Swatch: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
K (update conf) |
K (typo) |
||
(8 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) | |||
Zeile 4: | Zeile 4: | ||
=Problem= | =Problem= | ||
Scan-Attacks on FTP-Server | Scan-Attacks on FTP-Server, about 800 tries in 4sec. | ||
<pre> | <pre> | ||
Apr 13 05:25:00 mygretchen pure-ftpd: (?@88.198.15.174) [INFO] New connection from 88.198.15.174 | Apr 13 05:25:00 mygretchen pure-ftpd: (?@88.198.15.174) [INFO] New connection from 88.198.15.174 | ||
Apr 13 05:25:00 mygretchen pure-ftpd: (?@88.198.15.174) [WARNING] Sorry, cleartext sessions are not accepted on this server. Please reconnect using SSL/TLS security mechanisms. | Apr 13 05:25:00 mygretchen pure-ftpd: (?@88.198.15.174) [WARNING] Sorry, cleartext sessions are not accepted on this server. Please reconnect using SSL/TLS security mechanisms. | ||
</pre> | </pre><br/> | ||
=Solution= | =Solution= | ||
Zeile 14: | Zeile 14: | ||
=Configuration= | =Configuration= | ||
==/etc/defaults/swatch== | |||
<source lang="bash"> | |||
# Config file for /etc/init.d/swatch | |||
# Place where swatch will generate his temporary scripts | |||
SWATCH_SCRIPTDIR=/var/tmp/swatch | |||
# Tail arguments, not needed anymore as they are default | |||
#SWATCH_TAILARGS='--follow=name --lines=1' | |||
#file to monitor | |||
SWATCH_TAILFILE=/var/log/syslog | |||
#args | |||
DAEMON_ARGS="--daemon --config-file=/etc/swatch/swatch.conf --script-dir=${SWATCH_SCRIPTDIR} --tail-file=${SWATCH_TAILFILE}" | |||
#does not really work | |||
# --tail-args=\"${SWATCH_TAILARGS}\"" | |||
</source> | |||
==/etc/init.d/swatch== | ==/etc/init.d/swatch== | ||
<source lang="bash"> | <source lang="bash"> | ||
Zeile 29: | Zeile 48: | ||
# Author: Jonathan Tietz | # Author: Jonathan Tietz | ||
# Do NOT "set -e" | # Do NOT "set -e" | ||
Zeile 40: | Zeile 55: | ||
NAME=swatch | NAME=swatch | ||
DAEMON=/usr/bin/$NAME | DAEMON=/usr/bin/$NAME | ||
DAEMON_ARGS="--daemon | #not used, see /etc/defaults/swatch | ||
#DAEMON_ARGS="--daemon --config-file=/etc/swatch/swatch.conf" | |||
PIDFILE=/var/run/$NAME.pid | PIDFILE=/var/run/$NAME.pid | ||
SCRIPTNAME=/etc/init.d/$NAME | SCRIPTNAME=/etc/init.d/$NAME | ||
Zeile 63: | Zeile 78: | ||
do_start() | do_start() | ||
{ | { | ||
# Return | # Return | ||
# 0 if daemon has been started | # 0 if daemon has been started | ||
# 1 if daemon was already running | # 1 if daemon was already running | ||
# 2 if daemon could not be started | # 2 if daemon could not be started | ||
# | |||
# | # create tmpdir for monitor-script | ||
#start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \ | # Place where swatch will generate his temporary scripts | ||
if [ ! -d ${SWATCH_SCRIPTDIR} ]; then | |||
# || return | mkdir ${SWATCH_SCRIPTDIR} | ||
fi | |||
#add pidfile to swatch-ARGS | |||
DAEMON_ARGS="${DAEMON_ARGS} --pid-file=$PIDFILE" | |||
#does not work | |||
#start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \ | |||
# || return 1 | |||
#would work, but not good | |||
-- | #start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \ | ||
-- | # $DAEMON_ARGS \ | ||
-- | # || return 2 | ||
-- | # Add code here, if necessary, that waits for the process to be ready | ||
# to handle requests from services started subsequently which depend | |||
# on this one. As a last resort, sleep for some time. | |||
# | |||
# | |||
$DAEMON ${DAEMON_ARGS}\ | |||
>> /var/log/swatch.log \ | |||
2>> /var/log/swatch-err.log | |||
} | } | ||
Zeile 97: | Zeile 114: | ||
do_stop() | do_stop() | ||
{ | { | ||
# Return | # Return | ||
# 0 if daemon has been stopped | # 0 if daemon has been stopped | ||
# 1 if daemon was already stopped | # 1 if daemon was already stopped | ||
# 2 if daemon could not be stopped | # 2 if daemon could not be stopped | ||
# other if a failure occurred | # other if a failure occurred | ||
#start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME | #does not work | ||
kill -9 `cat /var/run/swatch.pid` | #start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME | ||
RETVAL="$?" | kill -9 `cat /var/run/swatch.pid` | ||
