[Fail2ban-users] Add fail2ban to your logwatch daily report

[Rarig, H. <hr...@so...>]

For those of you that use logwatch to generate daily reports of =
suspicious activity on your system, the following may be of interest...

In the attached tarball are four logwatch configuration and script files =
that I created for adding fail2ban to the standard logwatch summary =
report that is emailed to me by my server every morning.  Install these =
four files in the logwatch directories below (these are the locations on =
Fedora) and you will get a daily summary of the results posted to the =
fail2ban logfile /var/log/fail2ban.log.

Below are the four files contained in the tarball:

/etc/log.d/conf/logfiles/fail2ban.conf
/etc/log.d/conf/services/fail2ban.conf
/etc/log.d/scripts/services/fail2ban
/etc/log.d/scripts/shared/applyeurodate

After you install them, verify they are working correctly by attempting =
to log into your ftp server from a remote location four or more times =
using an invalid password.  Then run the following command to confirm =
the logwatch fail2ban service is working correctly:

[root@birch ~]# logwatch --range Today  --print --service fail2ban

 ################### LogWatch 5.2.2 (06/23/04) ####################
       Processing Initiated: Thu Mar 16 08:28:19 2006
       Date Range Processed: today
     Detail Level of Output: 0
          Logfiles for Host: birch.foobar.net
 ################################################################

 --------------------- fail2ban-messages Begin ------------------------

2006-03-16 08:00:30,273 WARNING: VSFTPD: Ban (600 s) 72.9.XXX.XXX
2006-03-16 08:10:30,310 WARNING: VSFTPD: Unban 72.9.XXX.XXX

 ---------------------- fail2ban-messages End -------------------------


 ###################### LogWatch End #########################

[root@birch ~]#


Cheers!

Harry Rarig