"tripwire" setup about fail2ban HOT 6 CLOSED

Could you just log iptables to some file (using syslog) and have fail2ban watch that file? If you already have iptables logging through syslog, use the log-prefix and a fail2ban regex to look for it....seems simple enough to do out-of-band :)

A more user-friendly way to get this going is all I can think of regarding changes to fail2ban...a jail config and setting for the iptables/syslog regex to look for....

from fail2ban.

yes yes yes -- it should be indeed quite trivial to work out -- just might be dependent on syslog configuration on where it dumps the iptables logs, otherwise it is just trivial and would not require any fail2ban code change -- just an action (to set iptable's log actions), filter (to monitor corresponding log with dumped logs from iptables) + jail ;-)

from fail2ban.

Seems excessive now that I think about it, would require logging every DROP/REJECT or inserting a rule where fail2ban does not usually (before any drop? dynamically somehow to see all traffic not explicitly accepted?). I'd probably suggest closing this Issue without further ideas.

from fail2ban.

well -- someone motivated could still come up with some recipe for piping those LOGs to fail2ban (thus avoiding permanent file storage) etc. Just a wishlist, so why not to keep it floating around?

from fail2ban.

Fair enough, I was flipping through the 100+ issues looking for something to help with and was a bit overcome/scattered by so many ... I'll say spurious, for lack of a better word ... requests. This particularly was a bit counter-intuitive to what I have learned as best firewall logging practice, so feel unlikely to be implemented even if coded into fail2ban. Just my two-cents :)

from fail2ban.

ok -- tagged with a brand new tag and closed to improve SNR on the issue tracker ;)

from fail2ban.