mirror of https://github.com/fail2ban/fail2ban
* master: ENH: for consistency (and future expansion ;)) -- rename to mysqld-auth Adjusting previous PR (MySQL logs) according to my comments TST: Add gamin testing for and only coveralls coverage for python2.7 change the license to GPLv2 + adapat text TST: Add gamin support for Travis CI fix the script name to check_fail2ban everywhere Replace the check_fail2ban script by a new one which respects the Nagios specs (like status, output, perfdata, help...). Also add a README which includes the content of f2ban.txt (which is now removed) Added testcase for MySQL date format to testcases/datedetectortestcase.py and example of MySQL log file. Added support for MySQL logfilespull/170/merge
Yaroslav Halchenko
12 years ago
commit
ebfb9422d8
@ -0,0 +1,31 @@
|
||||
# Fail2Ban configuration file for unsuccesfull MySQL authentication attempts
|
||||
#
|
||||
# Authors: Artur Penttinen
|
||||
# Yaroslav O. Halchenko
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
before = common.conf
|
||||
|
||||
|
||||
[Definition]
|
||||
|
||||
#_daemon = mysqld
|
||||
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failures messages in the logfile. The
|
||||
# host must be matched by a group named "host". The tag "<HOST>" can
|
||||
# be used for standard IP/hostname matching and is only an alias for
|
||||
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
|
||||
# Values: TEXT
|
||||
# 130322 11:26:54 [Warning] Access denied for user 'root'@'127.0.0.1' (using password: YES)
|
||||
failregex = Access denied for user '\w+'@'<HOST>' (to database '[^']*'|\(using password: (YES|NO)\))*\s*$
|
||||
|
||||
# Option: ignoreregex
|
||||
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
||||
# Values: TEXT
|
||||
#
|
||||
ignoreregex =
|
||||
@ -0,0 +1,104 @@
|
||||
Description
|
||||
-----------
|
||||
This plugin checks if the fail2ban server is running and how many IPs are currently banned.
|
||||
You can use this plugin to monitor all the jails or just a specific jail.
|
||||
|
||||
|
||||
How to use
|
||||
----------
|
||||
Just have to run the following command:
|
||||
$ ./check_fail2ban --help
|
||||
|
||||
If you need to use this script with NRPE you just have to do the
|
||||
following steps:
|
||||
|
||||
1 allow your user to run the script with the sudo rights. Just add
|
||||
something like that in your /etc/sudoers (use visudo) :
|
||||
nagios ALL=(ALL) NOPASSWD: /<path-to>/check_fail2ban
|
||||
|
||||
2 then just add this kind of line in your NRPE config file :
|
||||
command[check_fail2ban]=/usr/bin/sudo /<path-to>/check_fail2ban
|
||||
|
||||
3 don't forget to restart your NRPE daemon
|
||||
|
||||
/!\ be careful to let no one able to update the check_fail2ban ;)
|
||||
------------------------------------------------------------------------------
|
||||
|
||||
|
||||
Notes (from f2ban.txt)
|
||||
-----
|
||||
It seems that Fail2ban is currently not working, please login and check
|
||||
|
||||
HELP:
|
||||
|
||||
1.) stop the Service
|
||||
/etc/init.d/fail2ban stop
|
||||
|
||||
2.) delete the socket if available
|
||||
rm /tmp/fail2ban.sock
|
||||
|
||||
3.) start the Service
|
||||
/etc/init.d/fail2ban start
|
||||
|
||||
4.) check if fail2ban is working
|
||||
fail2ban-client ping
|
||||
Answer should be "pong"
|
||||
|
||||
5.) if the answer is not "pong" run away or CRY FOR HELP ;-)
|
||||
|
||||
|
