Name

syslog2iptables.conf — configuration file for syslog2iptables

Synopsis

syslog2iptables.conf

Description

The syslog2iptables.conf configuration file is specified by this partial bnf description. The entire config file is case sensitive. All the keywords are lower case.

CONFIG    := {THRESHOLD | ADD-CMD | REM-CMD | IGNORE | FILE}+
THRESHOLD := "threshold" THRESHOLD-INTEGER-VALUE ";"
ADD-CMD   := "add_command" IPT-CMD ";"
REM-CMD   := "remove_command" IPT-CMD ";"
IGNORE    := "ignore" "{" IG-SINGLE+ "};"
IG-SINGLE := IP-ADDRESS "/" CIDR-BITS ";"
FILE      := "file" FILENAME "{" PATTERN+ "};"
PATTERN   := "pattern" REGULAR-EXPRESSION "{" {INDEX | BUCKET | MESSAGE}+ "};"
INDEX     := "index" REGEX-INTEGER-VALUE ";"
BUCKET    := "bucket" BUCKET-ADD-INTEGER-VALUE ";"
MESSAGE   := "message" REASON ";"
REASON    := string to appear in syslog messages
IPT-CMD   := string containing exactly one %s replacement token for
             the ip address

Sample

threshold 550;

add_command    "/sbin/iptables -I INPUT --src %s --jump DROP";
remove_command "/sbin/iptables -D INPUT --src %s --jump DROP";

ignore {
    127.0.0.0/8;        // localhost
};

file "/var/log/cisco.log" {
    pattern "Internet_Firewall denied (tcp|udp) ([^(]*)" {
        index 2;    // zero based
        bucket 200;
        message "cisco firewall blocked packet";
    };
};

file "/var/log/secure" {
    pattern "sshd.*Failed password .* from ::ffff:(.*) port" {
        index 1;    // zero based
        bucket 400;
        message "ssh failed password";
    };
    pattern "sshd.*Failed password .* from (.*) port" {
        index 1;    // zero based
        bucket 400;
        message "ssh failed password";
    };
};

file "/var/log/httpd/access_log" {
    pattern "(.*) - - .* /cgi-bin" {
        index 1;    // zero based
        bucket 400;
        message "apache cgi-bin reference";
    };
    pattern "(.*) - - .*/index2.php" {
        index 1;    // zero based
        bucket 400;
        message "apache index2.php reference";
    };
    pattern "(.*) - - .*/main.php" {
        index 1;    // zero based
        bucket 400;
        message "apache main.php reference";
    };
};

file "/var/log/maillog" {
    pattern "lost input channel from .* \[(.*)\] .* after mail" {
        index 1;    // zero based
        bucket 200;
        message "sendmail spammer dropping connection";
    };
};

file "/var/log/messages" {
    pattern "sshd.pam_unix.*authentication failure.*rhost=(.*) user=" {
        index 1;    // zero based
        bucket 300;
        message "ssh failed password";
    };
    pattern "sshd.pam_unix.*authentication failure.*rhost=(.*)$" {
        index 1;    // zero based
        bucket 300;
        message "ssh failed password";
    };
};

CVS Version

$Id: syslog2iptables.in,v 1.11 2007/09/18 16:54:22 carl Exp $