You can subscribe to this list here.
2005 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
(11) |
Oct
(8) |
Nov
(10) |
Dec
(8) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2006 |
Jan
(6) |
Feb
(1) |
Mar
(43) |
Apr
(17) |
May
(2) |
Jun
(8) |
Jul
(9) |
Aug
(14) |
Sep
(15) |
Oct
(25) |
Nov
(20) |
Dec
(12) |
2007 |
Jan
(29) |
Feb
(19) |
Mar
(8) |
Apr
(12) |
May
(10) |
Jun
(9) |
Jul
(40) |
Aug
(33) |
Sep
(74) |
Oct
(19) |
Nov
(31) |
Dec
(13) |
2008 |
Jan
(50) |
Feb
(52) |
Mar
(43) |
Apr
(21) |
May
(68) |
Jun
(28) |
Jul
(6) |
Aug
(25) |
Sep
(14) |
Oct
(32) |
Nov
(7) |
Dec
(13) |
2009 |
Jan
(25) |
Feb
(1) |
Mar
(2) |
Apr
(8) |
May
(4) |
Jun
(6) |
Jul
(24) |
Aug
(40) |
Sep
(24) |
Oct
(15) |
Nov
(31) |
Dec
(35) |
2010 |
Jan
(6) |
Feb
(1) |
Mar
(23) |
Apr
(16) |
May
(4) |
Jun
(36) |
Jul
(20) |
Aug
(13) |
Sep
(36) |
Oct
(12) |
Nov
(9) |
Dec
(2) |
2011 |
Jan
(16) |
Feb
(9) |
Mar
(21) |
Apr
(33) |
May
(27) |
Jun
(31) |
Jul
(20) |
Aug
(7) |
Sep
(20) |
Oct
(41) |
Nov
(29) |
Dec
(52) |
2012 |
Jan
(127) |
Feb
(36) |
Mar
(15) |
Apr
(40) |
May
(23) |
Jun
(43) |
Jul
(84) |
Aug
(50) |
Sep
(31) |
Oct
(45) |
Nov
(43) |
Dec
(47) |
2013 |
Jan
(39) |
Feb
(83) |
Mar
(50) |
Apr
(50) |
May
(79) |
Jun
(87) |
Jul
(71) |
Aug
(41) |
Sep
(39) |
Oct
(81) |
Nov
(61) |
Dec
(74) |
2014 |
Jan
(76) |
Feb
(50) |
Mar
(45) |
Apr
(62) |
May
(59) |
Jun
(21) |
Jul
(93) |
Aug
(64) |
Sep
(53) |
Oct
(44) |
Nov
(37) |
Dec
(43) |
2015 |
Jan
(60) |
Feb
(72) |
Mar
(35) |
Apr
(50) |
May
(52) |
Jun
(89) |
Jul
(110) |
Aug
(94) |
Sep
(77) |
Oct
(82) |
Nov
(41) |
Dec
(26) |
2016 |
Jan
(42) |
Feb
(44) |
Mar
(26) |
Apr
(55) |
May
(26) |
Jun
(17) |
Jul
(63) |
Aug
(38) |
Sep
(43) |
Oct
(50) |
Nov
(45) |
Dec
(55) |
2017 |
Jan
(26) |
Feb
(29) |
Mar
(28) |
Apr
(40) |
May
(2) |
Jun
(16) |
Jul
(22) |
Aug
(21) |
Sep
(35) |
Oct
(47) |
Nov
(10) |
Dec
(15) |
2018 |
Jan
(18) |
Feb
(35) |
Mar
(71) |
Apr
(9) |
May
(39) |
Jun
(19) |
Jul
(14) |
Aug
(108) |
Sep
(5) |
Oct
(34) |
Nov
(24) |
Dec
(13) |
2019 |
Jan
(13) |
Feb
(19) |
Mar
(33) |
Apr
(11) |
May
(21) |
Jun
(61) |
Jul
(21) |
Aug
(80) |
Sep
(26) |
Oct
(10) |
Nov
(8) |
Dec
(4) |
2020 |
Jan
(26) |
Feb
(81) |
Mar
(31) |
Apr
(37) |
May
(52) |
Jun
(10) |
Jul
(47) |
Aug
(25) |
Sep
(63) |
Oct
(36) |
Nov
(19) |
Dec
(18) |
2021 |
Jan
(49) |
Feb
(11) |
Mar
(18) |
Apr
(21) |
May
(66) |
Jun
(8) |
Jul
(35) |
Aug
(30) |
Sep
(10) |
Oct
(31) |
Nov
(4) |
Dec
(23) |
2022 |
Jan
(1) |
Feb
(16) |
Mar
(34) |
Apr
(6) |
May
(2) |
Jun
|
Jul
(1) |
Aug
(17) |
Sep
(1) |
Oct
(2) |
Nov
(4) |
Dec
(16) |
2023 |
Jan
(10) |
Feb
(39) |
Mar
(7) |
Apr
(44) |
May
(17) |
Jun
(20) |
Jul
|
Aug
(2) |
Sep
(10) |
Oct
(7) |
Nov
(3) |
Dec
(3) |
2024 |
Jan
(1) |
Feb
(10) |
Mar
(8) |
Apr
(1) |
May
(19) |
Jun
(15) |
Jul
(3) |
Aug
(5) |
Sep
|
Oct
|
Nov
|
Dec
|
From: Yaroslav H. <li...@on...> - 2006-03-28 02:28:15
|
Hi Rarig, I again hijack your thread ;-) Indeed, it should work with your script... or to say -- your original tar.gz with only my recent fail2ban script should work... I tar.gz-ipped all necessary files in a layout of old logwatch, tested on Debian sarge which shipped with 5.2.2 logwatch Everything seems to be smooth ;-) Enjoy P.S. Cyril -- would you mind making both versions of logwatch scripts available on fail2ban site -- fail2ban.logwatch.7x.tgz for recent versions of logwatch (probably 7.x) (who can pin point which? :-) fail2ban.logwatch.5x.tgz -- for older (5.x) versions -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Rarig, H. <hr...@so...> - 2006-03-27 19:17:20
|
Nils, Try the attached "applyeurodate" file on for size. It is a rehash of my = original date matching script which should match "yesterday", "today", = and "all" in the logwatch print directive. Just replace the "applyeurodate" file in the latest logwatch files = release from Yaroslav with the "applyeurodate" script in the attached = tarball and I believe it will do the trick. =20 To see if it really works, try the following commands: logwatch --print --service fail2ban logwatch --range today --print --service fail2ban logwatch --range yesterday --print --service fail2ban logwatch --range all --print --service fail2ban (WARNING! This could = produce a lot of output!) Cheers! Harry -----Original Message----- From: fai...@li... [mailto:fai...@li...]On Behalf Of Nils Breunese (Lemonbit Internet) Sent: Monday, March 27, 2006 1:17 PM To: fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report Harry Rarig wrote: > Just make sure the README file warns that these logwatch files will =20 > not work with earlier versions of logwatch (e.g., version 5.2.2 =20 > which comes with Fedora Core 3) because of the "use Logwatch =20 > ':dates';" directive in /usr/share/logwatch/scripts/shared/=20 > applyeurodate. Users should be advised to upgrade their logwatch to =20 > the latest version (e.g. logwatch-7.2.1). Couldn't a version that works with 5.2.2 be made? Fedora Core 2, =20 Fedora Core 3 and CentOS 4 all have 5.2.2 rpms in their repositories =20 and I wouldn't want to upgrade all of my servers just to be able to =20 run this script. Nils. ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting = language that extends applications into web and mobile media. Attend the live = webcast and join the prime developer group breaking into this new coding = territory! http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D110944&bid=3D241720&dat=3D= 121642 _______________________________________________ Fail2ban-users mailing list Fai...@li... https://lists.sourceforge.net/lists/listinfo/fail2ban-users |
From: Nils B. (L. Internet) <ni...@le...> - 2006-03-27 18:17:44
|
Harry Rarig wrote: > Just make sure the README file warns that these logwatch files will > not work with earlier versions of logwatch (e.g., version 5.2.2 > which comes with Fedora Core 3) because of the "use Logwatch > ':dates';" directive in /usr/share/logwatch/scripts/shared/ > applyeurodate. Users should be advised to upgrade their logwatch to > the latest version (e.g. logwatch-7.2.1). Couldn't a version that works with 5.2.2 be made? Fedora Core 2, Fedora Core 3 and CentOS 4 all have 5.2.2 rpms in their repositories and I wouldn't want to upgrade all of my servers just to be able to run this script. Nils. |
From: Rarig, H. <hr...@so...> - 2006-03-27 18:06:30
|