||||
Help
|
||||
----
|
||||
|
||||
Usage: /<path-to>/check_fail2ban [-p] [-D "CHECK FAIL2BAN ACTIVITY"] [-v] [-c 2] [-w 1] [-s /<path-to>/socket] [-P /usr/bin/fail2ban-client]
|
||||
|
||||
Options:
|
||||
-h, --help
|
||||
Print detailed help screen
|
||||
-V, --version
|
||||
Print version information
|
||||
-D, --display=STRING
|
||||
To modify the output display
|
||||
default is "CHECK FAIL2BAN ACTIVITY"
|
||||
-P, --path-fail2ban_client=STRING
|
||||
Specify the path to the tw_cli binary
|
||||
default value is /usr/bin/fail2ban-client
|
||||
-c, --critical=INT
|
||||
Specify a critical threshold
|
||||
default is 2
|
||||
-w, --warning=INT
|
||||
Specify a warning threshold
|
||||
default is 1
|
||||
-s, --socket=STRING
|
||||
Specify a socket path
|
||||
default is unset
|
||||
-p, --perfdata
|
||||
If you want to activate the perfdata output
|
||||
-v, --verbose
|
||||
Show details for command-line debugging (Nagios may truncate the output)
|
||||
|
||||
|
||||
Example
|
||||
-------
|
||||
|
||||
# for a specific jail
|
||||
$ ./check_fail2ban --verbose -p -j ssh -w 1 -c 5 -P /usr/bin/fail2ban-client
|
||||
DEBUG : fail2ban_client_path: /usr/bin/fail2ban-client
|
||||
DEBUG : /usr/bin/fail2ban-client exists and is executable
|
||||
DEBUG : final fail2ban command: /usr/bin/fail2ban-client
|
||||
DEBUG : warning threshold : 1, critical threshold : 5
|
||||
DEBUG : it seems the connection with the fail2ban server is ok
|
||||
CHECK FAIL2BAN ACTIVITY - OK - 0 current banned IP(s) for the specific jail ssh | currentBannedIP=0
|
||||
|
||||
# for all the current jails
|
||||
$ ./check_fail2ban --verbose -p -w 1 -c 5 -P /usr/bin/fail2ban-client
|
||||
DEBUG : fail2ban_client_path: /usr/bin/fail2ban-client
|
||||
DEBUG : /usr/bin/fail2ban-client exists and is executable
|
||||
DEBUG : final fail2ban command: /usr/bin/fail2ban-client
|
||||
DEBUG : warning threshold : 1, critical threshold : 5
|
||||
DEBUG : it seems the connection with the fail2ban server is ok
|
||||
DEBUG : jails list: apache, ssh-ddos, ssh
|
||||
DEBUG : the jail apache has currently 0 banned IPs
|
||||
DEBUG : the jail ssh-ddos has currently 0 banned IPs
|
||||
DEBUG : the jail ssh has currently 0 banned IPs
|
||||
CHECK FAIL2BAN ACTIVITY - OK - 3 detected jails with 0 current banned IP(s) | currentBannedIP=0
|
||||
@ -1,18 +0,0 @@
|
||||
It seems that Fail2ban is currently not working, please login and check
|
||||
|
||||
HELP:
|
||||
|
||||
1.) stop the Service
|
||||
/etc/init.d/fail2ban stop
|
||||
|
||||
2.) delete the socket if available
|
||||
rm /tmp/fail2ban.sock
|
||||
|
||||
3.) start the Service
|
||||
/etc/init.d/fail2ban start
|
||||
|
||||
4.) check if fail2ban is working
|
||||
fail2ban-client ping
|
||||
Answer should be "pong"
|
||||
|
||||
5.) if the answer is not "pong" run away or CRY FOR HELP ;-)
|
||||
@ -0,0 +1,6 @@
|
||||
130324 0:04:00 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: NO)
|
||||
130324 8:24:09 [Warning] Access denied for user 'root'@'220.95.238.171' (using password: NO)
|
||||
130324 17:56:13 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: NO)
|
||||
130324 17:56:14 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: YES)
|
||||
130324 19:01:39 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: NO)
|
||||
130324 19:01:40 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: YES)
|
||||
Loading…
Reference in new issue