Swatch

the active log file monitoring tool. Swatch started out as the "simple watchdog" for activly monitoring log files produced by UNIX's syslog facility. It has since been evolving into a utility that can monitor just about any type of log.

http://swatch.sourceforge.net/

Problem

Scan-Attacks on FTP-Server

Apr 13 05:25:00 mygretchen pure-ftpd: (?@88.198.15.174) [INFO] New connection from 88.198.15.174
Apr 13 05:25:00 mygretchen pure-ftpd: (?@88.198.15.174) [WARNING] Sorry, cleartext sessions are not accepted on this server. Please reconnect using SSL/TLS security mechanisms.

Solution

Monitor syslog and drop IP-Address via Shorewall (iptables)

Configuration

/etc/init.d/swatch

#! /bin/sh
### BEGIN INIT INFO
# Provides:          swatch
# Required-Start:    $local_fs $remote_fs
# Required-Stop:     $local_fs $remote_fs
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Description:       This file should be used to construct scripts to be
#                    placed in /etc/init.d.
#
#   Quick & dirty !!
#
### END INIT INFO

# Author: Jonathan Tietz
# Do NOT "set -e"

# PATH should only include /usr/* if it runs after the mountnfs.sh script
PATH=/sbin:/usr/sbin:/bin:/usr/bin
DESC="Swatch LogFile-Monitor"
NAME=swatch
DAEMON=/usr/bin/$NAME
DAEMON_ARGS="--daemon --awk-field-syntax --config-file=/etc/swatch/swatch.conf"
#--tail-args=\'--follow=name --lines=1\'
PIDFILE=/var/run/$NAME.pid
SCRIPTNAME=/etc/init.d/$NAME

# Exit if the package is not installed
[ -x "$DAEMON" ] || exit 0

# Read configuration variable file if it is present
[ -r /etc/default/$NAME ] && . /etc/default/$NAME

# Load the VERBOSE setting and other rcS variables
. /lib/init/vars.sh

# Define LSB log_* functions.
# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
. /lib/lsb/init-functions

#
# Function that starts the daemon/service
#
do_start()
{
        # Return
        #   0 if daemon has been started
        #   1 if daemon was already running
        #   2 if daemon could not be started
        #start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
        #       || return 1
        #start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \
        #       $DAEMON_ARGS \
        #       || return 2
        # Add code here, if necessary, that waits for the process to be ready
        # to handle requests from services started subsequently which depend
        # on this one.  As a last resort, sleep for some time.
        if [ ! -d ${SWATCH_SCRIPTDIR} ]; then
                mkdir ${SWATCH_SCRIPTDIR}
        fi

        swatch --script-dir=${SWATCH_SCRIPTDIR} \
                --tail-file=${SWATCH_TAILFILE} \
                --config-file=/etc/swatch/swatch.conf \
                --pid-file=/var/run/swatch.pid \
                --tail-args='--follow=name --lines=1' \
                --daemon \
                >> /var/log/swatch.log \
                2>> /var/log/swatch-err.log
}

#
# Function that stops the daemon/service
#
do_stop()
{
        # Return
        #   0 if daemon has been stopped
        #   1 if daemon was already stopped
        #   2 if daemon could not be stopped
        #   other if a failure occurred
        #start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
        kill -9 `cat /var/run/swatch.pid`
        RETVAL="$?"
        [ "$RETVAL" = 2 ] && return 2
        # Wait for children to finish too if this is a daemon that forks
        # and if the daemon is only ever run from this initscript.
        # If the above conditions are not satisfied then add some other code
        # that waits for the process to drop all resources that could be
        # needed by services started subsequently.  A last resort is to
        # sleep for some time.
        start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
        [ "$?" = 2 ] && return 2
        # Many daemons don't delete their pidfiles when they exit.
        rm -f $PIDFILE
        return "$RETVAL"
}

#
# Function that sends a SIGHUP to the daemon/service
#
do_reload() {
        #
        # If the daemon can reload its configuration without
        # restarting (for example, when it is sent a SIGHUP),
        # then implement that here.
        #
        start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
        return 0
}

case "$1" in
  start)
        [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
        do_start
        case "$?" in
                0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
                2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
        esac
        ;;
  stop)
        [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
        do_stop
        case "$?" in
                0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
                2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
        esac
        ;;
  #reload|force-reload)
        #
        # If do_reload() is not implemented then leave this commented out
        # and leave 'force-reload' as an alias for 'restart'.
        #
        #log_daemon_msg "Reloading $DESC" "$NAME"
        #do_reload
        #log_end_msg $?
        #;;
  restart|force-reload)
        #
        # If the "reload" option is implemented then remove the
        # 'force-reload' alias
        #
        log_daemon_msg "Restarting $DESC" "$NAME"
        do_stop
        case "$?" in
          0|1)
                do_start
                case "$?" in
                        0) log_end_msg 0 ;;
                        1) log_end_msg 1 ;; # Old process is still running
                        *) log_end_msg 1 ;; # Failed to start
                esac
                ;;
          *)
                # Failed to stop
                log_end_msg 1
                ;;
        esac
        ;;
  *)
        #echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
        echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2
        exit 3
        ;;
esac

:

/etc/swatch/swatch.conf

in a time frame of 20 sec. (seconds) if we have 20 matches (count) of "watchfor" do the action (exec), then ignore (type)

# Global swatch filter file

# Invalid FTP Login Attempts
#Apr  5 01:12:58 mygretchen pure-ftpd: (?@217.229.137.69) [WARNING] Sorry, cleartext sessions are not accepted on this server. Please reconnect using SSL/TLS security mechanisms.
watchfor /(.*)pure-ftpd: (.*)\@(.*)\)( \[WARNING\] Sorry, cleartext sessions are not accepted)(.*)/
        threshold track_by=$3,type=both,count=20,seconds=20
        mail=sadmin@mygretchen.de,subject="FTP:\ Invalid\ User\ Access-IPTables\ Rule\ Added"
        exec "/etc/swatch/scripts/shorewall.sh $3"
        #exec echo $3 >> /var/log/swatch_ftp.log

/etc/swatch/scripts/shorewall.sh

#pure-ftp logs only IPs, no dns
#IP=`host $1|awk {'print $3'}`
IP=$1

if [ "x$IP" != "x" ]; then
        /sbin/shorewall drop $IP
        mail sadmin -s shorewall<<END
$IP was dropped
END
else
        mail sadmin -s shorewall<<END
Problem to drop $1: $IP
END
fi

Links

http://gentoo-wiki.com/HOWTO_Protect_SSHD_with_Swatch