freeradius

Hi,

i am completely new to perl and its the first time i work with logwatch.

We run freeradius on a Ubuntu server (10.04) and we were interested to get
some informations from it into our daily logwatch.
I wrote an elementary filter - see attachment.

My focus is to get to know when "something" unregular has happen. E.g.
someone tries to guess a username/password.
(In the past we had some problems with brute-force attacks)

The filter summarize how often an ip failed to login with a wrong password
or a wrong username.
For "Detail >= 5" the filter adds a list about the number of failed
attempts per ip.
For "Detail >= 10" also the number of successful logins per username are
summarized.
Everything else will be printed directly to the logwatch.

Because the shared script RemoveHeaders does not match the output from
freeradius i wrote also a short shared script named "RemoveHeadersDate" to
remove the starting date from each line. (maybe the name is not perfect,
also just using "remove" with a proper regex would work, too)

Please notice: Our freeradius is configured to log directly into
/var/log/freeradius/radius.log - without the usage of syslog.
>From /etc/freeradius/radiusd.conf the log block:
log {
  destination = files
  file = ${logdir}/radius.log
  stripped_names = no
  auth = yes
  auth_badpass = no
  auth_goodpass = no
}

Greetings,
Jonas Marczona

Example Output (ips and usernames anonymized):

Successful logins:
    username1 :  11 time(s)
    username2 :   4 time(s)
    username3 :   1 time(s)

 Sum of failed logins per ip (wrong password or user)
     178.200.xx.xx :   2 time(s)

 Failed logins - wrong user name:
     178.200.xx.xx
        username_invalid :   1 time(s)

 Failed logins - wrong password:
     178.200.xx.xx
             username1 :   1 time(s)

------------------------------------------------------------------------------
Write once. Port to many.
Get the SDK and tools to simplify cross-platform app development. Create 
new or port existing apps to sell to consumers worldwide. Explore the 
Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
http://p.sf.net/sfu/intel-appdev

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel