Mercurial > syslog2iptables

comparison xml/syslog2iptables.in @ 11:a9b52f657f08

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
finish coding 1.0 version
author carl
date Thu, 15 Dec 2005 16:20:17 -0800
parents
children c2a2e35a85ac
comparison
equal deleted inserted replaced
10:5dfe0138b4f9 11:a9b52f657f08
1 <reference>
2 <title>@PACKAGE@</title>
3 <partintro>
4 <title>Packages</title>
5 <para>The various source and binary packages are available at <ulink
6 url="http://www.five-ten-sg.com/syslog2iptables/packages">http://www.five-ten-sg.com/syslog2iptables/packages</ulink>
7 </para>
8 <para>The most recent documentation is available at <ulink
9 url="http://www.five-ten-sg.com/syslog2iptables/">http://www.five-ten-sg.com/syslog2iptables/</ulink>
10 </para>
11 </partintro>
12
13 <refentry id="@PACKAGE@.1">
14 <refentryinfo>
15 <date>2005-12-15</date>
16 </refentryinfo>
17
18 <refmeta>
19 <refentrytitle>@PACKAGE@</refentrytitle>
20 <manvolnum>1</manvolnum>
21 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo>
22 </refmeta>
23
24 <refnamediv id='name.1'>
25 <refname>@PACKAGE@</refname>
26 <refpurpose>a simple adaptive firewall</refpurpose>
27 </refnamediv>
28
29 <refsynopsisdiv id='synopsis.1'>
30 <title>Synopsis</title>
31 <cmdsynopsis>
32 <command>@PACKAGE@</command>
33 <arg><option>-c</option></arg>
34 <arg><option>-d <replaceable class="parameter">n</replaceable></option></arg>
35 </cmdsynopsis>
36 </refsynopsisdiv>
37
38 <refsect1 id='description.1'>
39 <title>Description</title>
40 <para><command>@PACKAGE@</command> is a simple adaptive firewall. It
41 maintains the INPUT chain of the <citerefentry>
42 <refentrytitle>iptables</refentrytitle> <manvolnum>1</manvolnum>
43 </citerefentry> firewall set based on syslog entries. These syslog
44 entries are typically generated by your hardware firewall, but they
45 could come from any source. Any syslog entry that contains a host name
46 or ip address can be used as input to this package.</para>
47
48 <para>The <citerefentry> <refentrytitle>@PACKAGE@.conf</refentrytitle>
49 <manvolnum>5</manvolnum> </citerefentry> file specifies the syslog files
50 to be monitored, and the regular expressions (<citerefentry>
51 <refentrytitle>regex</refentrytitle> <manvolnum>7</manvolnum>
52 </citerefentry>) to be applied to new lines in those files. Each
53 regular expression needs an index to specify the matching substring that
54 contains either an ip address or host name, and a bucket count which is
55 added to the leaky bucket for that ip address when a matching line is
56 read from that syslog file.</para>
57
58 <para>Each ip address has an associated leaky bucket, which leaks one
59 token per second. Once the bucket contains more than a configurable
60 number of tokens, that ip address is added to the INPUT chain with a
61 DROP target. When the bucket is drained to zero, that ip address is
62 removed from the INPUT chain.</para>
63 </refsect1>
64
65 <refsect1 id='options.1'>
66 <title>Options</title>
67 <variablelist>
68 <varlistentry>
69 <term>-c</term>
70 <listitem>
71 <para>
72 Load the configuration file, print a cannonical form
73 of the configuration on stdout, and exit.
74 </para>
75 </listitem>
76 </varlistentry>
77 <varlistentry>
78 <term>-d <replaceable class="parameter">n</replaceable></term>
79 <listitem>
80 <para>
81 Set the debug level to <replaceable class="parameter">n</replaceable>.
82 </para>
83 </listitem>
84 </varlistentry>
85 </variablelist>
86 </refsect1>
87
88 <refsect1>
89 <title>Usage</title>
90 <para><command>@PACKAGE@</command> -d 2</para>
91 </refsect1>
92
93 <refsect1>
94 <title>Configuration</title>
95 <para>
96 The configuration file is documented in <citerefentry>
97 <refentrytitle>@PACKAGE@.conf</refentrytitle> <manvolnum>5</manvolnum>
98 </citerefentry>.
99 </para>
100 </refsect1>
101
102 <refsect1>
103 <title>Copyright</title>
104 <para>
105 Copyright (C) 2005 by 510 Software Group &lt;carl@five-ten-sg.com&gt;
106 </para>
107 <para>
108 This program is free software; you can redistribute it and/or modify it
109 under the terms of the GNU General Public License as published by the
110 Free Software Foundation; either version 2, or (at your option) any
111 later version.
112 </para>
113 <para>
114 You should have received a copy of the GNU General Public License along
115 with this program; see the file COPYING. If not, please write to the
116 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
117 </para>
118 </refsect1>
119 </refentry>
120
121
122 <refentry id="@PACKAGE@.conf.5">
123 <refentryinfo>
124 <date>2005-12-15</date>
125 </refentryinfo>
126
127 <refmeta>
128 <refentrytitle>@PACKAGE@.conf</refentrytitle>
129 <manvolnum>5</manvolnum>
130 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo>
131 </refmeta>
132
133 <refnamediv id='name.5'>
134 <refname>@PACKAGE@.conf</refname>
135 <refpurpose>configuration file for @PACKAGE@</refpurpose>
136 </refnamediv>
137
138 <refsynopsisdiv id='synopsis.5'>
139 <title>Synopsis</title>
140 <cmdsynopsis>
141 <command>@PACKAGE@.conf</command>
142 </cmdsynopsis>
143 </refsynopsisdiv>
144
145 <refsect1 id='description.5'>
146 <title>Description</title>
147 <para>The <command>@PACKAGE@.conf</command> configuration file is
148 specified by this partial bnf description.</para>
149
150 <literallayout class="monospaced"><![CDATA[
151 CONFIG := THRESHOLD IGNORE {FILE}+
152 THRESHOLD := "threshold" THRESHOLD-INTEGER-VALUE ";"
153 IGNORE := "ignore" "{" IG-SINGLE+ "};"
154 IG-SINGLE := IP-ADDRESS "/" CIDR-BITS ";"
155 FILE := "file" FILENAME "{" PATTERN+ "};"
156 PATTERN := "pattern" REGULAR-EXPRESSION "{" {INDEX | BUCKET}+ "};"
157 INDEX := "index" REGEX-INTEGER-VALUE ";"
158 BUCKET := "bucket" BUCKET-ADD-INTEGER-VALUE ";"]]></literallayout>
159 </refsect1>
160
161 <refsect1 id='sample.5'>
162 <title>Sample</title>
163 <literallayout class="monospaced"><![CDATA[
164 threshold 550;
165
166 ignore {
167 127.0.0.0/8; // localhost
168 };
169
170 file "/var/log/cisco.log" {
171 pattern "Internet_Firewall denied (tcp|udp) ([^(]*)" {
172 index 2; // zero based
173 bucket 200;
174 };
175 };
176
177 file "/var/log/secure" {
178 pattern "sshd.*Failed password .* from ::ffff:(.*) port" {
179 index 1; // zero based
180 bucket 400;
181 };
182 pattern "sshd.*Failed password .* from (.*) port" {
183 index 1; // zero based
184 bucket 400;
185 };
186 };]]></literallayout>
187 </refsect1>
188
189 </refentry>
190 </reference>