Fail2stat - Versionsgeschichte

Codecivil: /* The converter */ add zeroes to first nine days

2017-02-07T18:36:39Z

The converter: add zeroes to first nine days

2017-01-17T12:14:29Z

webalizer configuration

2017-01-17T12:09:30Z

The converter

2017-01-17T12:06:02Z

2017-01-16T13:53:51Z

webalizer configuration

2017-01-16T13:51:30Z

The converter

2017-01-16T13:47:47Z

The converter

2017-01-16T13:45:16Z

added logrotation

2017-01-16T13:35:57Z

first draft of manual finished

2017-01-16T12:51:26Z

@@ Zeile 29: / Zeile 29: @@
                  MONTH_NUMBER="$(date -d "$MONTH 1, $YEAR" +%m)"
                  if [[ $((MONTH_NUMBER-1)) -ge $(date +%m) ]]; then YEAR=$((YEAR -1)); fi
+                 #
                  DAEMON="${DAEMON%%[*}"

@@ Zeile 154: / Zeile 154: @@
 The two "Cache" lines make sure that unresolvable IPs are not tried to be resolved all the time, the next time only after 30 days. This is useful because a lot of the devices trying to break into your system are not resolvable.
-The use of GeoDB is strongly recommended if you want to have a country diagram without the break-in attempts reducing your bandwith any further. Apart from choosing "yes" in the config file you have to make sure that the latest GeoDB is installed at the path givebn by GeoDBDatabase.
+The use of GeoDB is strongly recommended if you want to have a country diagram without the break-in attempts reducing your bandwith any further. Apart from choosing "yes" in the config file you have to make sure that the latest GeoDB is installed at the path given by GeoDBDatabase.
 The 0s at the "Top" entries disable these data; they have no meaning in the converter.

@@ Zeile 14: / Zeile 14: @@
 NAME="$2"
 LOGPATH="$3"
 TMP="/tmp/fail2stat$(date +%s)" # tmp file distinguishing seconds for handling rapid attacks
 # get the log lines
@@ Zeile 26: / Zeile 25: @@
                  # as the year is not part of the log line, we have to take
                  # extra care around New Year.
                  # Adapt the date command to suit your locale.
                  MONTH_NUMBER="$(date -d "$MONTH 1, $YEAR" +%m)"
@@ Zeile 35: / Zeile 35: @@
                  USER="${MSG##*user?}"; USER="${USER%%_*}";
                  # the numbers 200 and 1024 are arbitrary
-                 echo "$IP - $USER [$DAY/$MONTH/$YEAR:$TIME +0000] \"GET /$NAME/$MSG/ HTTP/1.1\" 200 1024 \"-\" \"$TARGET/$DAEMON\"" >> /var/log/fail2stat.log
+                 echo "$IP - \"$USER\" [$DAY/$MONTH/$YEAR:$TIME +0000] \"GET /$NAME/$MSG/ HTTP/1.1\" 200 1024 \"-\" \"$TARGET/$DAEMON\"" >> /var/log/fail2stat.log
          done < $TMP
 rm $TMP

@@ Zeile 68: / Zeile 68: @@
 Append the following lines to <nowiki>/etc/fail2ban/jail.local</nowiki> under [Default] > ACTIONS. First, define the statistics action
 <pre># statistics action
-stat = webalizer
+stat = fail2stat
 </pre>
 Append the statistics action at your favorite action shortcut, e.g. create
@@ Zeile 81: / Zeile 81: @@
 If you have defined jails with individual actions, take care to include the statistics action there as well.
-==== action.d/webalizer.conf ====
+==== action.d/fail2stat.conf ====
 Copy a standard configuration file and change the line defining actionban to
 <pre>actionban = /usr/local/bin/fail2stat <ip> <name> <logpath></pre>
@@ Zeile 137: / Zeile 137: @@
 CacheIPs yes
 CacheTTL 30
 </pre>
-The OutputDir must match the DocumentRoot of the apache configuration. The last two lines make sure that unresolvable IPs are not tried to be resolved all the time, the next time only after 30 days. This is useful because a lot of the devices trying to break into your system are not resolvable.
+The OutputDir must match the DocumentRoot of the apache configuration.
 Test your configuration by <pre>webalizer -c /etc/webalizer/fail2stat.conf</pre>, maybe with root privileges, depending on your webalizer installation.

@@ Zeile 134: / Zeile 134: @@
 LogFile /var/log/fail2stat.log.1
 OutputDir /var/www/fail2stat
 CacheIPs yes
 CacheTTL 30

@@ Zeile 15: / Zeile 15: @@
 LOGPATH="$3"
 YEAR="$(date +%Y)"
 # get the log lines
-grep $IP $LOGPATH > /tmp/fail2stat
+grep $IP $LOGPATH > $TMP
 # don't process if they are from an apache log file
-if [[ "$LOGPATH" == *"apache"* ]]; then cat /tmp/fail2stat >> /var/log/fail2stat.log; rm /tmp/fail2stat; exit 0; fi
+if [[ "$LOGPATH" == *"apache"* ]]; then cat $TMP >> /var/log/fail2stat.log; rm /tmp/fail2stat; exit 0; fi
 # processing in the following way is valid for auth.log and mail.log;
 # adapt if you need differently formatted logs
@@ Zeile 35: / Zeile 36: @@
                  # the numbers 200 and 1024 are arbitrary
                  echo "$IP - $USER [$DAY/$MONTH/$YEAR:$TIME +0000] \"GET /$NAME/$MSG/ HTTP/1.1\" 200 1024 \"-\" \"$TARGET/$DAEMON\"" >> /var/log/fail2stat.log
-         done < /tmp/fail2stat
+         done < $TMP
-rm /tmp/fail2stat
+rm $TMP
 exit 0
 </pre>

@@ Zeile 38: / Zeile 38: @@
 </pre>
 == fail2ban configuration ==
@@ Zeile 109: / Zeile 129: @@
 <pre>
 OutputDir /var/www/fail2stat
 CacheIPs yes
@@ Zeile 116: / Zeile 137: @@
 The OutputDir must match the DocumentRoot of the apache configuration. The last two lines make sure that unresolvable IPs are not tried to be resolved all the time, the next time only after 30 days. This is useful because a lot of the devices trying to break into your system are not resolvable.
-Test your configuration by <nowiki>webalizer -c /etc/webalizer/fail2stat.conf</nowiki>, maybe with root privileges, depending on your webalizer installation.
+Test your configuration by <pre>webalizer -c /etc/webalizer/fail2stat.conf</pre>, maybe with root privileges, depending on your webalizer installation.
 == That's It ==
 Now you should be able to see some useful statistics of fail2ban visiting http://yourserver.local.

@@ Zeile 55: / Zeile 55: @@
 and, finally, set the default action to include statistics:
 <pre>action = %(action_mwls)s</pre>
 ==== action.d/webalizer.conf ====
 Copy a standard configuration file and change the line defining actionban to
 <pre>actionban = /usr/local/bin/fail2stat <ip> <name> <logpath></pre>
-The complete file might look like this.
+The complete file might look like this (to be uploaded).