The syslog2iptables.conf configuration file is specified by this partial bnf description. The entire config file is case sensitive. All the keywords are lower case.
CONFIG := {THRESHOLD | ADD-CMD | REM-CMD | IGNORE | FILE}+ THRESHOLD := "threshold" THRESHOLD-INTEGER-VALUE ";" ADD-CMD := "add_command" IPT-CMD ";" REM-CMD := "remove_command" IPT-CMD ";" IGNORE := "ignore" "{" IG-SINGLE+ "};" IG-SINGLE := IP-ADDRESS "/" CIDR-BITS ";" FILE := "file" FILENAME "{" PATTERN+ "};" PATTERN := "pattern" REGULAR-EXPRESSION "{" {INDEX | BUCKET | MESSAGE}+ "};" INDEX := "index" REGEX-INTEGER-VALUE ";" BUCKET := "bucket" BUCKET-ADD-INTEGER-VALUE ";" MESSAGE := "message" REASON ";" REASON := string to appear in syslog messages IPT-CMD := string containing exactly one %s replacement token for the ip address
threshold 550; add_command "/sbin/iptables -I INPUT --src %s --jump DROP"; remove_command "/sbin/iptables -D INPUT --src %s --jump DROP"; ignore { 127.0.0.0/8; // localhost }; file "/var/log/cisco.log" { pattern "Internet_Firewall denied (tcp|udp) ([^(]*)" { index 2; // zero based bucket 200; message "cisco firewall blocked packet"; }; }; file "/var/log/secure" { pattern "sshd.*Failed password .* from ::ffff:(.*) port" { index 1; // zero based bucket 400; message "ssh failed password"; }; pattern "sshd.*Failed password .* from (.*) port" { index 1; // zero based bucket 400; message "ssh failed password"; }; }; file "/var/log/httpd/access_log" { pattern "(.*) - - .* /cgi-bin" { index 1; // zero based bucket 400; message "apache cgi-bin reference"; }; pattern "(.*) - - .*/index2.php" { index 1; // zero based bucket 400; message "apache index2.php reference"; }; pattern "(.*) - - .*/main.php" { index 1; // zero based bucket 400; message "apache main.php reference"; }; }; file "/var/log/maillog" { pattern "lost input channel from .* \[(.*)\] .* after mail" { index 1; // zero based bucket 200; message "sendmail spammer dropping connection"; }; }; file "/var/log/messages" { pattern "sshd.pam_unix.*authentication failure.*rhost=(.*) user=" { index 1; // zero based bucket 300; message "ssh failed password"; }; pattern "sshd.pam_unix.*authentication failure.*rhost=(.*)$" { index 1; // zero based bucket 300; message "ssh failed password"; }; };