fail2ban heti jelentés |

A fail2ban egy olyan alkalmazás ami folyamatosan parseolja a log fileoket és gyanús művelet esetén az adott IP-t kizárja a tűzfalon. Miután beröccent, úgy gondoltam jó lenne tudni róla, hogy

működik
folyamatosan működik
kiket vág ki.

Nyilván belehetne kötni nagiosba (muninba már eleve ott van, szóval a folyamatos működés vizuálisan észlelhető rajta), de akkor mire használnám a webmailemet 🙂 ?

Úgyhogy gyorsba kerestem egy fail2ban report scriptet ami hetente lefut cron-ból. Szépen működik is, ellenben csak kiírja az IP-ket, jó lenne tudni, hogy az milyen országból érkezik. ezért kicsit kibővítettem. Eredeti script megtalálható itt. Arra oda kell figyelni, hogy a crontab nem futtatja le azokat a fájlokat amiknek kiterjesztése van. Tehát semmiképpen ne úgy rakjuk be, hogy ~~fail2banweeklyreport.sh~~, hanem fail2banweeklyreport.

fail2ban_weekly_report
Shell

#!/bin/bash # Weekly Fail2Ban Report # Be sure to sudo chmod +x script_name.sh to make it executable # Original script by: https://www.mopar4life.com/fail2ban-reporting/ # Forked by Bence G. Debnár FAIL2BAN_PATH="/var/log/fail2ban*" LOGFILE="/var/backups/logs/fail2ban/$(date +%m%d%Y)_Fail2Ban_Report.log" #LOGFILE="/tmp/testfail2ban.txt" MAILTOADDRESS="emailaddress" SUBJECT="$HOSTNAME Weekly Fail2Ban Report" echo $(date +%m/%d/%Y) > $LOGFILE echo '' >> $LOGFILE echo '' >> $LOGFILE echo '' >> $LOGFILE echo 'Most frequently banned IP addresses' >> $LOGFILE echo ' Count IP Address' >> $LOGFILE echo '_______________________________________' >> $LOGFILE # show only the most problematic IP Addresses # 1.1: now it's show the IP AND the country name read -r -a IPARRAY <<< `zgrep -h "Ban " $FAIL2BAN_PATH | awk '{print $NF}' | sort | uniq -c | sort -n | tail | sort -nr` #read -r -a array <<< `zgrep -h "Ban " /var/log/fail2ban* | awk '{print $NF}' | sort | sort -n | tail | sort -nr` RE_NUMBER='^[0-9]+$' for IPADDRESS in "${IPARRAY[@]}" do #because the input file is pretty consequent we don't need a complicated filter # #if it's a number then it's the counter if [[ $IPADDRESS =~ $RE_NUMBER ]] then echo -n "${IPADDRESS} " >> $LOGFILE #if contains a dot, then it's an IP address elif [[ $IPADDRESS == *"."* ]] then echo -n "$IPADDRESS (`geoiplookup ${IPADDRESS} | awk '{print substr($0, index($0,$4))}'`)" >> $LOGFILE echo >> $LOGFILE fi done echo '' >> $LOGFILE echo '' >> $LOGFILE echo '' >> $LOGFILE echo '' >> $LOGFILE echo 'All banned IP addresses with service type' >> $LOGFILE echo '' >> $LOGFILE echo '_______________________________________' >> $LOGFILE # Show what service the IP was banned from and how many times for all log files including rotated # Sorts from high to low (using sort -nr) to sort low to high replace -nr with -n # To not use WILDCARD (*), you much change from {print $11,$9} to {print $10,$8} # SAMPLE OUTPUT # 1 XXX.71.214.66 [ssh-iptables] # 1 XXX.62.36.219 [sendmail] # 2 XX.165.195.40 [vsftpd] grep "Ban " $FAIL2BAN_PATH* | awk -F[\ \:] '{print $11,$9}' | sort | uniq -c | sort -nr >> $LOGFILE # EMail File after completion (wait 10 seconds to finish writing log first) sleep 10 mail -s "$SUBJECT" "$MAILTOADDRESS" < $LOGFILE

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

#!/bin/bash

# Weekly Fail2Ban Report
# Be sure to sudo chmod +x script_name.sh to make it executable
# Original script by: https://www.mopar4life.com/fail2ban-reporting/
# Forked by Bence G. Debnár

FAIL2BAN_PATH="/var/log/fail2ban*"
LOGFILE="/var/backups/logs/fail2ban/$(date +%m%d%Y)_Fail2Ban_Report.log"
#LOGFILE="/tmp/testfail2ban.txt"
MAILTOADDRESS="emailaddress"
SUBJECT="$HOSTNAME Weekly Fail2Ban Report"

echo $(date +%m/%d/%Y) > $LOGFILE
echo '' >> $LOGFILE
echo '' >> $LOGFILE
echo '' >> $LOGFILE
echo 'Most frequently banned IP addresses'  >> $LOGFILE
echo '  Count IP Address' >> $LOGFILE
echo '_______________________________________' >> $LOGFILE
# show only the most problematic IP Addresses
# 1.1: now it's show the IP AND the country name
read -r -a IPARRAY <<< `zgrep -h "Ban " $FAIL2BAN_PATH | awk '{print $NF}' | sort | uniq -c  | sort -n | tail | sort -nr`
#read -r -a array <<< `zgrep -h "Ban " /var/log/fail2ban* | awk '{print $NF}' | sort | sort -n | tail | sort -nr`

RE_NUMBER='^[0-9]+$'
for IPADDRESS in "${IPARRAY[@]}"
do
#because the input file is pretty consequent we don't need a complicated filter
#
#if it's a number then it's the counter
if [[ $IPADDRESS =~ $RE_NUMBER ]]
then
echo -n "${IPADDRESS} " >> $LOGFILE
#if contains a dot, then it's an IP address
elif [[ $IPADDRESS == *"."* ]]
then
echo -n "$IPADDRESS (`geoiplookup ${IPADDRESS} | awk '{print substr($0, index($0,$4))}'`)" >> $LOGFILE
echo >> $LOGFILE
fi
done

echo '' >> $LOGFILE
echo '' >> $LOGFILE
echo '' >> $LOGFILE
echo '' >> $LOGFILE
echo 'All banned IP addresses with service type'  >> $LOGFILE
echo '' >> $LOGFILE
echo '_______________________________________' >> $LOGFILE
# Show what service the IP was banned from and how many times for all log files including rotated
# Sorts from high to low (using sort -nr) to sort low to high replace -nr with -n
# To not use WILDCARD (*), you much change from {print $11,$9} to {print $10,$8}
# SAMPLE OUTPUT
#      1 XXX.71.214.66 [ssh-iptables]
#      1 XXX.62.36.219 [sendmail]
#      2 XX.165.195.40 [vsftpd]
grep "Ban " $FAIL2BAN_PATH* | awk -F[\ \:] '{print $11,$9}' | sort | uniq -c | sort -nr  >> $LOGFILE

# EMail File after completion (wait 10 seconds to finish writing log first)
sleep 10
mail -s "$SUBJECT" "$MAILTOADDRESS" < $LOGFILE

fail2ban heti jelentés

Archives

Meta