diff --git a/src/contrib/warden-app/Modules/IPset.pm b/src/contrib/warden-app/Modules/IPset.pm index 0c5ae9213dbb8186a765c1415a07474bfe74aa37..0d065040e13cdcf29c4106f2e5a5fa4ddf0023b3 100644 --- a/src/contrib/warden-app/Modules/IPset.pm +++ b/src/contrib/warden-app/Modules/IPset.pm @@ -9,7 +9,7 @@ my %CONSTANTS = ( threshold => 250, excludedip => [], eventtype => [], - setname => "BLOCK", + setname => "BLOCK", maxage => "1D", ); @@ -30,9 +30,9 @@ sub run { my @rows = Utils::fetchall_array_hashref($dbh, $query); - sub header { my $v = shift; return "/usr/sbin/ipset --create $v->{'setname'}_tmp iphash\n"; }; - sub record { my ($r, $v) = @_; return "/usr/sbin/ipset --add $v->{'setname'}_tmp $r->{'source'}\n" if ($r->{'source'}=~ /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/); }; - sub footer { my ($v) = @_; return "/usr/sbin/ipset --swap $v->{'setname'}_tmp $v->{'setname'}\n/usr/sbin/ipset --destroy $v->{'setname'}_tmp\n"; }; + sub header { my $v = shift; return "create $v->{'setname'}_tmp hash:ip\n"; }; + sub record { my ($r, $v) = @_; return "add $v->{'setname'}_tmp $r->{'source'}\n" if ($r->{'source'}=~/\d+\.\d+\.\d+\.\d+/); }; + sub footer { my ($v) = @_; return "swap $v->{'setname'}_tmp $v->{'setname'}\ndestroy $v->{'setname'}_tmp\nquit\n"; }; my $ret = Utils::generateOutput($v->{'outputfile'}, \@rows, \&header, \&record, \&footer, $v); return $ret; diff --git a/src/contrib/warden-app/doc/WApp.README b/src/contrib/warden-app/doc/WApp.README index 203b23eb6a2c389a82d6377effbf96785c7e1b2b..494afa9c868d32fad089bb3bd7825be5c52aac1c 100644 --- a/src/contrib/warden-app/doc/WApp.README +++ b/src/contrib/warden-app/doc/WApp.README @@ -195,12 +195,17 @@ H. The requirements of modules 2. IPset Initialize the new set and create a blocking rule in iptables. - If the 'setname="BLOCK"' option is used and and you are interested in SSH attackers (tcp/22) - it's necessary use these commands: + If the 'setname="BLOCK"' and 'outputfile="rules.txt"' options are used and and you are + interested in SSH attackers (tcp/22) it's necessary use these commands: ipset --create BLOCK iphash iptables -I INPUT 1 --protocol tcp --dport 22 -m set --match-set BLOCK src --jump DROP + Change of the rules using script consume a lot of CPU resources, so it is necessary + to use a pipe: + + ipset - < rules.txt + -------------------------------------------------------------------------------- X. Tutorial: Running of the WApp along with the database backend