|
11
|
1 <reference>
|
|
|
2 <title>@PACKAGE@</title>
|
|
|
3 <partintro>
|
|
|
4 <title>Packages</title>
|
|
|
5 <para>The various source and binary packages are available at <ulink
|
|
|
6 url="http://www.five-ten-sg.com/syslog2iptables/packages">http://www.five-ten-sg.com/syslog2iptables/packages</ulink>
|
|
|
7 </para>
|
|
|
8 <para>The most recent documentation is available at <ulink
|
|
|
9 url="http://www.five-ten-sg.com/syslog2iptables/">http://www.five-ten-sg.com/syslog2iptables/</ulink>
|
|
|
10 </para>
|
|
|
11 </partintro>
|
|
|
12
|
|
|
13 <refentry id="@PACKAGE@.1">
|
|
|
14 <refentryinfo>
|
|
|
15 <date>2005-12-15</date>
|
|
|
16 </refentryinfo>
|
|
|
17
|
|
|
18 <refmeta>
|
|
|
19 <refentrytitle>@PACKAGE@</refentrytitle>
|
|
|
20 <manvolnum>1</manvolnum>
|
|
|
21 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo>
|
|
|
22 </refmeta>
|
|
|
23
|
|
|
24 <refnamediv id='name.1'>
|
|
|
25 <refname>@PACKAGE@</refname>
|
|
|
26 <refpurpose>a simple adaptive firewall</refpurpose>
|
|
|
27 </refnamediv>
|
|
|
28
|
|
|
29 <refsynopsisdiv id='synopsis.1'>
|
|
|
30 <title>Synopsis</title>
|
|
|
31 <cmdsynopsis>
|
|
|
32 <command>@PACKAGE@</command>
|
|
|
33 <arg><option>-c</option></arg>
|
|
|
34 <arg><option>-d <replaceable class="parameter">n</replaceable></option></arg>
|
|
|
35 </cmdsynopsis>
|
|
|
36 </refsynopsisdiv>
|
|
|
37
|
|
|
38 <refsect1 id='description.1'>
|
|
|
39 <title>Description</title>
|
|
|
40 <para><command>@PACKAGE@</command> is a simple adaptive firewall. It
|
|
|
41 maintains the INPUT chain of the <citerefentry>
|
|
|
42 <refentrytitle>iptables</refentrytitle> <manvolnum>1</manvolnum>
|
|
|
43 </citerefentry> firewall set based on syslog entries. These syslog
|
|
|
44 entries are typically generated by your hardware firewall, but they
|
|
|
45 could come from any source. Any syslog entry that contains a host name
|
|
|
46 or ip address can be used as input to this package.</para>
|
|
|
47
|
|
|
48 <para>The <citerefentry> <refentrytitle>@PACKAGE@.conf</refentrytitle>
|
|
|
49 <manvolnum>5</manvolnum> </citerefentry> file specifies the syslog files
|
|
|
50 to be monitored, and the regular expressions (<citerefentry>
|
|
|
51 <refentrytitle>regex</refentrytitle> <manvolnum>7</manvolnum>
|
|
|
52 </citerefentry>) to be applied to new lines in those files. Each
|
|
|
53 regular expression needs an index to specify the matching substring that
|
|
|
54 contains either an ip address or host name, and a bucket count which is
|
|
|
55 added to the leaky bucket for that ip address when a matching line is
|
|
|
56 read from that syslog file.</para>
|
|
|
57
|
|
|
58 <para>Each ip address has an associated leaky bucket, which leaks one
|
|
|
59 token per second. Once the bucket contains more than a configurable
|
|
|
60 number of tokens, that ip address is added to the INPUT chain with a
|
|
|
61 DROP target. When the bucket is drained to zero, that ip address is
|
|
|
62 removed from the INPUT chain.</para>
|
|
|
63 </refsect1>
|
|
|
64
|
|
|
65 <refsect1 id='options.1'>
|
|
|
66 <title>Options</title>
|
|
|
67 <variablelist>
|
|
|
68 <varlistentry>
|
|
|
69 <term>-c</term>
|
|
|
70 <listitem>
|
|
|
71 <para>
|
|
|
72 Load the configuration file, print a cannonical form
|
|
|
73 of the configuration on stdout, and exit.
|
|
|
74 </para>
|
|
|
75 </listitem>
|
|
|
76 </varlistentry>
|
|
|
77 <varlistentry>
|
|
|
78 <term>-d <replaceable class="parameter">n</replaceable></term>
|
|
|
79 <listitem>
|
|
|
80 <para>
|
|
|
81 Set the debug level to <replaceable class="parameter">n</replaceable>.
|
|
|
82 </para>
|
|
|
83 </listitem>
|
|
|
84 </varlistentry>
|
|
|
85 </variablelist>
|
|
|
86 </refsect1>
|
|
|
87
|
|
|
88 <refsect1>
|
|
|
89 <title>Usage</title>
|
|
|
90 <para><command>@PACKAGE@</command> -d 2</para>
|
|
|
91 </refsect1>
|
|
|
92
|
|
|
93 <refsect1>
|
|
|
94 <title>Configuration</title>
|
|
|
95 <para>
|
|
|
96 The configuration file is documented in <citerefentry>
|
|
|
97 <refentrytitle>@PACKAGE@.conf</refentrytitle> <manvolnum>5</manvolnum>
|
|
|
98 </citerefentry>.
