Name

syslog2iptables.conf — configuration file for syslog2iptables

Synopsis

syslog2iptables.conf

Description

The syslog2iptables.conf configuration file is specified by this partial bnf description. The entire config file is case sensitive. All the keywords are lower case.

CONFIG    := {THRESHOLD | ADD-CMD | REM-CMD | IGNORE | FILE}+
THRESHOLD := "threshold" THRESHOLD-INTEGER-VALUE ";"
ADD-CMD   := "add_command" IPT-CMD ";"
REM-CMD   := "remove_command" IPT-CMD ";"
IGNORE    := "ignore" "{" IG-SINGLE+ "};"
IG-SINGLE := IP-ADDRESS "/" CIDR-BITS ";"
FILE      := "file" FILENAME "{" PATTERN+ "};"
PATTERN   := "pattern" REGULAR-EXPRESSION "{" {INDEX | BUCKET}+ "};"
INDEX     := "index" REGEX-INTEGER-VALUE ";"
BUCKET    := "bucket" BUCKET-ADD-INTEGER-VALUE ";"
IPT-CMD   := string containing exactly one %s replacement token for
             the ip address

Sample

threshold 550;

add_command    "/sbin/iptables -I INPUT --src %s --jump DROP";
remove_command "/sbin/iptables -D INPUT --src %s --jump DROP";

ignore {
    127.0.0.0/8;        // localhost
};

file "/var/log/cisco.log" {
    pattern "Internet_Firewall denied (tcp|udp) ([^(]*)" {
        index 2;    // zero based
        bucket 200;
    };
};

file "/var/log/secure" {
    pattern "sshd.*Failed password .* from ::ffff:(.*) port" {
        index 1;    // zero based
        bucket 400;
    };
    pattern "sshd.*Failed password .* from (.*) port" {
        index 1;    // zero based
        bucket 400;
    };
};

CVS Version

$Id: syslog2iptables.in,v 1.10 2007/09/09 17:59:16 carl Exp $