From: Rarig, H. <hr...@so...> - 2006-03-16 13:47:28
|
For those of you that use logwatch to generate daily reports of = suspicious activity on your system, the following may be of interest... In the attached tarball are four logwatch configuration and script files = that I created for adding fail2ban to the standard logwatch summary = report that is emailed to me by my server every morning. Install these = four files in the logwatch directories below (these are the locations on = Fedora) and you will get a daily summary of the results posted to the = fail2ban logfile /var/log/fail2ban.log. Below are the four files contained in the tarball: /etc/log.d/conf/logfiles/fail2ban.conf /etc/log.d/conf/services/fail2ban.conf /etc/log.d/scripts/services/fail2ban /etc/log.d/scripts/shared/applyeurodate After you install them, verify they are working correctly by attempting = to log into your ftp server from a remote location four or more times = using an invalid password. Then run the following command to confirm = the logwatch fail2ban service is working correctly: [root@birch ~]# logwatch --range Today --print --service fail2ban ################### LogWatch 5.2.2 (06/23/04) #################### Processing Initiated: Thu Mar 16 08:28:19 2006 Date Range Processed: today Detail Level of Output: 0 Logfiles for Host: birch.foobar.net ################################################################ --------------------- fail2ban-messages Begin ------------------------ 2006-03-16 08:00:30,273 WARNING: VSFTPD: Ban (600 s) 72.9.XXX.XXX 2006-03-16 08:10:30,310 WARNING: VSFTPD: Unban 72.9.XXX.XXX ---------------------- fail2ban-messages End ------------------------- ###################### LogWatch End ######################### [root@birch ~]# Cheers! Harry Rarig |