context dns { threshold 1100; add_command "/sbin/iptables -I INPUT --protocol udp --destination-port 53 --src %s --jump DROP"; remove_command "/sbin/iptables -D INPUT --protocol udp --destination-port 53 --src %s --jump DROP"; ignore { 127.0.0.0/8; // localhost }; file "/var/log/messages" { pattern "named.*client (.*)#.*query.*cache.*denied" { index 1; // zero based bucket 400; message "DNS attack"; }; }; }; context general { threshold 550; add_command "/sbin/iptables -I INPUT --src %s --jump DROP"; remove_command "/sbin/iptables -D INPUT --src %s --jump DROP"; ignore { 127.0.0.0/8; // localhost }; file "/var/log/secure" { pattern "sshd.*Failed password .* from ::ffff:(.*) port" { index 1; // zero based bucket 400; message "ssh failed password"; }; pattern "sshd.*Failed password .* from (.*) port" { index 1; // zero based bucket 400; message "ssh failed password"; }; pattern "proftpd.*no such user found from (.*) \[" { index 1; // zero based bucket 400; message "ftp failed password"; }; }; file "/var/log/messages" { pattern "ipop3d.* Login failed .* \[(.*)\]" { index 1; // zero based bucket 400; message "pop3 failed password"; }; }; file "/var/log/httpd/access_log" { // of course you cannot use this if you actually use cgi-bin directories pattern "(.*) - - .* /cgi-bin" { index 1; // zero based bucket 400; message "apache cgi-bin reference"; }; // or if you actually have an index2.php script pattern "(.*) - - .*/index2.php" { index 1; // zero based bucket 400; message "apache index2.php reference"; }; // or if you have a main.php script pattern "(.*) - - .*/main.php" { index 1; // zero based bucket 400; message "apache main.php reference"; }; pattern "(.*) - - .*/awstats.pl" { index 1; // zero based bucket 400; message "apache awstats.pl reference"; }; pattern "(.*) - - .*/adxmlrpc" { index 1; // zero based bucket 400; message "apache adxmlrpc reference"; }; }; file "/var/log/maillog" { pattern "lost input channel from .* \[(.*)\] .* after (mail|rcpt|auth)" { index 1; // zero based bucket 200; message "sendmail spammer dropping connection"; }; pattern " \[(.*)\]: possible SMTP attack" { index 1; // zero based bucket 600; message "sendmail authentication attack"; }; pattern "rejecting commands from .* \[(.*)\] due to pre-greeting traffic" { index 1; // zero based bucket 200; message "sendmail pre-greeting"; }; pattern "dovecot.*Aborted login.*rip=(.*)," { index 1; // zero based bucket 100; message "dovecot failed password"; }; pattern "dovecot: pop3-login: Disconnected: Shutting down.*rip=(.*)," { index 1; // zero based bucket 100; message "dovecot failed password"; }; // make sure your upstream MX servers are listed in the // ignore block above, otherwise you will kill them off // when they try to forward such mail to you. pattern "sendmail.*from=<>,.*nrcpts=0,.*\[(.*)\]" { index 1; // zero based bucket 200; message "sendmail rejected bounce"; }; }; };