Name

syslog2iptables.conf — configuration file for syslog2iptables

Synopsis

syslog2iptables.conf

Description

The syslog2iptables.conf configuration file is specified by this partial bnf description. The entire config file is case sensitive. All the keywords are lower case.

CONFIG     = {CONTEXT ";"}+
CONTEXT    = "context" NAME "{" {STATEMENT}+ "}"
STATEMENT := (THRESHOLD | ADD-CMD | REM-CMD | IGNORE | FILE) ";"
THRESHOLD := "threshold" THRESHOLD-INTEGER-VALUE
ADD-CMD   := "add_command" IPT-CMD
REM-CMD   := "remove_command" IPT-CMD
IGNORE    := "ignore" "{" IG-SINGLE+ "}"
IG-SINGLE := IP-ADDRESS "/" CIDR-BITS
FILE      := "file" FILENAME "{" PATTERN+ "}"
PATTERN   := "pattern" REGULAR-EXPRESSION "{" {INDEX | BUCKET | MESSAGE}+ "};"
INDEX     := "index" REGEX-INTEGER-VALUE ";"
BUCKET    := "bucket" BUCKET-ADD-INTEGER-VALUE ";"
MESSAGE   := "message" REASON ";"
REASON    := string to appear in syslog messages
IPT-CMD   := string containing exactly one %s replacement token for
             the ip address

Sample

context dns {
    threshold 1100;

    add_command    "/sbin/iptables -I INPUT --protocol udp --destination-port 53 --src %s --jump DROP";
    remove_command "/sbin/iptables -D INPUT --protocol udp --destination-port 53 --src %s --jump DROP";

    ignore {
        127.0.0.0/8;        // localhost
    };

    file "/var/log/messages" {
        pattern "named.*client (.*)#.*query.*cache.*denied" {
            index 1;    // zero based
            bucket 400;
            message "DNS attack";
        };
    };
};


context general {
    threshold 550;

    add_command    "/sbin/iptables -I INPUT --src %s --jump DROP";
    remove_command "/sbin/iptables -D INPUT --src %s --jump DROP";

    ignore {
        127.0.0.0/8;        // localhost
    };

    file "/var/log/secure" {
        pattern "sshd.*Failed password .* from ::ffff:(.*) port" {
            index 1;    // zero based
            bucket 400;
            message "ssh failed password";
        };
        pattern "sshd.*Failed password .* from (.*) port" {
            index 1;    // zero based
            bucket 400;
            message "ssh failed password";
        };
        pattern "proftpd.*no such user found from (.*) \[" {
            index 1;    // zero based
            bucket 400;
            message "ftp failed password";
        };
    };

    file "/var/log/messages" {
        pattern "ipop3d.* Login failed .* \[(.*)\]" {
            index 1;    // zero based
            bucket 400;
            message "pop3 failed password";
        };
    };

    file "/var/log/httpd/access_log" {
        // of course you cannot use this if you actually use cgi-bin directories
        pattern "(.*) - - .* /cgi-bin" {
            index 1;    // zero based
            bucket 400;
            message "apache cgi-bin reference";
        };
        // or if you actually have an index2.php script
        pattern "(.*) - - .*/index2.php" {
            index 1;    // zero based
            bucket 400;
            message "apache index2.php reference";
        };
        // or if you have a main.php script
        pattern "(.*) - - .*/main.php" {
            index 1;    // zero based
            bucket 400;
            message "apache main.php reference";
        };
        pattern "(.*) - - .*/awstats.pl" {
            index 1;    // zero based
            bucket 400;
            message "apache awstats.pl reference";
        };
        pattern "(.*) - - .*/adxmlrpc" {
            index 1;    // zero based
            bucket 400;
            message "apache adxmlrpc reference";
        };
    };

    file "/var/log/maillog" {
        pattern "lost input channel from .* \[(.*)\] .* after (mail|rcpt|auth)" {
            index 1;    // zero based
            bucket 200;
            message "sendmail spammer dropping connection";
        };
        pattern " \[(.*)\]: possible SMTP attack" {
            index 1;    // zero based
            bucket 600;
            message "sendmail authentication attack";
        };
        pattern "rejecting commands from .* \[(.*)\] due to pre-greeting traffic" {
            index 1;    // zero based
            bucket 200;
            message "sendmail pre-greeting";
        };
        pattern "dovecot.*Aborted login.*rip=(.*)," {
            index 1;    // zero based
            bucket 100;
            message "dovecot failed password";
        };
        pattern "dovecot: pop3-login: Disconnected: Shutting down.*rip=(.*)," {
            index 1;    // zero based
            bucket 100;
            message "dovecot failed password";
        };

        // make sure your upstream MX servers are listed in the
        // ignore block above, otherwise you will kill them off
        // when they try to forward such mail to you.
        pattern "sendmail.*from=<>,.*nrcpts=0,.*\[(.*)\]" {
            index 1;    // zero based
            bucket 200;
            message "sendmail rejected bounce";
        };
    };
};

Version

1.13