syslog
George Law <[email protected]> Tue, 8 Jul 2003 15:19:22 -0400
| Newsgroups | gmane.network.xinetd |
|---|---|
| Message-ID | <[email protected]> |
Now that I have per_source working correctly (thanks Steve!), I wanted to try to come up with a way to block IPs that continously hammer on the per_source limit (like the guy below from 166.114.250.149). Right now, I am using logsurfer to peek at /var/log/messages and certain regex will trigger a script which will process the probe based on a keyword. ie - when I see someone try to login as root, I block their IP address immediately using IP tables. Another example of this is when wu-ftpd logs : Jul 8 11:10:05 XXX ftpd[332]: anonymous([email protected]) of 81.56.198.138 [81.56.198.138] tried to create directory /pub/users/xyz/ftp/030708170909p This is a scan to find ftp sites which will allow anonymous mkdirs. When logsurfer sees this, it pulls out the IP address and blocks it with iptables. I see that you can control the syslog facility and priority in the xinetd.conf file. The default authpriv.info logs every START and EXIT, plus any errors. Is there a way to control the priority of the xinetd messages, ie to make the priority of the START and EXIT messages "info" and the priority of the FAIL lines "warning". This would allow me to just send authpriv.warning to /var/log/messages. I think this needs to go into the libs/include/xlog.h file, but my C programming is rusty! :) -- Cordially, George Law ____________________________________________________________________ Systems Engineer Software Workshop Inc. [email protected] 315.635-1968 (x-213) "software that fits!" (TM) Jul 8 14:20:00 XXX xinetd[1030]: START: ftp pid=25149 from=166.114.250.149 Jul 8 14:20:00 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:00 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:00 XXX xinetd[1030]: START: ftp pid=25150 from=166.114.250.149 Jul 8 14:20:00 XXX xinetd[1030]: START: ftp pid=25151 from=166.114.250.149 Jul 8 14:20:00 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:01 XXX xinetd[1030]: START: ftp pid=25168 from=166.114.250.149 Jul 8 14:20:01 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:01 XXX xinetd[1030]: START: ftp pid=25169 from=166.114.250.149 Jul 8 14:20:01 XXX xinetd[1030]: START: ftp pid=25170 from=166.114.250.149 Jul 8 14:20:01 XXX xinetd[1030]: START: ftp pid=25171 from=166.114.250.149 Jul 8 14:20:02 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:02 XXX xinetd[1030]: START: ftp pid=25174 from=166.114.250.149 Jul 8 14:20:02 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:02 XXX xinetd[1030]: START: ftp pid=25175 from=166.114.250.149 Jul 8 14:20:02 XXX xinetd[1030]: START: ftp pid=25176 from=166.114.250.149 Jul 8 14:20:02 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:02 XXX xinetd[1030]: START: ftp pid=25177 from=166.114.250.149 Jul 8 14:20:02 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:02 XXX xinetd[1030]: START: ftp pid=25180 from=166.114.250.149 Jul 8 14:20:03 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:03 XXX xinetd[1030]: START: ftp pid=25185 from=166.114.250.149 Jul 8 14:20:03 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:03 XXX xinetd[1030]: START: ftp pid=25189 from=166.114.250.149 Jul 8 14:20:03 XXX xinetd[1030]: START: ftp pid=25192 from=166.114.250.149 Jul 8 14:20:03 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:03 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:04 XXX xinetd[1030]: START: ftp pid=25196 from=166.114.250.149 Jul 8 14:20:05 XXX xinetd[1030]: START: ftp pid=25197 from=166.114.250.149 Jul 8 14:20:05 XXX xinetd[1030]: START: ftp pid=25198 from=166.114.250.149 Jul 8 14:20:05 XXX xinetd[1030]: START: ftp pid=25199 from=166.114.250.149 Jul 8 14:20:05 XXX xinetd[1030]: START: ftp pid=25200 from=166.114.250.149 Jul 8 14:20:05 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:06 XXX xinetd[1030]: START: ftp pid=25201 from=166.114.250.149 Jul 8 14:20:06 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:06 XXX xinetd[1030]: START: ftp pid=25202 from=166.114.250.149 Jul 8 14:20:07 XXX xinetd[1030]: START: ftp pid=25208 from=166.114.250.149 Jul 8 14:20:07 XXX xinetd[1030]: START: ftp pid=25209 from=166.114.250.149 Jul 8 14:20:07 XXX xinetd[1030]: START: ftp pid=25211 from=166.114.250.149 Jul 8 14:20:07 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:07 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:08 XXX xinetd[1030]: START: ftp pid=25213 from=166.114.250.149 Jul 8 14:20:08 XXX xinetd[1030]: START: ftp pid=25214 from=166.114.250.149 Jul 8 14:20:08 XXX xinetd[1030]: START: ftp pid=25224 from=166.114.250.149 Jul 8 14:20:09 XXX xinetd[1030]: START: ftp pid=25225 from=166.114.250.149 Jul 8 14:20:09 XXX xinetd[1030]: START: ftp pid=25226 from=166.114.250.149 Jul 8 14:20:09 XXX xinetd[1030]: START: ftp pid=25227 from=166.114.250.149 Jul 8 14:20:09 XXX xinetd[1030]: START: ftp pid=25228 from=166.114.250.149 Jul 8 14:20:17 XXX xinetd[1030]: START: ftp pid=25254 from=166.114.250.149 Jul 8 14:20:17 XXX xinetd[1030]: START: ftp pid=25255 from=166.114.250.149 Jul 8 14:20:17 XXX xinetd[1030]: START: ftp pid=25256 from=166.114.250.149 Jul 8 14:20:18 XXX xinetd[1030]: START: ftp pid=25257 from=166.114.250.149 Jul 8 14:20:18 XXX xinetd[1030]: START: ftp pid=25258 from=166.114.250.149 Jul 8 14:20:18 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:19 XXX xinetd[1030]: START: ftp pid=25260 from=166.114.250.149 Jul 8 14:20:19 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:20 XXX xinetd[1030]: START: ftp pid=25264 from=166.114.250.149 Jul 8 14:20:20 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:21 XXX xinetd[1030]: START: ftp pid=25265 from=166.114.250.149 Jul 8 14:20:22 XXX xinetd[1030]: START: ftp pid=25268 from=166.114.250.149 Jul 8 14:20:22 XXX xinetd[1030]: START: ftp pid=25269 from=166.114.250.149 Jul 8 14:20:22 XXX xinetd[1030]: START: ftp pid=25270 from=166.114.250.149 Jul 8 14:20:22 XXX xinetd[1030]: START: ftp pid=25271 from=166.114.250.149 Jul 8 14:20:22 XXX xinetd[1030]: FAIL: ftp per_source_limit from=166.114.250.149 Jul 8 14:20:27 XXX xinetd[1030]: START: ftp pid=25273 from=166.114.250.149