Mercurial > syslog2iptables
annotate xml/syslog2iptables.in @ 58:b45dddebe8fc
Add exponential increase in penalty for repeat offenders
author | Carl Byington <carl@five-ten-sg.com> |
---|---|
date | Tue, 10 Jun 2014 08:48:53 -0700 |
parents | d6fb7fca0394 |
children | 60f59936fabb |
rev | line source |
---|---|
11 | 1 <reference> |
50 | 2 <title>@PACKAGE@ - Version @VERSION@</title> |
11 | 3 <partintro> |
4 <title>Packages</title> | |
44
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
5 |
11 | 6 <para>The various source and binary packages are available at <ulink |
19 | 7 url="http://www.five-ten-sg.com/@PACKAGE@/packages/">http://www.five-ten-sg.com/@PACKAGE@/packages/</ulink> |
12 | 8 The most recent documentation is available at <ulink |
9 url="http://www.five-ten-sg.com/@PACKAGE@/">http://www.five-ten-sg.com/@PACKAGE@/</ulink> | |
11 | 10 </para> |
44
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
11 |
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
12 <para>A <ulink |
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
13 url="http://www.selenic.com/mercurial/wiki/">Mercurial</ulink> source |
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
14 code repository for this project is available at <ulink |
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
15 url="http://hg.five-ten-sg.com/@PACKAGE@/">http://hg.five-ten-sg.com/@PACKAGE@/</ulink>. |
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
16 </para> |
9e9f09cf411c
Add fixes for Solaris from sm-archive.
Carl Byington <carl@five-ten-sg.com>
parents:
42
diff
changeset
|
17 |
11 | 18 </partintro> |
19 | |
20 <refentry id="@PACKAGE@.1"> | |
21 <refentryinfo> | |
53
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
22 <date>2009-01-25</date> |
58
b45dddebe8fc
Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents:
53
diff
changeset
|
23 <author> |
b45dddebe8fc
Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents:
53
diff
changeset
|
24 <firstname>Carl</firstname> |
b45dddebe8fc
Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents:
53
diff
changeset
|
25 <surname>Byington</surname> |
b45dddebe8fc
Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents:
53
diff
changeset
|
26 <affiliation> |
b45dddebe8fc
Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents:
53
diff
changeset
|
27 <orgname>510 Software Group</orgname> |
b45dddebe8fc
Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents:
53
diff
changeset
|
28 </affiliation> |
b45dddebe8fc
Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents:
53
diff
changeset
|
29 </author> |
11 | 30 </refentryinfo> |
31 | |
32 <refmeta> | |
33 <refentrytitle>@PACKAGE@</refentrytitle> | |
34 <manvolnum>1</manvolnum> | |
35 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo> | |
36 </refmeta> | |
37 | |
38 <refnamediv id='name.1'> | |
39 <refname>@PACKAGE@</refname> | |
40 <refpurpose>a simple adaptive firewall</refpurpose> | |
41 </refnamediv> | |
42 | |
43 <refsynopsisdiv id='synopsis.1'> | |
44 <title>Synopsis</title> | |
45 <cmdsynopsis> | |
46 <command>@PACKAGE@</command> | |
47 <arg><option>-c</option></arg> | |
48 <arg><option>-d <replaceable class="parameter">n</replaceable></option></arg> | |
49 </cmdsynopsis> | |
50 </refsynopsisdiv> | |
51 | |
52 <refsect1 id='description.1'> | |
53 <title>Description</title> | |
12 | 54 |
55 <para><command>@PACKAGE@</command> is a simple adaptive firewall. It | |
56 maintains the INPUT chain of the <citerefentry> | |
57 <refentrytitle>iptables</refentrytitle> <manvolnum>1</manvolnum> | |
58 </citerefentry> firewall set based on syslog entries. These syslog | |
59 entries are typically generated by your hardware firewall, but they | |
60 could come from any source. Any syslog entry that contains a host name | |
61 or ip address can be used as input to this package.</para> | |
11 | 62 |
12 | 63 <para>The <citerefentry> <refentrytitle>@PACKAGE@.conf</refentrytitle> |
64 <manvolnum>5</manvolnum> </citerefentry> file specifies the syslog files | |