Yaroslav, Just loaded up your latest tarball of logwatch files = (fail2ban.logwatch.v5.tgz)... I love it, ship it, nice job! Just make sure the README file warns that these logwatch files will not = work with earlier versions of logwatch (e.g., version 5.2.2 which comes = with Fedora Core 3) because of the "use Logwatch ':dates';" directive in = /usr/share/logwatch/scripts/shared/applyeurodate. Users should be = advised to upgrade their logwatch to the latest version (e.g. = logwatch-7.2.1). Harry [root@birch ~]# logwatch --detail 5 --range today --print --service = fail2ban ################### Logwatch 7.2.1 (01/18/06) #################### Processing Initiated: Mon Mar 27 12:50:46 2006 Date Range Processed: today ( 2006-Mar-27 ) Period is day. Detail Level of Output: 5 Type of Output: unformatted Logfiles for Host: birch.foobar.net ################################################################## --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: Bans:Unbans VSFTPD: [ 4:2 ] 72.9.234.170 (star.dnsprotect.com) 2:1 208.45.212.32 (foobar.goober.com) 2:1 ---------------------- fail2ban-messages End ------------------------- ###################### Logwatch End ######################### [root@birch ~]# -----Original Message----- From: fai...@li... [mailto:fai...@li...]On Behalf Of Yaroslav Halchenko Sent: Friday, March 24, 2006 7:49 PM To: fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report On Fri, 24 Mar 2006, Rarig, Harry wrote: > Yaroslav, > Loaded up the tarball on my small server and got the logwatch output = from the fail2ban.log input file given below. > Definitely moving in the right direction! > Just a few comments based on these results: > 1) The summary line "(all)" should be "(all) 1 ban(s) 1 unban(s)" you have Detail Level of Output: 0 please make it 5 but indeed I should probably don't print individual ips + ban/unban with such low level of details - but only print out a summary...=20 > 2) The "(all)" summary line should *always* appear as the first line, = not sometimes first, and sometimes last yeah - I thought that sorting would take care about it... > 3) My personal preference is a summary line like this: "Totals: 1 = ban(s) 1 unban(s)" or "All: 1 ban(s) 1 unban(s)"; it just looks a little = cleaner to me than "(all) 1 ban(s) 1 unban(s)" ;-) it will be=20 VSFTPD: X ban(s) Y unban(s) then reports per IP if detail >=3D5 =20 and no "all" at all -- that would resolve 1-3 ;-) > 4) Nice job, now get some sleep my friend, you need it! thanks ;) it is just 8pm here ;-) I will work on this thing after put my baby and wife asleep ;-) > Harry --=20 .-. =3D------------------------------ /v\ ----------------------------=3D Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting = language that extends applications into web and mobile media. Attend the live = webcast and join the prime developer group breaking into this new coding = territory! http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D110944&bid=3D241720&dat=3D= 121642 _______________________________________________ Fail2ban-users mailing list Fai...@li... https://lists.sourceforge.net/lists/listinfo/fail2ban-users |
From: Yaroslav H. <de...@on...> - 2006-03-27 02:32:09
|
Package: logwatch Version: 7.1-1 Severity: wishlist Tags: patch User-Agent: mutt-ng/devel-r782 (Debian) Dear Debian Developer and Upstream Authors of the LogWatch, Please find attached scripts/configs for including reports about fail2ban(http://fail2ban.sourceforge.net/) activity. As the starting point I took configs provided by "Rarig, Harry" <hr...@so...> and logwatch ssh script and also had to generate a new apply*date script, since the time format in fail2ban logs seems to be not covered by any present in the shipped logwatch. I am emailing both DD and upstream since version shipped by Debian (7.1) seems to be not the most recent stable upstream, and I believe that if you decide to include the scripts, they will be included just in the development branch. Dear DD, I would really appreciate if you include the scripts in logwatch package meanwhile -- quite a few users would benefit from that. Here are examples of reports generated with provided scripts: Verbose (Detail >=10): --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: Bans:Unbans SSH: [ 6:6 ] 210.103.124.7 1:1 Failed 5 times 210.14.28.59 1:1 Failed 5 times 165.230.95.72 (tractatus.rutgers.edu) 4:4 Failed 5 5 5 5 times VSFTPD: [ 1:1 ] 72.9.234.170 (star.dnsprotect.com) 1:1 **Unmatched Entries** 2006-03-05 18:13:24,365 WARNING: is not a valid IP address 2006-03-12 07:50:09,404 WARNING: is not a valid IP address <SKIPPED> Regular (Detail==5) --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: Bans:Unbans SSH: [ 6:6 ] 210.103.124.7 1:1 210.14.28.59 1:1 165.230.95.72 (tractatus.rutgers.edu) 4:4 VSFTPD: [ 1:1 ] 72.9.234.170 (star.dnsprotect.com) 1:1 **Unmatched Entries** 2006-03-05 18:13:24,365 WARNING: is not a valid IP address 2006-03-12 07:50:09,404 WARNING: is not a valid IP address <SKIPPED> Minimal verbosity (Detail == 0): --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: Bans:Unbans SSH: [ 6:6 ] VSFTPD: [ 1:1 ] ---------------------- fail2ban-messages End ------------------------- -- System Information: Debian Release: testing/unstable APT prefers unstable APT policy: (500, 'unstable') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.13.4 Locale: LANG=ru_RU.KOI8-R, LC_CTYPE=ru_RU.KOI8-R (charmap=KOI8-R) Versions of packages logwatch depends on: ii gawk 1:3.1.5-1 GNU awk, a pattern scanning and pr ii mailx 1:8.1.2-0.20050715cvs-1 A simple mail user agent ii perl 5.8.7-10 Larry Wall's Practical Extraction logwatch recommends no packages. -- no debconf information -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Benjamin D. <ben...@py...> - 2006-03-25 14:13:57
|
Yaroslav Halchenko wrote: > Please see fresh version attached. Hopefully this time it will satisfy > everyone's needs ;-) Works perfectly on my system! :-) Huge thank yous! Ben |
From: Yaroslav H. <li...@on...> - 2006-03-25 05:08:48
|
