60 lines
1.4 KiB
Jsonnet
60 lines
1.4 KiB
Jsonnet
|
local banFor(time) = {
|
||
|
|
ban: {
|
||
|
|
cmd: ['iptables', '-w', '-A', 'reaction', '-s', '<ip>', '-j', 'DROP'],
|
||
|
|
},
|
||
|
|
unban: {
|
||
|
|
cmd: ['iptables', '-w', '-D', 'reaction', '-s', '<ip>', '-j', 'DROP'],
|
||
|
|
after: time,
|
||
|
|
},
|
||
|
|
};
|
||
|
|
|
||
|
|
{
|
||
|
|
patterns: {
|
||
|
|
ip: {
|
||
|
|
type: 'ipv4',
|
||
|
|
},
|
||
|
|
},
|
||
|
|
start: [
|
||
|
|
['iptables', '-N', 'reaction'],
|
||
|
|
['iptables', '-I', 'INPUT', '-p', 'all', '-j', 'reaction'],
|
||
|
|
['iptables', '-I', 'FORWARD', '-p', 'all', '-j', 'reaction'],
|
||
|
|
],
|
||
|
|
stop: [
|
||
|
|
['iptables', '-D', 'INPUT', '-p', 'all', '-j', 'reaction'],
|
||
|
|
['iptables', '-D', 'FORWARD', '-p', 'all', '-j', 'reaction'],
|
||
|
|
['iptables', '-F', 'reaction'],
|
||
|
|
['iptables', '-X', 'reaction'],
|
||
|
|
],
|
||
|
|
streams: {
|
||
|
|
ssh: {
|
||
|
|
cmd: ['journalctl', '-fu', 'ssh.service'],
|
||
|
|
filters: {
|
||
|
|
failedlogin: {
|
||
|
|
regex: [
|
||
|
|
@'authentication failure;.*rhost=<ip>',
|
||
|
|
@'Failed password for .* from <ip>',
|
||
|
|
@'banner exchange: Connection from <ip> port [0-9]*: invalid format',
|
||
|
|
@'Invalid user .* from <ip>',
|
||
|
|
],
|
||
|
|
retry: 3,
|
||
|
|
retryperiod: '6h',
|
||
|
|
actions: banFor('96h'),
|
||
|
|
},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
apache: {
|
||
|
|
cmd: ['tail', '-q', '-F', '-n0', '/var/log/apache2/wp6_eureka.access.log'],
|
||
|
|
filters: {
|
||
|
|
sniffer: {
|
||
|
|
regex: [
|
||
|
|
@'\[.*\] 404 <ip>'
|
||
|
|
],
|
||
|
|
retry: 3,
|
||
|
|
retryperiod: '10s',
|
||
|
|
actions: banFor('1h'),
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
}
|