|
|
|
99 </para>
|
|
|
100 </refsect1>
|
|
|
101
|
|
|
102 <refsect1>
|
|
|
103 <title>Copyright</title>
|
|
|
104 <para>
|
|
|
105 Copyright (C) 2005 by 510 Software Group <carl@five-ten-sg.com>
|
|
|
106 </para>
|
|
|
107 <para>
|
|
|
108 This program is free software; you can redistribute it and/or modify it
|
|
|
109 under the terms of the GNU General Public License as published by the
|
|
|
110 Free Software Foundation; either version 2, or (at your option) any
|
|
|
111 later version.
|
|
|
112 </para>
|
|
|
113 <para>
|
|
|
114 You should have received a copy of the GNU General Public License along
|
|
|
115 with this program; see the file COPYING. If not, please write to the
|
|
|
116 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
|
117 </para>
|
|
|
118 </refsect1>
|
|
|
119 </refentry>
|
|
|
120
|
|
|
121
|
|
|
122 <refentry id="@PACKAGE@.conf.5">
|
|
|
123 <refentryinfo>
|
|
|
124 <date>2005-12-15</date>
|
|
|
125 </refentryinfo>
|
|
|
126
|
|
|
127 <refmeta>
|
|
|
128 <refentrytitle>@PACKAGE@.conf</refentrytitle>
|
|
|
129 <manvolnum>5</manvolnum>
|
|
|
130 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo>
|
|
|
131 </refmeta>
|
|
|
132
|
|
|
133 <refnamediv id='name.5'>
|
|
|
134 <refname>@PACKAGE@.conf</refname>
|
|
|
135 <refpurpose>configuration file for @PACKAGE@</refpurpose>
|
|
|
136 </refnamediv>
|
|
|
137
|
|
|
138 <refsynopsisdiv id='synopsis.5'>
|
|
|
139 <title>Synopsis</title>
|
|
|
140 <cmdsynopsis>
|
|
|
141 <command>@PACKAGE@.conf</command>
|
|
|
142 </cmdsynopsis>
|
|
|
143 </refsynopsisdiv>
|
|
|
144
|
|
|
145 <refsect1 id='description.5'>
|
|
|
146 <title>Description</title>
|
|
|
147 <para>The <command>@PACKAGE@.conf</command> configuration file is
|
|
|
148 specified by this partial bnf description.</para>
|
|
|
149
|
|
|
150 <literallayout class="monospaced"><![CDATA[
|
|
|
151 CONFIG := THRESHOLD IGNORE {FILE}+
|
|
|
152 THRESHOLD := "threshold" THRESHOLD-INTEGER-VALUE ";"
|
|
|
153 IGNORE := "ignore" "{" IG-SINGLE+ "};"
|
|
|
154 IG-SINGLE := IP-ADDRESS "/" CIDR-BITS ";"
|
|
|
155 FILE := "file" FILENAME "{" PATTERN+ "};"
|
|
|
156 PATTERN := "pattern" REGULAR-EXPRESSION "{" {INDEX | BUCKET}+ "};"
|
|
|
157 INDEX := "index" REGEX-INTEGER-VALUE ";"
|
|
|
158 BUCKET := "bucket" BUCKET-ADD-INTEGER-VALUE ";"]]></literallayout>
|
|
|
159 </refsect1>
|
|
|
160
|
|
|
161 <refsect1 id='sample.5'>
|
|
|
162 <title>Sample</title>
|
|
|
163 <literallayout class="monospaced"><![CDATA[
|
|
|
164 threshold 550;
|
|
|
165
|
|
|
166 ignore {
|
|
|
167 127.0.0.0/8; // localhost
|
|
|
168 };
|
|
|
169
|
|
|
170 file "/var/log/cisco.log" {
|
|
|
171 pattern "Internet_Firewall denied (tcp|udp) ([^(]*)" {
|
|
|
172 index 2; // zero based
|
|
|
173 bucket 200;
|
|
|
174 };
|
|
|
175 };
|
|
|
176
|
|
|
177 file "/var/log/secure" {
|
|
|
178 pattern "sshd.*Failed password .* from ::ffff:(.*) port" {
|
|
|
179 index 1; // zero based
|
|
|
180 bucket 400;
|
|
|
181 };
|
|
|
182 pattern "sshd.*Failed password .* from (.*) port" {
|
|
|
183 index 1; // zero based
|
|
|
184 bucket 400;
|
|
|
185 };
|
|
|
186 };]]></literallayout>
|
|
|
187 </refsect1>
|
|
|
188
|
|
|
189 </refentry>
|
|
|
190 </reference>
|