65 to be monitored, and the regular expressions (<citerefentry> | |
66 <refentrytitle>regex</refentrytitle> <manvolnum>7</manvolnum> | |
67 </citerefentry>) to be applied to new lines in those files. Each | |
68 regular expression needs an index to specify the matching substring that | |
69 contains either an ip address or host name, and a bucket count which is | |
70 added to the leaky bucket for that ip address when a matching line is | |
71 read from that syslog file.</para> | |
11 | 72 |
12 | 73 <para>Each ip address has an associated leaky bucket, which leaks one |
74 token per second. Once the bucket contains more than a configurable | |
75 threshold number of tokens, that ip address is added to the INPUT chain | |
76 with a DROP target. When the bucket is drained to zero, that ip address | |
77 is removed from the INPUT chain.</para> | |
78 | |
79 <para>The discussion has focused on syslog files, but any ascii text | |
80 file can be used, so long as some other process appends lines to that | |
81 file, and those lines containing hostname or ip addresses can be matched | |
82 with some regular expression.</para> | |
83 | |
84 <para>Considering syslog files in particular, these are normally rotated | |
85 via logrotate. <command>@PACKAGE@</command> properly detects and | |
86 handles this case by closing the old file, and reopening the newly | |
87 created file.</para> | |
11 | 88 </refsect1> |
89 | |
90 <refsect1 id='options.1'> | |
91 <title>Options</title> | |
92 <variablelist> | |
93 <varlistentry> | |
94 <term>-c</term> | |
95 <listitem> | |
96 <para> | |
97 Load the configuration file, print a cannonical form | |
98 of the configuration on stdout, and exit. | |
99 </para> | |
100 </listitem> | |
101 </varlistentry> | |
102 <varlistentry> | |
103 <term>-d <replaceable class="parameter">n</replaceable></term> | |
104 <listitem> | |
105 <para> | |
106 Set the debug level to <replaceable class="parameter">n</replaceable>. | |
107 </para> | |
108 </listitem> | |
109 </varlistentry> | |
110 </variablelist> | |
111 </refsect1> | |
112 | |
16 | 113 <refsect1 id='usage.1'> |
11 | 114 <title>Usage</title> |
115 <para><command>@PACKAGE@</command> -d 2</para> | |
116 </refsect1> | |
117 | |
16 | 118 <refsect1 id='configuration.1'> |
11 | 119 <title>Configuration</title> |
120 <para> | |
121 The configuration file is documented in <citerefentry> | |
122 <refentrytitle>@PACKAGE@.conf</refentrytitle> <manvolnum>5</manvolnum> | |
12 | 123 </citerefentry>. Any change to the config file will cause it to be |
124 reloaded within three minutes. | |
11 | 125 </para> |
126 </refsect1> | |
127 | |
24 | 128 <refsect1 id='todo.1'> |
129 <title>TODO</title> | |
130 <para> | |
131 The following ideas are under consideration. | |
132 </para> | |
133 <para> | |
134 Add a configuration option for the iptables table name in the | |
135 pattern statement. This implies handling multiple tables, so each | |
136 table needs its own map of ip addresses and bucket values. | |
137 </para> | |
138 </refsect1> | |
139 | |
16 | 140 <refsect1 id='copyright.1'> |
11 | 141 <title>Copyright</title> |
142 <para> | |
31 | 143 Copyright (C) 2007 by 510 Software Group <carl@five-ten-sg.com> |
11 | 144 </para> |
145 <para> | |
146 This program is free software; you can redistribute it and/or modify it | |
147 under the terms of the GNU General Public License as published by the | |
31 | 148 Free Software Foundation; either version 3, or (at your option) any |
11 | 149 later version. |
150 </para> | |
151 <para> | |
152 You should have received a copy of the GNU General Public License along | |
153 with this program; see the file COPYING. If not, please write to the | |
154 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. | |
155 </para> | |
156 </refsect1> | |
31 | 157 |
158 <refsect1 id='version.1'> | |
42
d9ae11033b4b
Add default config to firewall systems that send bounces to non-existant accounts.
