diff --git a/src/contrib/warden-app/Modules/IPset.pm b/src/contrib/warden-app/Modules/IPset.pm
index 0d065040e13cdcf29c4106f2e5a5fa4ddf0023b3..0c5ae9213dbb8186a765c1415a07474bfe74aa37 100644
--- a/src/contrib/warden-app/Modules/IPset.pm
+++ b/src/contrib/warden-app/Modules/IPset.pm
@@ -9,7 +9,7 @@ my %CONSTANTS = (
threshold => 250,
excludedip => [],
eventtype => [],
- setname => "BLOCK",
+ setname => "BLOCK",
maxage => "1D",
);
@@ -30,9 +30,9 @@ sub run {
my @rows = Utils::fetchall_array_hashref($dbh, $query);
- sub header { my $v = shift; return "create $v->{'setname'}_tmp hash:ip\n"; };
- sub record { my ($r, $v) = @_; return "add $v->{'setname'}_tmp $r->{'source'}\n" if ($r->{'source'}=~/\d+\.\d+\.\d+\.\d+/); };
- sub footer { my ($v) = @_; return "swap $v->{'setname'}_tmp $v->{'setname'}\ndestroy $v->{'setname'}_tmp\nquit\n"; };
+ sub header { my $v = shift; return "/usr/sbin/ipset --create $v->{'setname'}_tmp iphash\n"; };
+ sub record { my ($r, $v) = @_; return "/usr/sbin/ipset --add $v->{'setname'}_tmp $r->{'source'}\n" if ($r->{'source'}=~ /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/); };
+ sub footer { my ($v) = @_; return "/usr/sbin/ipset --swap $v->{'setname'}_tmp $v->{'setname'}\n/usr/sbin/ipset --destroy $v->{'setname'}_tmp\n"; };
my $ret = Utils::generateOutput($v->{'outputfile'}, \@rows, \&header, \&record, \&footer, $v);
return $ret;
diff --git a/src/contrib/warden-app/doc/WApp.README b/src/contrib/warden-app/doc/WApp.README
index 6a12fbd988a9b4bf76714bb7a45ad71423c3e419..203b23eb6a2c389a82d6377effbf96785c7e1b2b 100644
--- a/src/contrib/warden-app/doc/WApp.README
+++ b/src/contrib/warden-app/doc/WApp.README
@@ -11,6 +11,7 @@ Content
E. Configuration
F. Modules
G. Run
+ H. The requirements of modules
X. Tutorial: Running of the WApp along with the database backend
XX. Tutorial: Writing your own module
@@ -146,10 +147,13 @@ F. Modules
DNSblacklist - generates zone file for the most widely used DNS software on the Internet.
IPblacklist - generates traditional CSV file with IP addresses.
IPtables - generates iptables rules.
- IPset - generates ipset rules (use on big sets of addresses rather than iptables).
+ IPset - generates ipset rules (use on big sets of addresses rather than iptables).
MailReport - generates reports which are sent to specific recipients.
- Section XX. describes how to write own module.
+ Section XX. describes how to write own module.
+
+ Some modules require additional requirements for their proper functioning. Specific
+ examples are described in section H.
--------------------------------------------------------------------------------
G. Run
@@ -174,22 +178,46 @@ G. Run
3. Cleaner
Usage: warden-cleaner.pl
+--------------------------------------------------------------------------------
+H. The requirements of modules
+
+ These modules require an initial steps:
+
+ 1. IPtables
+
+ Redirect of specific traffic to chain specified in the configuration.
+ If the 'chainname="BLOCK"' option is used and you are interested in SSH attackers (tcp/22),
+ it's necessary use these commands:
+
+ iptables -N BLOCK
+ iptables -I INPUT 1 --protocol tcp --dport 22 --jump BLOCK
+
+ 2. IPset
+
+ Initialize the new set and create a blocking rule in iptables.
