Mercurial > hg > maltfilter

annotate README @ 59:69c39b5c6277

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Typofix.
author Matti Hamalainen <ccr@tnsp.org>
date Mon, 17 Aug 2009 03:58:41 +0300
parents a70493b6c916
children 8b33436dd18b
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
57
a70493b6c916 Clear %statlist and %ignorelist when re-initializing (due to HUP), so we don't count stats twice.
Matti Hamalainen <ccr@tnsp.org>
parents: 55
diff changeset
1 Malicious Attack Livid Termination Filter daemon (maltfilter) v0.13.1
27
632bce74cf38 v0.10.0
Matti Hamalainen <ccr@tnsp.org>
parents: 23
diff changeset
2 =====================================================================
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
3 Programmed by Matti 'ccr' Hämäläinen <ccr@tnsp.org>
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
4 (C) Copyright 2009 Tecnic Software productions (TNSP)
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
5
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
6 Distributed under the modified ("3-clause") BSD license. Please see
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
7 included file COPYING for more information.
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
8
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
9 About
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
10 =====
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
11 Automagic management script for adding and removing Netfilter/iptables
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
12 filtering rules based on continuous logfile parsing for certain break-in
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
13 and exploitation scanning attempts.
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
14
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
15 Maltfilter daemon script continuously scans various system logfiles
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
16 including auth.log, httpd logs, etc. for signs of malicious connections
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
17 break-in and exploitation attempts. The originating IP addresses of
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
18 these connections are then blocked via Netfilter (iptables).
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
19
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
20 Requirements:
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
21
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
22 - Perl 5.8 or later
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
23 - Date::Parse (libtimedate-perl)
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
24 - Net::IP (libnet-ip-perl)
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
25
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
26
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
27 Installation
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
28 ============
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
29 Copy maltfilter script to /usr/sbin and set permissions
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
30
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
31 $ cp maltfilter /usr/sbin/maltfilter
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
32 $ chmod 755 /usr/sbin/maltfilter
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
33 $ chown root:root /usr/sbin/maltfilter
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
34
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
35 Copy example configuration under /etc (you may not want to
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
36 to have the configuration readable to regular users, so below
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
37 example sets mode 600 to it.)
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
38
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
39 $ cp example.conf /etc/maltfilter.conf
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
40 $ chmod 600 /etc/maltfilter.conf
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
41 $ chown root:root /etc/maltfilter.conf
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
42
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
43
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
44 Optional
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
45 ========
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
46 Additionally you can set up the provided Debian style init script:
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
47
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
48 $ cp example.init /etc/init.d/maltfilter
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
49 $ chmod 755 /etc/init.d/maltfilter
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
50 $ chown root:root /etc/init.d/maltfilter
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
51
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
52 You need to edit the script, if you didn't install the configuration
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
53 and maltfilter to paths described in installation section.
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
54
48
f6af53354c17 Update documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 47
diff changeset
55 Also a simple example HTML CSS stylesheet is provided for your convenience.
f6af53354c17 Update documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 47
diff changeset
56
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
57
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
58 Configuration and usage
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
59 =======================
42
23beaa7095fe Update documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 40
diff changeset
60 See example.conf for documentation about settings.
0
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
61 Start maltfilter either via the init script or through commandline:
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
62
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
63 $ maltfilter /var/run/maltfilter.pid /etc/maltfilter.conf
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
64
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
65 If you want to use the init script, you need to edit your init runlevel
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
66 settings to enable it, for example in Debian/Ubuntu you can use rcconf(8)
fec14263801d Initial import of maltfilter development version.
Matti Hamalainen <ccr@tnsp.org>
parents:
diff changeset
67 or chkconfig(8).
11
26c2cc5077aa Added reporting functionality.
Matti Hamalainen <ccr@tnsp.org>
parents: 6
diff changeset
68
15
b05d0f0ff106 Cleanups in progress, does not work.
Matti Hamalainen <ccr@tnsp.org>
parents: 13
diff changeset
69
13
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
70 Reports
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
71 =======
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
72 Automatic report generation can be enabled from configuration.
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
73 You can also run "full" report generation via the "-f" option, in this
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
74 special mode, no automatic weeding is performed, resulting in
fc053b001027 Improved reporting and documentation.
Matti Hamalainen <ccr@tnsp.org>
parents: 11
diff changeset
75 more data being shown.