Carl Byington <carl@five-ten-sg.com>
parents:
36
diff
changeset
|
159 <title>Version</title> |
31 | 160 <para> |
42
d9ae11033b4b
Add default config to firewall systems that send bounces to non-existant accounts.
Carl Byington <carl@five-ten-sg.com>
parents:
36
diff
changeset
|
161 @VERSION@ |
31 | 162 </para> |
163 </refsect1> | |
11 | 164 </refentry> |
165 | |
166 | |
167 <refentry id="@PACKAGE@.conf.5"> | |
168 <refentryinfo> | |
53
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
169 <date>2009-01-25</date> |
11 | 170 </refentryinfo> |
171 | |
172 <refmeta> | |
173 <refentrytitle>@PACKAGE@.conf</refentrytitle> | |
174 <manvolnum>5</manvolnum> | |
175 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo> | |
176 </refmeta> | |
177 | |
178 <refnamediv id='name.5'> | |
179 <refname>@PACKAGE@.conf</refname> | |
180 <refpurpose>configuration file for @PACKAGE@</refpurpose> | |
181 </refnamediv> | |
182 | |
183 <refsynopsisdiv id='synopsis.5'> | |
184 <title>Synopsis</title> | |
185 <cmdsynopsis> | |
186 <command>@PACKAGE@.conf</command> | |
187 </cmdsynopsis> | |
188 </refsynopsisdiv> | |
189 | |
190 <refsect1 id='description.5'> | |
191 <title>Description</title> | |
192 <para>The <command>@PACKAGE@.conf</command> configuration file is | |
27 | 193 specified by this partial bnf description. The entire config file |
194 is case sensitive. All the keywords are lower case. | |
195 </para> | |
11 | 196 |
197 <literallayout class="monospaced"><![CDATA[ | |
53
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
198 CONFIG = {CONTEXT ";"}+ |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
199 CONTEXT = "context" NAME "{" {STATEMENT}+ "}" |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
200 STATEMENT := (THRESHOLD | ADD-CMD | REM-CMD | IGNORE | FILE) ";" |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
201 THRESHOLD := "threshold" THRESHOLD-INTEGER-VALUE |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
202 ADD-CMD := "add_command" IPT-CMD |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
203 REM-CMD := "remove_command" IPT-CMD |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
204 IGNORE := "ignore" "{" IG-SINGLE+ "}" |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
205 IG-SINGLE := IP-ADDRESS "/" CIDR-BITS |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
206 FILE := "file" FILENAME "{" PATTERN+ "}" |
35 | 207 PATTERN := "pattern" REGULAR-EXPRESSION "{" {INDEX | BUCKET | MESSAGE}+ "};" |
11 | 208 INDEX := "index" REGEX-INTEGER-VALUE ";" |
29 | 209 BUCKET := "bucket" BUCKET-ADD-INTEGER-VALUE ";" |
35 | 210 MESSAGE := "message" REASON ";" |
211 REASON := string to appear in syslog messages | |
27 | 212 IPT-CMD := string containing exactly one %s replacement token for |
29 | 213 the ip address]]></literallayout> |
11 | 214 </refsect1> |
215 | |
216 <refsect1 id='sample.5'> | |
217 <title>Sample</title> | |
218 <literallayout class="monospaced"><![CDATA[ | |
53
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
219 context dns { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
220 threshold 1100; |
11 | 221 |
53
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
222 add_command "/sbin/iptables -I INPUT --protocol udp --destination-port 53 --src %s --jump DROP"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
223 remove_command "/sbin/iptables -D INPUT --protocol udp --destination-port 53 --src %s --jump DROP"; |
11 | 224 |
53
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
225 ignore { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
226 127.0.0.0/8; // localhost |
11 | 227 }; |
228 | |
53
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
229 file "/var/log/messages" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
230 pattern "named.*client (.*)#.*query.*cache.*denied" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
231 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
232 bucket 400; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
233 message "DNS attack"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
234 }; |
35 | 235 }; |
236 }; | |
237 | |
53
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
238 |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
239 context general { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
240 threshold 550; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
241 |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
242 add_command "/sbin/iptables -I INPUT --src %s --jump DROP"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
243 remove_command "/sbin/iptables -D INPUT --src %s --jump DROP"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
244 |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
245 ignore { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
246 127.0.0.0/8; // localhost |
35 | 247 }; |
53
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
248 |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
249 file "/var/log/secure" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
250 pattern "sshd.*Failed password .* from ::ffff:(.*) port" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
251 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
252 bucket 400; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
253 message "ssh failed password"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
254 }; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
255 pattern "sshd.*Failed password .* from (.*) port" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
256 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
257 bucket 400; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
258 message "ssh failed password"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
259 }; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
260 pattern "proftpd.*no such user found from (.*) \[" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
261 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
262 bucket 400; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
263 message "ftp failed password"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
264 }; |
35 | 265 }; |
53
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
266 |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