+ If the 'setname="BLOCK"' option is used and and you are interested in SSH attackers (tcp/22)
+ it's necessary use these commands:
+
+ ipset --create BLOCK iphash
+ iptables -I INPUT 1 --protocol tcp --dport 22 -m set --match-set BLOCK src --jump DROP
+
--------------------------------------------------------------------------------
X. Tutorial: Running of the WApp along with the database backend
1. Database engine configuration (conf/db.conf)
[SQLITE]
- db="var/warden.db"
+ db="var/warden.db"
user=
pass=
2. Receiver configuration (conf/receiver.conf)
[GENERAL]
- method="db"
+ method="db"
wardenpath="/opt/warden-client"
- requested_type="_all_"
+ # Type of event which will be requested. To get all types of event, leave this option blank.
+ requested_type=
[DB]
dbengine="sqlite"
@@ -213,9 +241,6 @@ X. Tutorial: Running of the WApp along with the database backend
method="db"
maxage="5D"
- [DB]
- dbengine="sqlite"
-
5. Run
I. Manually
diff --git a/src/contrib/warden-app/etc/db.conf b/src/contrib/warden-app/etc/db.conf
index 637ea68bb74df0fc1e3d4a6f8e78745a1bfab716..7705ec302b734aa047978fa6018f0f43a734f1e2 100644
--- a/src/contrib/warden-app/etc/db.conf
+++ b/src/contrib/warden-app/etc/db.conf
@@ -2,7 +2,7 @@
[SQLITE]
# Path to sqlite database file
-db="/root/warden/src/warden-app/var/warden.db"
+db="/root/warden/src/contrib/warden-app/var/warden.db"
# Username
user=
# Password
diff --git a/src/contrib/warden-app/etc/factory.conf b/src/contrib/warden-app/etc/factory.conf
index 426859e997709eb27af055ebef6db8d8e7225f35..e637db026f3b018e3694d5e575d204de18be33d4 100644
--- a/src/contrib/warden-app/etc/factory.conf
+++ b/src/contrib/warden-app/etc/factory.conf
@@ -10,7 +10,7 @@ enabled="yes"
# Type of module; see 'moddir' directory
module="IPblacklist"
# Where will be result stored
-outputfile="/root/warden/src/warden-app/tmp/blacklist.csv"
+outputfile="/root/warden/src/contrib/warden-app/tmp/blacklist.csv"
# Threshold for SQL query (events grouped by source IP) [number]
threshold="2"
# Which source IP we want to exclude from result [ip1, ip2, ipN]
@@ -26,7 +26,7 @@ enabled="yes"
# Type of module; see 'moddir' directory
module="IPtables"
# Where will be result stored
-outputfile="/root/warden/src/warden-app/tmp/iptables2.txt"
+outputfile="/root/warden/src/contrib/warden-app/tmp/iptables2.txt"
# Threshold for SQL query (events grouped by source IP) [number]
threshold="10"
# Which source IP we want to exclude from result [ip1, ip2, ipN]
@@ -46,7 +46,7 @@ enabled="yes"
# Type of module; see 'moddir' directory
module="IPset"
# Where will be result stored
-outputfile="/opt/warden-app/var/ipset.txt"
+outputfile="/root/warden/src/contrib/warden-app/tmp/ipset.txt"
# Threshold for SQL query (events grouped by source IP) [number]
threshold="10"
# Which source IP we want to exclude from result [ip1, ip2, ipN]
@@ -64,7 +64,7 @@ enabled="yes"
# Type of module; see 'moddir' directory
module="DNSblacklist"
# Where will be result stored
-outputfile="/root/warden/src/warden-app/tmp/dnsbl2.txt"
+outputfile="/root/warden/src/contrib/warden-app/tmp/dnsbl2.txt"
# Default target for blacklisted A record
target="127.0.0.2"
# Threshold for SQL query (events grouped by source IP) [number]