[ "$RETVAL" = 2 ] && return 2 | |||
# Wait for children to finish too if this is a daemon that forks | #kill tail | ||
# and if the daemon is only ever run from this initscript. | kill `ps fax|grep tail|grep ${SWATCH_TAILFILE}|awk {'print $1'}` | ||
# If the above conditions are not satisfied then add some other code | |||
# that waits for the process to drop all resources that could be | RETVAL="$?" | ||
# needed by services started subsequently. A last resort is to | [ "$RETVAL" = 2 ] && return 2 | ||
# sleep for some time. | # Wait for children to finish too if this is a daemon that forks | ||
start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON | # and if the daemon is only ever run from this initscript. | ||
[ "$?" = 2 ] && return 2 | # If the above conditions are not satisfied then add some other code | ||
# Many daemons don't delete their pidfiles when they exit. | # that waits for the process to drop all resources that could be | ||
rm -f $PIDFILE | # needed by services started subsequently. A last resort is to | ||
return "$RETVAL" | # sleep for some time. | ||
#start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON | |||
[ "$?" = 2 ] && return 2 | |||
# Many daemons don't delete their pidfiles when they exit. | |||
rm -f $PIDFILE | |||
return "$RETVAL" | |||
} | } | ||
Zeile 123: | Zeile 145: | ||
# | # | ||
do_reload() { | do_reload() { | ||
# | # | ||
# If the daemon can reload its configuration without | # If the daemon can reload its configuration without | ||
# restarting (for example, when it is sent a SIGHUP), | # restarting (for example, when it is sent a SIGHUP), | ||
# then implement that here. | # then implement that here. | ||
# | # | ||
start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME | start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME | ||
return 0 | return 0 | ||
} | } | ||
case "$1" in | case "$1" in | ||
start) | start) | ||
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" | [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" | ||
do_start | do_start | ||
case "$?" in | case "$?" in | ||
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; | 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; | ||
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; | 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; | ||
esac | esac | ||
;; | ;; | ||
stop) | stop) | ||
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME" | [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME" | ||
do_stop | do_stop | ||
case "$?" in | case "$?" in | ||
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; | 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; | ||
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; | 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; | ||
esac | esac | ||
;; | ;; | ||
#reload|force-reload) | #reload|force-reload) | ||
# | # | ||
# If do_reload() is not implemented then leave this commented out | # If do_reload() is not implemented then leave this commented out | ||
# and leave 'force-reload' as an alias for 'restart'. | # and leave 'force-reload' as an alias for 'restart'. | ||
# | # | ||
#log_daemon_msg "Reloading $DESC" "$NAME" | #log_daemon_msg "Reloading $DESC" "$NAME" | ||
#do_reload | #do_reload | ||
#log_end_msg $? | #log_end_msg $? | ||
#;; | #;; | ||
restart|force-reload) | restart|force-reload) | ||
# | # | ||
# If the "reload" option is implemented then remove the | # If the "reload" option is implemented then remove the | ||
# 'force-reload' alias | # 'force-reload' alias | ||
# | # | ||
log_daemon_msg "Restarting $DESC" "$NAME" | log_daemon_msg "Restarting $DESC" "$NAME" | ||
do_stop | do_stop | ||
case "$?" in | case "$?" in | ||
0|1) | 0|1) | ||
do_start | do_start | ||
case "$?" in | case "$?" in | ||
0) log_end_msg 0 ;; | 0) log_end_msg 0 ;; | ||
1) log_end_msg 1 ;; # Old process is still running | 1) log_end_msg 1 ;; # Old process is still running | ||
*) log_end_msg 1 ;; # Failed to start | *) log_end_msg 1 ;; # Failed to start | ||
esac | esac | ||
;; | ;; | ||