Please see fresh version attached. Hopefully this time it will satisfy everyone's needs ;-) Sample outputs: Verbose (Detail >=10): --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: Bans:Unbans SSH: [ 6:6 ] 210.103.124.7 1:1 Failed 5 times 210.14.28.59 1:1 Failed 5 times 165.230.95.72 (tractatus.rutgers.edu) 4:4 Failed 5 5 5 5 times VSFTPD: [ 1:1 ] 72.9.234.170 (star.dnsprotect.com) 1:1 **Unmatched Entries** 2006-03-05 18:13:24,365 WARNING: is not a valid IP address 2006-03-12 07:50:09,404 WARNING: is not a valid IP address Regular (Detail==5) --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: Bans:Unbans SSH: [ 6:6 ] 210.103.124.7 1:1 210.14.28.59 1:1 165.230.95.72 (tractatus.rutgers.edu) 4:4 VSFTPD: [ 1:1 ] 72.9.234.170 (star.dnsprotect.com) 1:1 **Unmatched Entries** 2006-03-05 18:13:24,365 WARNING: is not a valid IP address 2006-03-12 07:50:09,404 WARNING: is not a valid IP address Minimal verbosity (Detail == 0): --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: Bans:Unbans SSH: [ 6:6 ] VSFTPD: [ 1:1 ] ---------------------- fail2ban-messages End ------------------------- Please mention that I excluded Unmatched Entries for Detail=0 I believe I didn't change anything in the logic so if previous one worked for you, this one should work as well. Enjoy -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Yaroslav H. <li...@on...> - 2006-03-25 00:49:06
|
On Fri, 24 Mar 2006, Rarig, Harry wrote: > Yaroslav, > Loaded up the tarball on my small server and got the logwatch output from the fail2ban.log input file given below. > Definitely moving in the right direction! > Just a few comments based on these results: > 1) The summary line "(all)" should be "(all) 1 ban(s) 1 unban(s)" you have Detail Level of Output: 0 please make it 5 but indeed I should probably don't print individual ips + ban/unban with such low level of details - but only print out a summary... > 2) The "(all)" summary line should *always* appear as the first line, not sometimes first, and sometimes last yeah - I thought that sorting would take care about it... > 3) My personal preference is a summary line like this: "Totals: 1 ban(s) 1 unban(s)" or "All: 1 ban(s) 1 unban(s)"; it just looks a little cleaner to me than "(all) 1 ban(s) 1 unban(s)" ;-) it will be VSFTPD: X ban(s) Y unban(s) then reports per IP if detail >=5 and no "all" at all -- that would resolve 1-3 ;-) > 4) Nice job, now get some sleep my friend, you need it! thanks ;) it is just 8pm here ;-) I will work on this thing after put my baby and wife asleep ;-) > Harry -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Benjamin D. <ben...@py...> - 2006-03-25 00:01:11
|
Yaroslav Halchenko wrote: > Thank you for testing -- damn me, again a side-effect of coding at night > -- a bug .... uff -- I was still basing my output on caught "INFO" > entries... now it MUST work! ;-) also I've added (all) entry, which is > just a sum of ban/unbans across all entries. Works perfectly - see below. Many thanks! :-) Ben # /usr/sbin/logwatch --service fail2ban --range all --print ################### LogWatch 7.1 (11/12/05) #################### Processing Initiated: Fri Mar 24 22:31:12 2006 Date Range Processed: all Detail Level of Output: 5 Type of Output: unformatted Logfiles for Host: kevin.pythagoras.no-ip.org ################################################################## --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: Apache: (all) 2 ban(s) 2 unban(s) 87.74.28.38 (host-87-74-28-38.bulldogdsl.com) 2 ban(s) 2 unban(s) IMAP: (all) 2 ban(s) 2 unban(s) 87.74.28.38 (host-87-74-28-38.bulldogdsl.com) 2 ban(s) 2 unban(s) IMAPPOP: (all) 4 ban(s) 4 unban(s) 87.74.28.38 (host-87-74-28-38.bulldogdsl.com) 4 ban(s) 4 unban(s) SMTP: (all) 6 ban(s) 6 unban(s) 202.63.163.82 (202-63-163-82.exatt.net) 3 ban(s) 3 unban(s) 24.151.58.194 (24-151-58-194.dhcp.nwtn.ct.charter.com) 1 ban(s) 1 unban(s) 87.74.28.38 (host-87-74-28-38.bulldogdsl.com) 1 ban(s) 1 unban(s) 196.1.176.165 (196-1-176-165.nitelnet.com) 1 ban(s) 1 unban(s) ---------------------- fail2ban-messages End ------------------------- |
From: Rarig, H. <hr...@so...> - 2006-03-24 18:46:35
|
Yaroslav, Loaded up the tarball on my small server and got the logwatch output = from the fail2ban.log input file given below. Definitely moving in the right direction! Just a few comments based on these results: 1) The summary line "(all)" should be "(all) 1 ban(s) 1 unban(s)" 2) The "(all)" summary line should *always* appear as the first line, = not sometimes first, and sometimes last 3) My personal preference is a summary line like this: "Totals: 1 ban(s) = 1 unban(s)" or "All: 1 ban(s) 1 unban(s)"; it just looks a little = cleaner to me than "(all) 1 ban(s) 1 unban(s)" ;-) 4) Nice job, now get some sleep my friend, you need it! Harry [root@birch /]# logwatch --range today --print --service fail2ban ################### Logwatch 7.2.1 (01/18/06) #################### Processing Initiated: Fri Mar 24 13:28:16 2006 Date Range Processed: today ( 2006-Mar-24 ) Period is day. Detail Level of Output: 0 Type of Output: unformatted Logfiles for Host: birch.wp.comcast.net ################################################################## --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: VSFTPD: (all) 72.9.234.170 (star.dnsprotect.com) **Unmatched Entries** 2006-03-24 07:19:43,609 WARNING: is not a valid IP address 2006-03-24 07:22:03,546 WARNING: is not a valid IP address ---------------------- fail2ban-messages End ------------------------- ###################### Logwatch End ######################### [root@birch /]# tail /var/log/fail2ban.log 2006-03-24 06:58:38,154 WARNING: Restoring firewall rules... 2006-03-24 07:00:15,450 WARNING: Restoring firewall rules... 2006-03-24 07:02:15,033 WARNING: Restoring firewall rules... 2006-03-24 07:02:27,387 WARNING: Restoring firewall rules... 2006-03-24 07:19:43,609 WARNING: is not a valid IP address 2006-03-24 07:21:56,681 WARNING: Restoring firewall rules... 2006-03-24 07:22:03,546 WARNING: is not a valid IP address 2006-03-24 07:23:34,844 WARNING: Restoring firewall rules... 2006-03-24 07:25:55,284 WARNING: VSFTPD: Ban (600 s) 72.9.234.170 2006-03-24 07:35:56,274 WARNING: VSFTPD: Unban 72.9.234.170 [root@birch /]# -----Original Message----- From: fai...@li... [mailto:fai...@li...]On Behalf Of Yaroslav Halchenko Sent: Friday, March 24, 2006 10:56 AM To: fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report Hi Rarig, Thank you for testing -- damn me, again a side-effect of coding at night -- a bug .... uff -- I was still basing my output on caught "INFO" entries... now it MUST work! ;-) also I've added (all) entry, which is just a sum of ban/unbans across all entries.=20 Example with your logs: Banned services with Fail2Ban: SSH: 210.103.124.7 1 ban(s) 1 unban(s): 5 failures 210.14.28.59 1 ban(s) 1 unban(s): 5 failures 165.230.95.72 4 ban(s) 4 unban(s): 5 5 5 5 failures (all) 6 ban(s) 6 unban(s) VSFTPD: (all) 1 ban(s) 1 unban(s) 72.9.234.170 1 ban(s) 1 unban(s) Example with many logs: Banned services with Fail2Ban: SSH: 213.76.149.226 1 ban(s) 1 unban(s) 66.34.52.10 1 ban(s) 1 unban(s) 217.11.107.130 (fw-2.saimanet.net) 1 ban(s) 1 unban(s) 202.63.117.71 (yantra.uceou.edu) 2 ban(s) 2 unban(s) 201.224.172.195 2 ban(s) 2 unban(s) 24.218.152.41 (c-24-218-152-41.hsd1.ma.comcast.net) 2 ban(s) 2 = unban(s) 210.22.12.56 (sunym.gdsz.cncnet.net) 2 ban(s) 2 unban(s) 203.86.41.223 2 ban(s) 2 unban(s) 125.240.172.5 2 ban(s) 2 unban(s) 165.230.95.72 (tractatus.rutgers.edu) 4 ban(s) 4 unban(s) 217.199.176.86 (fw.ns.aswood.net) 2 ban(s) 2 unban(s) 83.239.15.116 2 ban(s) 2 unban(s) 218.146.254.184 2 ban(s) 2 unban(s) (all) 25 ban(s) 25 unban(s) I hope this works fine -- please provide feedback --=20 .-. =3D------------------------------ /v\ ----------------------------=3D Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Yaroslav H. <li...@on...> - 2006-03-24 15:56:48
