; | |
| 256 }; | |
| 257 | |
| 258 file "/var/log/maillog" { | |
| 259 pattern "lost input channel from .* \[(.*)\] .* after mail" { | |
| 260 index 1; // zero based | |
| 261 bucket 200; | |
| 262 message "sendmail spammer dropping connection"; | |
| 263 }; | |
| 264 }; | |
| 265 | |
| 266 file "/var/log/messages" { | |
| 267 pattern "sshd.pam_unix.*authentication failure.*rhost=(.*) user=" { | |
| 268 index 1; // zero based | |
| 269 bucket 300; | |
| 270 message "ssh failed password"; | |
| 271 }; | |
| 272 pattern "sshd.pam_unix.*authentication failure.*rhost=(.*)$" { | |
| 273 index 1; // zero based | |
| 274 bucket 300; | |
| 275 message "ssh failed password"; | |
| 11 | 276 }; |
| 277 };]]></literallayout> | |
| 278 </refsect1> | |
| 279 | |
| 31 | 280 <refsect1 id='version.5'> |
|
42
d9ae11033b4b
Add default config to firewall systems that send bounces to non-existant accounts.
Carl Byington <carl@five-ten-sg.com>
parents:
36
diff
changeset
|
281 <title>Version</title> |
| 31 | 282 <para> |
|
42
d9ae11033b4b
Add default config to firewall systems that send bounces to non-existant accounts.
Carl Byington <carl@five-ten-sg.com>
parents:
36
diff
changeset
|
283 @VERSION@ |
| 31 | 284 </para> |
| 285 </refsect1> | |
| 286 | |
| 11 | 287 </refentry> |
| 288 </reference> |