*) | *) | ||
# Failed to stop | # Failed to stop | ||
log_end_msg 1 | log_end_msg 1 | ||
;; | ;; | ||
esac | esac | ||
;; | ;; | ||
*) | *) | ||
#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2 | #echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2 | ||
echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2 | echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2 | ||
exit 3 | exit 3 | ||
;; | ;; | ||
esac | esac | ||
Zeile 191: | Zeile 213: | ||
==/etc/swatch/swatch.conf== | ==/etc/swatch/swatch.conf== | ||
in a time frame of 20 sec. (seconds) if we have 20 matches (count) of "watchfor" do the action (exec), then ignore (type) | |||
<source lang="bash"> | <source lang="bash"> | ||
# Global swatch filter file | # Global swatch filter file | ||
# Invalid FTP Login Attempts | # Invalid FTP Login Attempts | ||
Zeile 199: | Zeile 222: | ||
watchfor /(.*)pure-ftpd: (.*)\@(.*)\)( \[WARNING\] Sorry, cleartext sessions are not accepted)(.*)/ | watchfor /(.*)pure-ftpd: (.*)\@(.*)\)( \[WARNING\] Sorry, cleartext sessions are not accepted)(.*)/ | ||
threshold track_by=$3,type=both,count=20,seconds=20 | threshold track_by=$3,type=both,count=20,seconds=20 | ||
mail= | mail=root@domain.tld,subject="FTP:\ Invalid\ User\ Access-IPTables\ Rule\ Added" | ||
exec "/etc/swatch/scripts/shorewall.sh $3" | exec "/etc/swatch/scripts/shorewall.sh $3" | ||
#exec echo $3 >> /var/log/swatch_ftp.log | #exec echo $3 >> /var/log/swatch_ftp.log | ||
Zeile 206: | Zeile 229: | ||
==/etc/swatch/scripts/shorewall.sh== | ==/etc/swatch/scripts/shorewall.sh== | ||
<source lang="bash"> | <source lang="bash"> | ||
# | #pure-ftp logs only IPs, no dns | ||
IP=`host $1|awk {'print $3'}` | #IP=`host $1|awk {'print $3'}` | ||
IP=$1 | |||
if [ "x$IP" != "x" ]; then | if [ "x$IP" != "x" ]; then | ||
/sbin/shorewall drop $IP | /sbin/shorewall drop $IP | ||
mail sadmin -s shorewall<<END | mail sadmin -s shorewall<<END | ||
$IP was dropped | $IP was dropped | ||
END | END | ||
else | else | ||
mail sadmin -s shorewall<<END | |||
mail sadmin -s shorewall<<END | |||
Problem to drop $1: $IP | Problem to drop $1: $IP | ||
END | END | ||
fi | fi | ||
</source> | </source> | ||
<br/> | |||
=Links= | =Links= |
Aktuelle Version vom 22. April 2008, 23:12 Uhr
the active log file monitoring tool. Swatch started out as the "simple watchdog" for activly monitoring log files produced by UNIX's syslog facility. It has since been evolving into a utility that can monitor just about any type of log.
http://swatch.sourceforge.net/
Problem
Scan-Attacks on FTP-Server, about 800 tries in 4sec.
Apr 13 05:25:00 mygretchen pure-ftpd: (?@88.198.15.174) [INFO] New connection from 88.198.15.174 Apr 13 05:25:00 mygretchen pure-ftpd: (?@88.198.15.174) [WARNING] Sorry, cleartext sessions are not accepted on this server. Please reconnect using SSL/TLS security mechanisms.
Solution
Monitor syslog and drop IP-Address via Shorewall (iptables)
Configuration
/etc/defaults/swatch
# Config file for /etc/init.d/swatch
# Place where swatch will generate his temporary scripts
SWATCH_SCRIPTDIR=/var/tmp/swatch
# Tail arguments, not needed anymore as they are default
#SWATCH_TAILARGS='--follow=name --lines=1'
#file to monitor
SWATCH_TAILFILE=/var/log/syslog
#args
DAEMON_ARGS="--daemon --config-file=/etc/swatch/swatch.conf --script-dir=${SWATCH_SCRIPTDIR} --tail-file=${SWATCH_TAILFILE}"
#does not really work
# --tail-args=\"${SWATCH_TAILARGS}\""
/etc/init.d/swatch
#! /bin/sh
### BEGIN INIT INFO
# Provides: skeleton
# Required-Start: $local_fs $remote_fs
# Required-Stop: $local_fs $remote_fs
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Example initscript
# Description: This file should be used to construct scripts to be
# placed in /etc/init.d.
### END INIT INFO
# Author: Jonathan Tietz
# Do NOT "set -e"
# PATH should only include /usr/* if it runs after the mountnfs.sh script
PATH=/sbin:/usr/sbin:/bin:/usr/bin
DESC="Swatch LogFile-Monitor"
NAME=swatch
DAEMON=/usr/bin/$NAME
#not used, see /etc/defaults/swatch
#DAEMON_ARGS="--daemon --config-file=/etc/swatch/swatch.conf"