|
Hi Rarig, Thank you for testing -- damn me, again a side-effect of coding at night -- a bug .... uff -- I was still basing my output on caught "INFO" entries... now it MUST work! ;-) also I've added (all) entry, which is just a sum of ban/unbans across all entries. Example with your logs: Banned services with Fail2Ban: SSH: 210.103.124.7 1 ban(s) 1 unban(s): 5 failures 210.14.28.59 1 ban(s) 1 unban(s): 5 failures 165.230.95.72 4 ban(s) 4 unban(s): 5 5 5 5 failures (all) 6 ban(s) 6 unban(s) VSFTPD: (all) 1 ban(s) 1 unban(s) 72.9.234.170 1 ban(s) 1 unban(s) Example with many logs: Banned services with Fail2Ban: SSH: 213.76.149.226 1 ban(s) 1 unban(s) 66.34.52.10 1 ban(s) 1 unban(s) 217.11.107.130 (fw-2.saimanet.net) 1 ban(s) 1 unban(s) 202.63.117.71 (yantra.uceou.edu) 2 ban(s) 2 unban(s) 201.224.172.195 2 ban(s) 2 unban(s) 24.218.152.41 (c-24-218-152-41.hsd1.ma.comcast.net) 2 ban(s) 2 unban(s) 210.22.12.56 (sunym.gdsz.cncnet.net) 2 ban(s) 2 unban(s) 203.86.41.223 2 ban(s) 2 unban(s) 125.240.172.5 2 ban(s) 2 unban(s) 165.230.95.72 (tractatus.rutgers.edu) 4 ban(s) 4 unban(s) 217.199.176.86 (fw.ns.aswood.net) 2 ban(s) 2 unban(s) 83.239.15.116 2 ban(s) 2 unban(s) 218.146.254.184 2 ban(s) 2 unban(s) (all) 25 ban(s) 25 unban(s) I hope this works fine -- please provide feedback -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Rarig, H. <hr...@so...> - 2006-03-24 14:31:48
|
Yaroslav, I installed the four logwatch files you sent and created a single vsftpd = ban failure as shown in the logfile below. =20 fail2ban: version 0.6.1 logwatch: version 7.2.1-2 Unfortunately, the filter is not matching the VSFTPD log entries. Also, = the filter you wrote does not work with the stock logwatch distribution = that comes with Fedora Core 3 (5.2.2-1.FC3.3), you need to update to the = latest version (7.2.1). Let me know when you get a fix for this, will be happy to test it out = for you ;-) Cheers! Harry =3D=3D=3D>> Here is the logwatch report for fail2ban [root@birch /]# logwatch --range today --print --service fail2ban ################### Logwatch 7.2.1 (01/18/06) #################### Processing Initiated: Fri Mar 24 08:46:16 2006 Date Range Processed: today ( 2006-Mar-24 ) Period is day. Detail Level of Output: 0 Type of Output: unformatted Logfiles for Host: foobar.com ################################################################## --------------------- fail2ban-messages Begin ------------------------ **Unmatched Entries** 2006-03-24 07:19:43,609 WARNING: is not a valid IP address 2006-03-24 07:22:03,546 WARNING: is not a valid IP address ---------------------- fail2ban-messages End ------------------------- ###################### Logwatch End ######################### =3D=3D=3D>> Here is the input file to logwatch. Note the VSFTPD entries = that are not being matched. [root@birch /]# tail /var/log/fail2ban.log 2006-03-24 06:58:38,154 WARNING: Restoring firewall rules... 2006-03-24 07:00:15,450 WARNING: Restoring firewall rules... 2006-03-24 07:02:15,033 WARNING: Restoring firewall rules... 2006-03-24 07:02:27,387 WARNING: Restoring firewall rules... 2006-03-24 07:19:43,609 WARNING: is not a valid IP address 2006-03-24 07:21:56,681 WARNING: Restoring firewall rules... 2006-03-24 07:22:03,546 WARNING: is not a valid IP address 2006-03-24 07:23:34,844 WARNING: Restoring firewall rules... 2006-03-24 07:25:55,284 WARNING: VSFTPD: Ban (600 s) 72.9.234.170 2006-03-24 07:35:56,274 WARNING: VSFTPD: Unban 72.9.234.170 [root@birch /]# -----Original Message----- From: fai...@li... [mailto:fai...@li...]On Behalf Of Yaroslav Halchenko Sent: Thursday, March 23, 2006 11:08 PM To: fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report Hi All, Here is a brand new version... This one should fit everyone in terms of functionality I hope=20 I fixed a bug and added a bit more information to the report. Also previous version was monitoring "INFO:" (verbose>0) level not "WARN:"(no verbose) HEre is a sample output (detail level 6 I believe) --------------------- fail2ban-messages Begin ------------------------=20 Banned services with Fail2Ban: SSH: 210.103.124.7 1 ban(s) 1 unban(s): 5 failures 210.14.28.59 1 ban(s) 1 unban(s): 5 failures =20 ---------------------- fail2ban-messages End -------------------------=20 and here is for this month on my desktop with default detail level (which is 5 I believe)... The list of Unmatched entries is quite long but I think it should be this way -- I cut it after few lines to don't abuse mailin list ;-) ################### LogWatch 7.1 (11/12/05) ####################=20 Processing Initiated: Thu Mar 23 23:05:29 2006 Date Range Processed: between 03/01/2006 and today ( 2006-Mar-01 / 2006-Mar-23 ) Period is day. Detail Level of Output: 5 Type of Output: unformatted Logfiles for Host: washoe ##################################################################=20 =20 --------------------- fail2ban-messages Begin ------------------------=20 Banned services with Fail2Ban: ApacheAttacks: 61.220.191.21 (61-220-191-21.HINET-IP.hinet.net) 2 ban(s) 2 = unban(s) 66.34.225.186 2 ban(s) 2 unban(s) SSH: 68.85.110.185 (c-68-85-110-185.hsd1.de.comcast.net) 1 ban(s) 1 = unban(s) 59.120.70.210 (59-120-70-210.HINET-IP.hinet.net) 1 ban(s) 1 = unban(s) 66.34.52.10 1 ban(s) 1 unban(s) 217.11.107.130 (fw-2.saimanet.net) 1 ban(s) 1 unban(s) 202.63.117.71 (yantra.uceou.edu) 2 ban(s) 2 unban(s) 201.224.172.195 2 ban(s) 2 unban(s) 139.142.43.29 (raq.yourlink.ca) 2 ban(s) 2 unban(s) 210.22.12.56 (sunym.gdsz.cncnet.net) 2 ban(s) 2 unban(s) 203.86.41.223 2 ban(s) 2 unban(s) 125.240.172.5 2 ban(s) 2 unban(s) 165.230.95.67 (washoe.rutgers.edu) 2 ban(s) 2 unban(s) 60.248.185.43 (60-248-185-43.HINET-IP.hinet.net) 2 ban(s) 2 = unban(s) 218.146.254.184 6 ban(s) 6 unban(s) 83.14.0.230 (dwa230.internetdsl.tpnet.pl) 2 ban(s) 2 unban(s) =20 **Unmatched Entries** 2006-03-03 14:54:25,215 ERROR: SSH: 83.14.0.230 already in ban list 2006-03-04 04:43:10,360 ERROR: SSH: 218.146.254.184 already in ban list 2006-03-05 07:46:04,013 WARNING: is not a valid IP address 2006-03-06 14:53:55,477 ERROR: 'iptables -D INPUT -p tcp --dport http = -j fail2ban-Apache 2006-03-06 14:53:55,524 ERROR: 'iptables -D INPUT -p tcp --dport http = -j fail2ban-ApacheAttacks ........ --=20 .-. =3D------------------------------ /v\ ----------------------------=3D Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Yaroslav H. <li...@on...> - 2006-03-24 04:08:50
