fail2ban heti jelentés

A fail2ban egy olyan alkalmazás ami folyamatosan parseolja a log fileoket és gyanús művelet esetén az adott IP-t kizárja a tűzfalon. Miután beröccent, úgy gondoltam jó lenne tudni róla, hogy

• működik
• folyamatosan működik
• kiket vág ki.

Nyilván belehetne kötni nagiosba (muninba már eleve ott van, szóval a folyamatos működés vizuálisan észlelhető rajta), de akkor mire használnám a webmailemet 🙂 ?

Úgyhogy gyorsba kerestem egy fail2ban report scriptet ami hetente lefut cron-ból. Szépen működik is, ellenben csak kiírja az IP-ket, jó lenne tudni, hogy az milyen országból érkezik. ezért kicsit kibővítettem. Eredeti script megtalálható itt. Arra oda kell figyelni, hogy a crontab nem futtatja le azokat a fájlokat amiknek kiterjesztése van. Tehát semmiképpen ne úgy rakjuk be, hogy fail2banweeklyreport.sh, hanem fail2banweeklyreport.

fail2ban_weekly_report

Shell

#!/bin/bash # Weekly Fail2Ban Report # Be sure to sudo chmod +x script_name.sh to make it executable # Original script by: https://www.mopar4life.com/fail2ban-reporting/ # Forked by Bence G. Debnár FAIL2BAN_PATH="/var/log/fail2ban*" LOGFILE="/var/backups/logs/fail2ban/$(date +%m%d%Y)_Fail2Ban_Report.log" #LOGFILE="/tmp/testfail2ban.txt" MAILTOADDRESS="emailaddress" SUBJECT="$HOSTNAME Weekly Fail2Ban Report" echo $(date +%m/%d/%Y) > $LOGFILE echo '' >> $LOGFILE echo '' >> $LOGFILE echo '' >> $LOGFILE echo 'Most frequently banned IP addresses' >> $LOGFILE echo ' Count IP Address' >> $LOGFILE echo '_______________________________________' >> $LOGFILE # show only the most problematic IP Addresses # 1.1: now it's show the IP AND the country name read -r -a IPARRAY <<< `zgrep -h "Ban " $FAIL2BAN_PATH | awk '{print $NF}' | sort | uniq -c | sort -n | tail | sort -nr` #read -r -a array <<< `zgrep -h "Ban " /var/log/fail2ban* | awk '{print $NF}' | sort | sort -n | tail | sort -nr` RE_NUMBER='^[0-9]+$' for IPADDRESS in "${IPARRAY[@]}" do #because the input file is pretty consequent we don't need a complicated filter # #if it's a number then it's the counter if [[ $IPADDRESS =~ $RE_NUMBER ]] then echo -n "${IPADDRESS} " >> $LOGFILE #if contains a dot, then it's an IP address elif [[ $IPADDRESS == *"."* ]] then echo -n "$IPADDRESS (`geoiplookup ${IPADDRESS} | awk '{print substr($0, index($0,$4))}'`)" >> $LOGFILE echo >> $LOGFILE fi done echo '' >> $LOGFILE echo '' >> $LOGFILE echo '' >> $LOGFILE echo '' >> $LOGFILE echo 'All banned IP addresses with service type' >> $LOGFILE echo '' >> $LOGFILE echo '_______________________________________' >> $LOGFILE # Show what service the IP was banned from and how many times for all log files including rotated # Sorts from high to low (using sort -nr) to sort low to high replace -nr with -n # To not use WILDCARD (*), you much change from {print $11,$9} to {print $10,$8} # SAMPLE OUTPUT # 1 XXX.71.214.66 [ssh-iptables] # 1 XXX.62.36.219 [sendmail] # 2 XX.165.195.40 [vsftpd] grep "Ban " $FAIL2BAN_PATH* | awk -F[\ \:] '{print $11,$9}' | sort | uniq -c | sort -nr >> $LOGFILE # EMail File after completion (wait 10 seconds to finish writing log first) sleep 10 mail -s "$SUBJECT" "$MAILTOADDRESS" < $LOGFILE

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61

#!/bin/bash   # Weekly Fail2Ban Report # Be sure to sudo chmod +x script_name.sh to make it executable # Original script by: https://www.mopar4life.com/fail2ban-reporting/ # Forked by Bence G. Debnár   FAIL2BAN_PATH="/var/log/fail2ban*" LOGFILE="/var/backups/logs/fail2ban/$(date +%m%d%Y)_Fail2Ban_Report.log" #LOGFILE="/tmp/testfail2ban.txt" MAILTOADDRESS="emailaddress" SUBJECT="$HOSTNAME Weekly Fail2Ban Report"   echo $(date +%m/%d/%Y) > $LOGFILE echo '' >> $LOGFILE echo '' >> $LOGFILE echo '' >> $LOGFILE echo 'Most frequently banned IP addresses'  >> $LOGFILE echo '  Count IP Address' >> $LOGFILE echo '_______________________________________' >> $LOGFILE # show only the most problematic IP Addresses # 1.1: now it's show the IP AND the country name read -r -a IPARRAY <<< `zgrep -h "Ban " $FAIL2BAN_PATH | awk '{print $NF}' | sort | uniq -c  | sort -n | tail | sort -nr` #read -r -a array <<< `zgrep -h "Ban " /var/log/fail2ban* | awk '{print $NF}' | sort | sort -n | tail | sort -nr`   RE_NUMBER='^[0-9]+$' for IPADDRESS in "${IPARRAY[@]}" do #because the input file is pretty consequent we don't need a complicated filter # #if it's a number then it's the counter if [[ $IPADDRESS =~ $RE_NUMBER ]] then echo -n "${IPADDRESS} " >> $LOGFILE #if contains a dot, then it's an IP address elif [[ $IPADDRESS == *"."* ]] then echo -n "$IPADDRESS (`geoiplookup ${IPADDRESS} | awk '{print substr($0, index($0,$4))}'`)" >> $LOGFILE echo >> $LOGFILE fi done   echo '' >> $LOGFILE echo '' >> $LOGFILE echo '' >> $LOGFILE echo '' >> $LOGFILE echo 'All banned IP addresses with service type'  >> $LOGFILE echo '' >> $LOGFILE echo '_______________________________________' >> $LOGFILE # Show what service the IP was banned from and how many times for all log files including rotated # Sorts from high to low (using sort -nr) to sort low to high replace -nr with -n # To not use WILDCARD (*), you much change from {print $11,$9} to {print $10,$8} # SAMPLE OUTPUT #      1 XXX.71.214.66 [ssh-iptables] #      1 XXX.62.36.219 [sendmail] #      2 XX.165.195.40 [vsftpd] grep "Ban " $FAIL2BAN_PATH* | awk -F[\ \:] '{print $11,$9}' | sort | uniq -c | sort -nr  >> $LOGFILE   # EMail File after completion (wait 10 seconds to finish writing log first) sleep 10 mail -s "$SUBJECT" "$MAILTOADDRESS" < $LOGFILE