PIDFILE=/var/run/$NAME.pid
SCRIPTNAME=/etc/init.d/$NAME
# Exit if the package is not installed
[ -x "$DAEMON" ] || exit 0
# Read configuration variable file if it is present
[ -r /etc/default/$NAME ] && . /etc/default/$NAME
# Load the VERBOSE setting and other rcS variables
. /lib/init/vars.sh
# Define LSB log_* functions.
# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
. /lib/lsb/init-functions
#
# Function that starts the daemon/service
#
do_start()
{
# Return
# 0 if daemon has been started
# 1 if daemon was already running
# 2 if daemon could not be started
# create tmpdir for monitor-script
# Place where swatch will generate his temporary scripts
if [ ! -d ${SWATCH_SCRIPTDIR} ]; then
mkdir ${SWATCH_SCRIPTDIR}
fi
#add pidfile to swatch-ARGS
DAEMON_ARGS="${DAEMON_ARGS} --pid-file=$PIDFILE"
#does not work
#start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
# || return 1
#would work, but not good
#start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \
# $DAEMON_ARGS \
# || return 2
# Add code here, if necessary, that waits for the process to be ready
# to handle requests from services started subsequently which depend
# on this one. As a last resort, sleep for some time.
$DAEMON ${DAEMON_ARGS}\
>> /var/log/swatch.log \
2>> /var/log/swatch-err.log
}
#
# Function that stops the daemon/service
#
do_stop()
{
# Return
# 0 if daemon has been stopped
# 1 if daemon was already stopped
# 2 if daemon could not be stopped
# other if a failure occurred
#does not work
#start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
kill -9 `cat /var/run/swatch.pid`
#kill tail
kill `ps fax|grep tail|grep ${SWATCH_TAILFILE}|awk {'print $1'}`
RETVAL="$?"
[ "$RETVAL" = 2 ] && return 2
# Wait for children to finish too if this is a daemon that forks
# and if the daemon is only ever run from this initscript.
# If the above conditions are not satisfied then add some other code
# that waits for the process to drop all resources that could be
# needed by services started subsequently. A last resort is to
# sleep for some time.
#start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
[ "$?" = 2 ] && return 2
# Many daemons don't delete their pidfiles when they exit.
rm -f $PIDFILE
return "$RETVAL"
}
#
# Function that sends a SIGHUP to the daemon/service
#
do_reload() {
#
# If the daemon can reload its configuration without
# restarting (for example, when it is sent a SIGHUP),
# then implement that here.
#
start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
return 0
}
case "$1" in
start)
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
do_start
case "$?" in
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
esac
;;
stop)
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
do_stop
case "$?" in
0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
esac
;;
#reload|force-reload)
#
# If do_reload() is not implemented then leave this commented out
# and leave 'force-reload' as an alias for 'restart'.
#
#log_daemon_msg "Reloading $DESC" "$NAME"
#do_reload
#log_end_msg $?
#;;
restart|force-reload)
#
# If the "reload" option is implemented then remove the
# 'force-reload' alias
#
log_daemon_msg "Restarting $DESC" "$NAME"
do_stop
case "$?" in
0|1)
do_start
case "$?" in
0) log_end_msg 0 ;;
1) log_end_msg 1 ;; # Old process is still running
*) log_end_msg 1 ;; # Failed to start
esac
;;
*)
# Failed to stop
log_end_msg 1
;;
esac
;;
*)
#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2
exit 3
;;
esac
:
/etc/swatch/swatch.conf
in a time frame of 20 sec. (seconds) if we have 20 matches (count) of "watchfor" do the action (exec), then ignore (type)
# Global swatch filter file
# Invalid FTP Login Attempts
#Apr 5 01:12:58 mygretchen pure-ftpd: (?@217.229.137.69) [WARNING] Sorry, cleartext sessions are not accepted on this server. Please reconnect using SSL/TLS security mechanisms.
watchfor /(.*)pure-ftpd: (.*)\@(.*)\)( \[WARNING\] Sorry, cleartext sessions are not accepted)(.*)/
threshold track_by=$3,type=both,count=20,seconds=20
mail=root@domain.tld,subject="FTP:\ Invalid\ User\ Access-IPTables\ Rule\ Added"
exec "/etc/swatch/scripts/shorewall.sh $3"
#exec echo $3 >> /var/log/swatch_ftp.log
/etc/swatch/scripts/shorewall.sh
#pure-ftp logs only IPs, no dns
#IP=`host $1|awk {'print $3'}`
IP=$1
if [ "x$IP" != "x" ]; then
/sbin/shorewall drop $IP
mail sadmin -s shorewall<<END
$IP was dropped
END
else
mail sadmin -s shorewall<<END
Problem to drop $1: $IP
END
fi