|
Hi All, Here is a brand new version... This one should fit everyone in terms of functionality I hope I fixed a bug and added a bit more information to the report. Also previous version was monitoring "INFO:" (verbose>0) level not "WARN:"(no verbose) HEre is a sample output (detail level 6 I believe) --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: SSH: 210.103.124.7 1 ban(s) 1 unban(s): 5 failures 210.14.28.59 1 ban(s) 1 unban(s): 5 failures ---------------------- fail2ban-messages End ------------------------- and here is for this month on my desktop with default detail level (which is 5 I believe)... The list of Unmatched entries is quite long but I think it should be this way -- I cut it after few lines to don't abuse mailin list ;-) ################### LogWatch 7.1 (11/12/05) #################### Processing Initiated: Thu Mar 23 23:05:29 2006 Date Range Processed: between 03/01/2006 and today ( 2006-Mar-01 / 2006-Mar-23 ) Period is day. Detail Level of Output: 5 Type of Output: unformatted Logfiles for Host: washoe ################################################################## --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: ApacheAttacks: 61.220.191.21 (61-220-191-21.HINET-IP.hinet.net) 2 ban(s) 2 unban(s) 66.34.225.186 2 ban(s) 2 unban(s) SSH: 68.85.110.185 (c-68-85-110-185.hsd1.de.comcast.net) 1 ban(s) 1 unban(s) 59.120.70.210 (59-120-70-210.HINET-IP.hinet.net) 1 ban(s) 1 unban(s) 66.34.52.10 1 ban(s) 1 unban(s) 217.11.107.130 (fw-2.saimanet.net) 1 ban(s) 1 unban(s) 202.63.117.71 (yantra.uceou.edu) 2 ban(s) 2 unban(s) 201.224.172.195 2 ban(s) 2 unban(s) 139.142.43.29 (raq.yourlink.ca) 2 ban(s) 2 unban(s) 210.22.12.56 (sunym.gdsz.cncnet.net) 2 ban(s) 2 unban(s) 203.86.41.223 2 ban(s) 2 unban(s) 125.240.172.5 2 ban(s) 2 unban(s) 165.230.95.67 (washoe.rutgers.edu) 2 ban(s) 2 unban(s) 60.248.185.43 (60-248-185-43.HINET-IP.hinet.net) 2 ban(s) 2 unban(s) 218.146.254.184 6 ban(s) 6 unban(s) 83.14.0.230 (dwa230.internetdsl.tpnet.pl) 2 ban(s) 2 unban(s) **Unmatched Entries** 2006-03-03 14:54:25,215 ERROR: SSH: 83.14.0.230 already in ban list 2006-03-04 04:43:10,360 ERROR: SSH: 218.146.254.184 already in ban list 2006-03-05 07:46:04,013 WARNING: is not a valid IP address 2006-03-06 14:53:55,477 ERROR: 'iptables -D INPUT -p tcp --dport http -j fail2ban-Apache 2006-03-06 14:53:55,524 ERROR: 'iptables -D INPUT -p tcp --dport http -j fail2ban-ApacheAttacks ........ -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Benjamin D. <ben...@py...> - 2006-03-22 23:23:16
|
Benjamin Donnachie wrote: > ################### LogWatch 7.1 (11/12/05) #################### > Processing Initiated: Wed Mar 22 23:03:01 2006 > Date Range Processed: all > Detail Level of Output: 5 > Type of Output: unformatted > Logfiles for Host: kevin.pythagoras.no-ip.org > ################################################################## > > --------------------- fail2ban-messages Begin ------------------------ > > Banned services with Fail2Ban: > Apache: > 87.74.28.38 (host-87-74-28-38.bulldogdsl.com) > SSH: > 87.74.28.38 (host-87-74-28-38.bulldogdsl.com) > > ---------------------- fail2ban-messages End ------------------------- Ah... I just realised that these entries are from several days ago and I can't persuade it to display anything more recent... I'm going to give for tonight as I should have crashed into bed ages ago... Nighty night! :-) Ben |
From: Benjamin D. <ben...@py...> - 2006-03-22 23:06:19
|
Yaroslav Halchenko wrote: > I observed the weird logwatch behavior, as Ben reported, that even > though file is present under /etc/logwatch/conf/logfiles/fail2ban.conf > logwatch says that it is not there... since at the moment I was anxious > to make a rule for logwatch, not to fix logwatch problems, I just > installed fail2ban scripts system-wide. Ah-ha! I've not installed them system wide and it seems much happier now! :-) # /usr/sbin/logwatch --print --service fail2ban --range all ################### LogWatch 7.1 (11/12/05) #################### Processing Initiated: Wed Mar 22 23:03:01 2006 Date Range Processed: all Detail Level of Output: 5 Type of Output: unformatted Logfiles for Host: kevin.pythagoras.no-ip.org ################################################################## --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: Apache: 87.74.28.38 (host-87-74-28-38.bulldogdsl.com) SSH: 87.74.28.38 (host-87-74-28-38.bulldogdsl.com) ---------------------- fail2ban-messages End ------------------------- ###################### LogWatch End ######################### Many thanks! :-) Ben |
From: Yaroslav H. <li...@on...> - 2006-03-22 22:38:32
|
