stunnel filter
Jonas Marczona <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <CAJyZDLjX3mhj4G=KZp-ss68t8MV-iRpMiEtLs+uUMvLfROBuwA@mail.gmail.com> |
Hello, we use stunnel 4.15 on CentOs 5.7. Yes its old, but this is what we get from the CentOs repos. This traffic is behind a firewall - so medium security acceptable for us. *Format mismatch* Sadly the output from stunnel is not matched from the logwatch filter. Example output (hostname and ips anonymized): Dec 29 12:35:09 hostname stunnel: LOG3[2411:3086588816]: SSL_read: Connection reset by peer (104) Dec 30 20:22:37 hostname stunnel: LOG5[2411:3084352400]: Connection closed: 829 bytes sent to SSL, 403 bytes sent to socket Dec 31 08:31:52 hostname stunnel: LOG5[2411:3084143504]: Connection reset: 7571653 bytes sent to SSL, 80209 bytes sent to socket Dec 31 11:43:27 hostname stunnel: LOG5[2411:3084143504]: uals connected from xx.xx.xx.111:49254 Dec 31 11:44:00 hostname stunnel: LOG5[2411:3084352400]: uals connected from xx.xx.xx.111:49261 Dec 31 11:45:08 hostname stunnel: LOG5[2411:3084352400]: Connection closed: 829 bytes sent to SSL, 403 bytes sent to socket Dec 31 11:56:59 hostname stunnel: LOG5[2411:3084143504]: Connection closed: 7199827 bytes sent to SSL, 136049 bytes sent to socket The part "LOG5[2411:3084143504]:" is not expected by the current filter. I have extended some if-conditions with an "or"-block to match this format. The matching of "connected from" is reduced to services without spaces in their name. I do not know if stunnel support this at all. *Reduced output for "allowed services"* In addition to this we are not interested to see each ip of each service. So i did extend the filter script to be sensitive to an environment variable "stunnelallowedservices" - all services listed there (comma separated) will be summarized to "how often was this service used". independent of the ip. Obviously stunnelallowedservices could be set within "stunnel.conf" Hopefully i does not changed anything if the other input-format is produced and stunnelallowedservices is not set. Please find attached the diff and my complete version of the stunnel filter. Regards, Jonas Marczona ------------------------------------------------------------------------------ Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex infrastructure or vast IT resources to deliver seamless, secure access to virtual desktops. With this all-in-one solution, easily deploy virtual desktops for less than the cost of PCs and save 60% on VDI infrastructure costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox _______________________________________________ Logwatch-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/logwatch-devel
stunnel.diff
(text/x-patch, 2.7 KB)
0a1,2
> #!/usr/bin/perl
>
4c6,7
<
---
> # modified by Jonas Marczona
> # 2011/12/28
20a24
>
25a30
> my $allowedServicesInput = $ENV{'stunnelallowedservices'} || "";
36a42
> my %connectionsAllowed = ();
40a47,58
> $allowedServicesInput =~ s/[\t ]*,[\t ]*/,/g;
> my %allowedServices = ();
> @allowedServices{split(/,/, $allowedServicesInput)} = ();
>
> if ($Debug >= 5) {
> print "Allowed services are set to: \n";
> foreach my $allowedService (sort keys %allowedServices) {
> print $allowedService, "\n";
> }
> print "\n\n\n";
> }
>
50a69,77
> sub addAllowedConnection {
> my $service = shift;
> if (! exists($connectionsAllowed{$service})) {
> $connectionsAllowed{$service} = 0;
> }
> ++$connectionsAllowed{$service};
> }
>
>
59c86,90
< if ($ThisLine =~ m/^(.+) connected from (\d+\.\d+\.\d+\.\d+)/) {
---
> # Service name should not contain spaces => use ([^ ]+) instead of (.+)
> if (
> ($ThisLine =~ m/^([^ ]+) connected from (\d+\.\d+\.\d+\.\d+)/) or
> ($ThisLine =~ m/^\w{0,5}\d{1}\[\d+:\d+\]: ([^ ]+) connected from (\d+\.\d+\.\d+\.\d+)/)
> ) {
62,63c93,99
< if (! exists($connections{$service}{$ip})) {
< $connections{$service}{$ip} = 0;
---
> if (exists($allowedServices{$service})) {
> addAllowedConnection($service);
> } else {
> if (! exists($connections{$service}{$ip})) {
> $connections{$service}{$ip} = 0;
> }
> ++$connections{$service}{$ip};
65,66c101,104
< ++$connections{$service}{$ip};
< } elsif ($ThisLine =~ m/^Connection (reset|closed): (\d+) bytes sent to SSL, (\d+) bytes sent to socket/) {
---
> } elsif (
> ($ThisLine =~ m/^Connection (reset|closed): (\d+) bytes sent to SSL, (\d+) bytes sent to socket/) or
> ($ThisLine =~ m/^\w{0,5}\d{1}\[\d+:\d+\]: Connection (reset|closed): (\d+) bytes sent to SSL, (\d+) bytes sent to socket/)
> ) {
69c107,110
< } elsif ($ThisLine =~ m/^Connection (reset|closed)/) {
---
> } elsif (
> ($ThisLine =~ m/^Connection (reset|closed)/) or
> ($ThisLine =~ m/^\w{0,5}\d{1}\[\d+:\d+\]: SSL_read: Connection (reset|closed)/)
> ) {
80c121
< print "\nconnections:\n";
---
> print "\nNumber of connections per service per ip:\n";
82c123
< print " $service\n";
---
> printf " %7s \n", $service; # , $connections{$service}, "\n";
85c126
< print " $ip ", $ips->{$ip}, "\n";
---
> printf " %15s : %3d time(s)\n", $ip, $ips->{$ip};
89a131,140
>
> if (keys %connectionsAllowed) {
> print "\nNumber of connections per allowed service:\n";
> foreach my $service (sort keys %connectionsAllowed) {
> printf " %8s : %5d time(s)\n", $service, $connectionsAllowed{$service};
> }
> }
>
>
>
121d171
<
stunnel
(application/octet-stream, 4.8 KB) - not displayed