Re: iptables & tcp wrappers

On Tue, Oct 05, 2004 at 06:26:55PM +0100, Matthew Baker wrote:

> What it does is monitor the output from auth logs (using 
> swatch) and takes the IP addresses of failed/invalid attempts and 
> records the number of attempts made from that IP in a database file. 
> Then when the counter goes above a configured threshold (which can be 
> different for a single host or CIDR network) the IP is inserted as a 
> DROP rule into custom chain using IPtables.

I wrote a more generalized version of this:
<http://www.tifaware.com/perl/log-guardian/>.  It's a Perl script,
freely available, that monitors one or more logs for patterns.  As
matches are found, the script reacts by running blocks of Perl code. 
The patterns and code can be pretty much whatever you want, which makes
the script very flexible.  I use it to monitor logs and drop traffic
from hosts responsible for troublesome behaviour with iptables rules.

George
-- 
[email protected]

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQFBY0D5sWUciNmuHkURAqCDAJwJG0/lD/Iq1ENatn4EXznYXxJ8sgCdEpvN
/JkFxQBQx29dqAWmvIF/n3c=
=ZaGD
-----END PGP SIGNATURE-----