=46rom the first look at logwatch code: the only place where it seems to load conf files from /etc/logwatch (on debian at least) is here: # Find out what logfiles are defined... opendir(LOGFILEDIR, $BaseDir . "/default.conf/logfiles") or die $BaseDir . = "/default.conf/logfiles/, no such direc tory.\n"; while (defined($ThisFile =3D readdir(LOGFILEDIR))) { unless (-d $BaseDir . "/default.conf/logfiles/" . $ThisFile) { my $ThisLogFile =3D $ThisFile; if ($ThisLogFile =3D~ s/\.conf$//i) { push @AllLogFiles, $ThisLogFile; @ReadConfigNames =3D (); @ReadConfigValues =3D (); @Separators =3D (); push (@Separators, scalar(@ReadConfigNames)); ReadConfigFile("$BaseDir/default.conf/logfiles/" . $ThisFile, ""); push (@Separators, scalar(@ReadConfigNames)); ReadConfigFile("$BaseDir/dist.conf/logfiles/" . $ThisFile, ""); push (@Separators, scalar(@ReadConfigNames)); ReadConfigFile("$ConfigDir/conf/logfiles/" . $ThisFile, ""); push (@Separators, scalar(@ReadConfigNames)); ReadConfigFile("$ConfigDir/conf/override.conf", "logfiles/$ThisLog= File"); =2E.... So, if there is no fail2ban.conf under $BaseDir . "/default.conf/logfiles/"= , then it never gets read from /etc/logwatch seems to me... yikes...=20 On Wed, 22 Mar 2006, Rarig, Harry wrote: > Ben, > Try=20 > logwatch --debug Med --print --service fail2ban > or > logwatch --debug High --print --service fail2ban > and see if that helps identify the root cause of your problem. > Cheers! > -----Original Message----- > From: Benjamin Donnachie [mailto:ben...@py...] > Sent: Wednesday, March 22, 2006 3:37 PM > To: Rarig, Harry > Cc: fai...@li... > Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report > Rarig, Harry wrote: > > Here they are guyz...knock yerselves out! ;-) > > If you are running Fedora Core 3, you can untar these directly from "/"= into the correct logwatch directory locations. > Many thanks! > I'm using the cAos distro with Logwatch 7.1 and the files needed to be > installed under /etc/logwatch. Unfortunately, it keeps failing with an > error about a file even though it exists: > # /usr/sbin/logwatch --print --service fail2ban > *** Error: There is no logfile defined. Do you have a > /etc/logwatch/conf/logfiles/fail2ban.conf file ? > # ls /etc/logwatch/conf/logfiles/fail2ban.conf > /etc/logwatch/conf/logfiles/fail2ban.conf > I should be catching up on work at the moment, so I'll look into it later. > Take care, > Ben > ------------------------------------------------------- > This SF.Net email is sponsored by xPML, a groundbreaking scripting langua= ge > that extends applications into web and mobile media. Attend the live webc= ast > and join the prime developer group breaking into this new coding territor= y! > http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=110944&bid$1720&dat=121642 > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users --=20 .-. =3D------------------------------ /v\ ----------------------------=3D Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Yaroslav H. <li...@on...> - 2006-03-22 22:28:09
|
I am sorry everyone for being silent -- didn't mention that there is such an active discussion :-) I am running Debian unstable (why anything else if there is Debian? :-))) with logwatch 7.1-2 I observed the weird logwatch behavior, as Ben reported, that even though file is present under /etc/logwatch/conf/logfiles/fail2ban.conf logwatch says that it is not there... since at the moment I was anxious to make a rule for logwatch, not to fix logwatch problems, I just installed fail2ban scripts system-wide. so there seems to be a problem with 7.1 logwatch and location of the files -- I believe they have been changing files location recently, which probably lead to discoved by both of us bug On Wed, 22 Mar 2006, Rarig, Harry wrote: > Ben, > Try > logwatch --debug Med --print --service fail2ban > or > logwatch --debug High --print --service fail2ban > and see if that helps identify the root cause of your problem. > Cheers! > From: Benjamin Donnachie [mailto:ben...@py...] > Sent: Wednesday, March 22, 2006 3:37 PM > To: Rarig, Harry > Cc: fai...@li... > Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report > Rarig, Harry wrote: > > Here they are guyz...knock yerselves out! ;-) > > If you are running Fedora Core 3, you can untar these directly from "/" into the correct logwatch directory locations. > Many thanks! > I'm using the cAos distro with Logwatch 7.1 and the files needed to be > installed under /etc/logwatch. Unfortunately, it keeps failing with an > error about a file even though it exists: > # /usr/sbin/logwatch --print --service fail2ban > *** Error: There is no logfile defined. Do you have a > /etc/logwatch/conf/logfiles/fail2ban.conf file ? > # ls /etc/logwatch/conf/logfiles/fail2ban.conf > /etc/logwatch/conf/logfiles/fail2ban.conf > I should be catching up on work at the moment, so I'll look into it later. > Take care, -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Rarig, H. <hr...@so...> - 2006-03-22 20:42:36
|
Ben, Try=20 logwatch --debug Med --print --service fail2ban or logwatch --debug High --print --service fail2ban and see if that helps identify the root cause of your problem. Cheers! -----Original Message----- From: Benjamin Donnachie [mailto:ben...@py...] Sent: Wednesday, March 22, 2006 3:37 PM To: Rarig, Harry Cc: fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report Rarig, Harry wrote: > Here they are guyz...knock yerselves out! ;-) > If you are running Fedora Core 3, you can untar these directly from = "/" into the correct logwatch directory locations. Many thanks! I'm using the cAos distro with Logwatch 7.1 and the files needed to be installed under /etc/logwatch. Unfortunately, it keeps failing with an error about a file even though it exists: # /usr/sbin/logwatch --print --service fail2ban *** Error: There is no logfile defined. Do you have a /etc/logwatch/conf/logfiles/fail2ban.conf file ? # ls /etc/logwatch/conf/logfiles/fail2ban.conf /etc/logwatch/conf/logfiles/fail2ban.conf I should be catching up on work at the moment, so I'll look into it = later. Take care, Ben |
From: Benjamin D. <ben...@py...> - 2006-03-22 20:36:54
|
Rarig, Harry wrote: > Here they are guyz...knock yerselves out! ;-) > If you are running Fedora Core 3, you can untar these directly from "/" into the correct logwatch directory locations. Many thanks! I'm using the cAos distro with Logwatch 7.1 and the files needed to be installed under /etc/logwatch. Unfortunately, it keeps failing with an error about a file even though it exists: # /usr/sbin/logwatch --print --service fail2ban *** Error: There is no logfile defined. Do you have a /etc/logwatch/conf/logfiles/fail2ban.conf file ? # ls /etc/logwatch/conf/logfiles/fail2ban.conf /etc/logwatch/conf/logfiles/fail2ban.conf I should be catching up on work at the moment, so I'll look into it later. Take care, Ben |
From: Rarig, H. <hr...@so...> - 2006-03-22 19:56:16
|