267 file "/var/log/messages" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
268 pattern "ipop3d.* Login failed .* \[(.*)\]" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
269 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
270 bucket 400; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
271 message "pop3 failed password"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
272 }; |
35 | 273 }; |
274 | |
53
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
275 file "/var/log/httpd/access_log" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
276 // of course you cannot use this if you actually use cgi-bin directories |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
277 pattern "(.*) - - .* /cgi-bin" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
278 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
279 bucket 400; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
280 message "apache cgi-bin reference"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
281 }; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
282 // or if you actually have an index2.php script |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
283 pattern "(.*) - - .*/index2.php" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
284 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
285 bucket 400; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
286 message "apache index2.php reference"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
287 }; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
288 // or if you have a main.php script |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
289 pattern "(.*) - - .*/main.php" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
290 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
291 bucket 400; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
292 message "apache main.php reference"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
293 }; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
294 pattern "(.*) - - .*/awstats.pl" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
295 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
296 bucket 400; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
297 message "apache awstats.pl reference"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
298 }; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
299 pattern "(.*) - - .*/adxmlrpc" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
300 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
301 bucket 400; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
302 message "apache adxmlrpc reference"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
303 }; |
35 | 304 }; |
305 | |
53
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
306 file "/var/log/maillog" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
307 pattern "lost input channel from .* \[(.*)\] .* after (mail|rcpt|auth)" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
308 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
309 bucket 200; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
310 message "sendmail spammer dropping connection"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
311 }; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
312 pattern " \[(.*)\]: possible SMTP attack" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
313 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
314 bucket 600; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
315 message "sendmail authentication attack"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
316 }; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
317 pattern "rejecting commands from .* \[(.*)\] due to pre-greeting traffic" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
318 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
319 bucket 200; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
320 message "sendmail pre-greeting"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
321 }; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
322 pattern "dovecot.*Aborted login.*rip=(.*)," { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
323 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
324 bucket 100; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
325 message "dovecot failed password"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
326 }; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
327 pattern "dovecot: pop3-login: Disconnected: Shutting down.*rip=(.*)," { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
328 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
329 bucket 100; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
330 message "dovecot failed password"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
331 }; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
332 |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
333 // make sure your upstream MX servers are listed in the |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
334 // ignore block above, otherwise you will kill them off |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
335 // when they try to forward such mail to you. |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
336 pattern "sendmail.*from=<>,.*nrcpts=0,.*\[(.*)\]" { |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
337 index 1; // zero based |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
338 bucket 200; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
339 message "sendmail rejected bounce"; |
d6fb7fca0394
Document multiple contexts
Carl Byington <carl@five-ten-sg.com>
parents:
50
diff
changeset
|
340 }; |
11 | 341 }; |
342 };]]></literallayout> | |
343 </refsect1> | |
344 | |
31 | 345 <refsect1 id='version.5'> |
42
d9ae11033b4b
Add default config to firewall systems that send bounces to non-existant accounts.
Carl Byington <carl@five-ten-sg.com>
parents:
36
diff
changeset
|
346 <title>Version</title> |
31 | 347 <para> |
42
d9ae11033b4b
Add default config to firewall systems that send bounces to non-existant accounts.
Carl Byington <carl@five-ten-sg.com>
parents:
36
diff
changeset
|
348 @VERSION@ |
31 | 349 </para> |
350 </refsect1> | |
351 | |
11 | 352 </refentry> |
353 </reference> |