Here they are guyz...knock yerselves out! ;-) If you are running Fedora Core 3, you can untar these directly from "/" = into the correct logwatch directory locations. Cheers! Harry -----Original Message----- From: fai...@li... [mailto:fai...@li...]On Behalf Of Benjamin Donnachie Sent: Wednesday, March 22, 2006 2:10 PM To: Yaroslav Halchenko Cc: fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report Rarig, Harry wrote: > I loaded up the four logwatch files you sent me and this is what = happened. I'd quite like a copy too if I may! Take care, Ben ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting = language that extends applications into web and mobile media. Attend the live = webcast and join the prime developer group breaking into this new coding = territory! http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D110944&bid=3D241720&dat=3D= 121642 _______________________________________________ Fail2ban-users mailing list Fai...@li... https://lists.sourceforge.net/lists/listinfo/fail2ban-users |
From: Benjamin D. <ben...@py...> - 2006-03-22 19:48:26
|
Rarig, Harry wrote: > I loaded up the four logwatch files you sent me and this is what happened. I'd quite like a copy too if I may! Take care, Ben |
From: Rarig, H. <hr...@so...> - 2006-03-22 12:37:48
|
Yikes! I loaded up the four logwatch files you sent me and this is what = happened. [root@birch logwatch]# logwatch --range Today --print --service = fail2ban "dates" is not defined in %Logwatch::EXPORT_TAGS at = /etc/log.d/scripts/shared/applyeurodate line 18 main::BEGIN() called at /usr/lib/perl5/5.8.5/Carp.pm line 18 eval {...} called at /usr/lib/perl5/5.8.5/Carp.pm line 18 Can't continue after import errors at = /etc/log.d/scripts/shared/applyeurodate line 18 BEGIN failed--compilation aborted at = /etc/log.d/scripts/shared/applyeurodate line 18. [root@birch logwatch]# I am running Fedora Core 3 using logwatch-5.2.2-1.FC3.3. Based on the tar files you sent me, it appears you are running Fedora = Core 4? Harry -----Original Message----- From: fai...@li... [mailto:fai...@li...]On Behalf Of Yaroslav Halchenko Sent: Saturday, March 18, 2006 1:30 AM To: fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report Dear Rarig, Harry, Thanks once again for triggering logwatch move ;-) Here is my version based on yours (see attached). The differences are: 1. rewritten applyeurodate to be in concordance with other apply*date and use logwatch time filter regex creation facility (to faciliate such definitions like "between X and Y" =20 2. generates a summary of banned ips including the numbers (in the detailed view) after how many attempts each time it was banned... so on my laptop it looked like: --------------------- fail2ban-messages Begin ------------------------=20 Banned services with Fail2Ban: SSH: 165.230.95.72 (tractatus.rutgers.edu): 5 failures =20 ---------------------- fail2ban-messages End -------------------------=20 and on my mailbox server for yesterday it looks like --------------------- fail2ban-messages Begin ------------------------=20 Banned services with Fail2Ban: ApacheAttacks: 66.34.225.186: 2 failures SSH: 202.63.117.71 (yantra.uceou.edu): 5 7 failures =20 ---------------------- fail2ban-messages End -------------------------=20 sorry for no comma in the list of number of failures. sideeffect: different installation path for the config scripts -- I just decided to mess with system wide config so it makes it easier to provide to be included in logwatch. Also it was tested only on logwatch 7.1-2 Please let me know what you think before I submit a request to logwatch maintainer (in debian) or upstream to have those rules included to be used by everyone else NOTE: I didn't test it thouroughly yet -- thus more sideeffects possible... I am installing it on a few nodes to see how it will behave ;-) On Thu, 16 Mar 2006, Rarig, Harry wrote: > Yaroslav, > Yeah, the thought crossed my mind that maybe I ought to do a little = more than just "cat" the fail2ban.log file...;-). I certainly would = enjoy doing this sometime in the future, but right now my stack is = overflowing big time with too many other commitments! > On the other hand, my experience has been that very few robots are = attacking my site via FTP, and when they do the "magic" in vsftpd seems = to do a good job regulating the frequency of the attempts. However, = once they get past this, the 25 authentications per second dictionary = attacks that were plaguing me in the past have completely ceased now = that fail2ban is guarding the entrance to the castle! (Nice work guys!) > As far as SSH goes, I am using the iptables "recent" option to manage = that (see http://olivier.sessink.nl/publications/blacklisting/index.html = [Note: replace "extern_in" with "INPUT" and "extern-out" with = "OUTPUT"]). Using this, the banned IPs show up automatically in the = logwatch default ssh and kernel reports. > Would be interested in hearing some anecdotal reports from the field = about how many entries other subscribers to this mailing list are seeing = in their fail2ban.log files...?? =20 > Are entries in your fail2ban.log file on the order of 1 or 2, dozens, = hundreds, or more? > Cheers! > Harry > -----Original Message----- > From: fai...@li... > [mailto:fai...@li...]On Behalf Of = Yaroslav > Halchenko > Sent: Thursday, March 16, 2006 4:54 PM > To: fai...@li... > Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily = report > Dear Harry, > Thank you for logwatch scripts -- I was looking toward composing ones > myself but never got to them ;-) > Wouldn't you like to see a summary like > VSFTPD: 12 IPs baned [list of IPs may be] > SSH: 3 IPs baned [...] > Another possibility would be to include for each IP on how many times = it was banned > which would signal that bantime might be too low if you have multiple > hits for the same IP > If you have any spare moment, since you mastered logwatch already, = would > you mind writing a script to provide such statistics? > Otherwise you just might get lengthy list of WARNINGs and I really = think > that statistics would be a better presentation of relevant information --=20 .-. =3D------------------------------ /v\ ----------------------------=3D Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Benjamin D. <ben...@py...> - 2006-03-18 18:56:10
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The archives for this list mention config files to add fail2ban to logwatch reports. I'd be very grateful if someone could please send the files to me, or point me to where I can get them. Many thanks, Ben -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQIVAwUBRBw3degNmph0Y1E2AQJ4rw//ZJ+zmuZCIGfhVJiVPIc+gp4b46mn6OUq x6ohvlJBfSLv1N/wxDNC7heOQ5oQ3mUdWAciXW3/olWt3bsmIyjUdWc68ZkciJOk eyJzIm3YDJDDpvZuei7ZsOFk4/SUsY5OHQlfskewcYUa1p0qJDXc6fPQ7fqZbykF I/UI/h/YOk1n4AQwvXDwrl4FGHE0ieHTwYRnmoSnXB/hScAwfHX9Dj0nN+kL8uOL NhZk7vp5/m3/BGNtDF5nh5IELwM0eOsoxL7T+NuZ7nam/WWGIRpk4BbaGw0piRp7 G8gL9nYVI2YuHhQ73whWR20vAPnwjpIhiEbye+JwUA1rX60nZ0LbJAPVAbyuXRwq 30MB1B7qJNBZLmk+lT+dSUYj+01JGuSsKPlYahDL4XotXbubGnkWJ69xjFjN6L2J CtpbN0gniYXSUMNSVFs7jQ1Jh78kFaVTBMFnKuXkZ1IcBeeu++/1at3UBI2Lm4A1 M/RetWSwP+EHSbaqXvAAb52+2SZLznDMC4S02B0BKYXeF/iCJJLvkfsIyre1zOV9 1iXoco3KxBy7KiFE6qpZr6Eir2oEB6SXrMhZ9w8K5JhkKYDhUv7R5HnLHXJ/VnKV J542DFGoQebcyGh3RydyoRlB5Mfi+qEhjZW2OqkNmgSpwlAU0STVAfk6OrAibVNq CEF6RSaWj90= =dMkQ -----END PGP SIGNATURE----- |
From: Yaroslav H. <li...@on...> - 2006-03-18 06:30:53
|
Dear Rarig, Harry, Thanks once again for triggering logwatch move ;-) Here is my version based on yours (see attached). The differences are: 1. rewritten applyeurodate to be in concordance with other apply*date and use logwatch time filter regex creation facility (to faciliate such definitions like "between X and Y" 2. generates a summary of banned ips including the numbers (in the detailed view) after how many attempts each time it was banned... so on my laptop it looked like: --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: SSH: 165.230.95.72 (tractatus.rutgers.edu): 5 failures ---------------------- fail2ban-messages End ------------------------- and on my mailbox server for yesterday it looks like --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: ApacheAttacks: 66.34.225.186: 2 failures SSH: 202.63.117.71 (yantra.uceou.edu): 5 7 failures ---------------------- fail2ban-messages End ------------------------- sorry for no comma in the list of number of failures. sideeffect: different installation path for the config scripts -- I just decided to mess with system wide config so it makes it easier to provide to be included in logwatch. Also it was tested only on logwatch 7.1-2 Please let me know what you think before I submit a request to logwatch maintainer (in debian) or upstream to have those rules included to be used by everyone else NOTE: I didn't test it thouroughly yet -- thus more sideeffects possible... I am installing it on a few nodes to see how it will behave ;-) On Thu, 16 Mar 2006, Rarig, Harry wrote: > Yaroslav, > Yeah, the thought crossed my mind that maybe I ought to do a little more than just "cat" the fail2ban.log file...;-). I certainly would enjoy doing this sometime in the future, but right now my stack is overflowing big time with too many other commitments! > On the other hand, my experience has been that very few robots are attacking my site via FTP, and when they do the "magic" in vsftpd seems to do a good job regulating the frequency of the attempts. However, once they get past this, the 25 authentications per second dictionary attacks that were plaguing me in the past have completely ceased now that fail2ban is guarding the entrance to the castle! (Nice work guys!) > As far as SSH goes, I am using the iptables "recent" option to manage that (see http://olivier.sessink.nl/publications/blacklisting/index.html [Note: replace "extern_in" with "INPUT" and "extern-out" with "OUTPUT"]). Using this, the banned IPs show up automatically in the logwatch default ssh and kernel reports. > Would be interested in hearing some anecdotal reports from the field about how many entries other subscribers to this mailing list are seeing in their fail2ban.log files...?? > Are entries in your fail2ban.log file on the order of 1 or 2, dozens, hundreds, or more? > Cheers! > Harry > -----Original Message----- > From: fai...@li... > [mailto:fai...@li...]On Behalf Of Yaroslav > Halchenko > Sent: Thursday, March 16, 2006 4:54 PM > To: fai...@li... > Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report > Dear Harry, > Thank you for logwatch scripts -- I was looking toward composing ones > myself but never got to them ;-) > Wouldn't you like to see a summary like > VSFTPD: 12 IPs baned [list of IPs may be] > SSH: 3 IPs baned [...] > Another possibility would be to include for each IP on how many times it was banned > which would signal that bantime might be too low if you have multiple > hits for the same IP > If you have any spare moment, since you mastered logwatch already, would > you mind writing a script to provide such statistics? > Otherwise you just might get lengthy list of WARNINGs and I really think > that statistics would be a better presentation of relevant information -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Rarig, H. <hr...@so...> - 2006-03-17 20:58:55
|
I guess if my one domain gets an average of one to three "robotic" = attacks a day, then it would probably make sense that 50 domains hosted = on one server could expect to see 50 to 150 attacks a day. Sounds like we have come up with a good Internet Security "rule of = thumb"! (I just love tidy little formulas!) Harry -----Original Message----- From: fai...@li... [mailto:fai...@li...]On Behalf Of Nils Breunese (Lemonbit Internet) Sent: Friday, March 17, 2006 1:32 PM To: fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report Harry Rarig wrote: > Interesting.... > > My website is a small one that I run for our Church. Not well =20 > known or advertised, the community of interest tends to be small =20 > and localized. Consequently, the pattern I see in my logfiles is =20 > that of "robots" running through dictionary attacks on SSH and =20 > FTP. Only a few attacks a day. > > In your case, maybe you have larger community of interest, a =20 > popular server with many subscribers. Perhaps your website appears =20 > on more of the lists used by the robots for attacks. In addition, =20 > maybe some of your own subscribers are forgetting their correct =20 > usernames and passwords. Our servers are shared hosting servers, hosting around 50 domains =20 each. None of my clients have shell access via SSH, only my company =20 has access to these servers. Nils. ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting = language that extends applications into web and mobile media. Attend the live = webcast and join the prime developer group breaking into this new coding = territory! http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D110944&bid=3D241720&dat=3D= 121642 _______________________________________________ Fail2ban-users mailing list Fai...@li... https://lists.sourceforge.net/lists/listinfo/fail2ban-users |