Guard: watch logs, ban misbehaving addresses in Housecarl
Files and the journal, patterns with one <IP>, bounties within a window, bans in a Housecarl ban list with repeat offenders' bans growing; presets for sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot, nginx-auth and housecarl-drops; guard run/check/test/status/bans/ban/unban; a Debian package with a sandboxed unit; an end-to-end test with Housecarl. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
abrown38andClaude Opus 5.5 committed
commit
d06bf8d531
47 files changed
+4614
No files matched your search
Vendored
+4
@@ -0,0 +1,4 @@
|
||||
203.0.113.9 client @0x7f3a1c0e4168 203.0.113.9#41234 (example.com): view external: zone transfer 'example.com/AXFR/IN' denied
|
||||
2001:db8::9 client @0x7f3a1c0e4168 2001:db8::9#41234 (example.com): zone transfer 'example.com/AXFR/IN' denied
|
||||
- client @0x7f3a1c0e4168 203.0.113.9#41234 (example.com): view external: query (cache) 'example.com/ANY/IN' denied
|
||||
- client @0x7f3a1c0e4168 10.0.10.2#41234 (example.com): transfer of 'example.com/IN': AXFR started
|
||||
Vendored
+4
@@ -0,0 +1,4 @@
|
||||
203.0.113.9 imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 12 secs): user=<admin>, method=PLAIN, rip=203.0.113.9, lip=10.0.10.25, TLS, session=<abc>
|
||||
203.0.113.9 pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<test>, method=PLAIN, rip=203.0.113.9, lip=10.0.10.25, session=<abc>
|
||||
203.0.113.9 imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<a>, rip=8.8.8.8, x>, method=PLAIN, rip=203.0.113.9, lip=10.0.10.25, session=<abc>
|
||||
- imap-login: Login: user=<adam>, method=PLAIN, rip=10.0.10.20, lip=10.0.10.25, mpid=1234, TLS
|
||||
Vendored
+6
@@ -0,0 +1,6 @@
|
||||
203.0.113.9 time=2026-10-22T10:00:00.000Z level=WARN msg="login failed" ip=203.0.113.9 user=admin reason="wrong username or password"
|
||||
2001:db8::9 time=2026-10-22T10:00:00.000Z level=WARN msg="token refused" ip=2001:db8::9 reason="wrong token secret"
|
||||
203.0.113.9 time=2026-10-22T10:00:00.000Z level=WARN msg="login failed" ip=203.0.113.9 user="x ip=8.8.8.8" reason="wrong username or password"
|
||||
203.0.113.9 {"time":"2026-10-22T10:00:00Z","level":"WARN","msg":"login failed","ip":"203.0.113.9","user":"admin","reason":"wrong username or password"}
|
||||
- time=2026-10-22T10:00:00.000Z level=INFO msg="configuration changed" history=3 user=admin
|
||||
- time=2026-10-22T10:00:00.000Z level=WARN msg="token used with its old secret" ip=203.0.113.9
|
||||
Vendored
+6
@@ -0,0 +1,6 @@
|
||||
203.0.113.9 time=2026-10-22T10:00:00.000Z level=WARN msg="login failed" ip=203.0.113.9 user=admin reason="wrong username or password"
|
||||
2001:db8::9 time=2026-10-22T10:00:00.000Z level=WARN msg="token refused" ip=2001:db8::9 reason="wrong token secret"
|
||||
203.0.113.9 time=2026-10-22T10:00:00.000Z level=WARN msg="login failed" ip=203.0.113.9 user="x ip=8.8.8.8" reason="wrong username or password"
|
||||
203.0.113.9 {"time":"2026-10-22T10:00:00Z","level":"WARN","msg":"login failed","ip":"203.0.113.9","user":"admin","reason":"wrong username or password"}
|
||||
- time=2026-10-22T10:00:00.000Z level=INFO msg="configuration changed" history=3 user=admin
|
||||
- time=2026-10-22T10:00:00.000Z level=WARN msg="token used with its old secret" ip=203.0.113.9
|
||||
Vendored
+3
@@ -0,0 +1,3 @@
|
||||
203.0.113.9 2026/10/22 10:00:00 [error] 1234#1234: *5 user "admin" was not found in "/etc/nginx/.htpasswd", client: 203.0.113.9, server: example.com, request: "GET / HTTP/1.1", host: "example.com"
|
||||
203.0.113.9 2026/10/22 10:00:00 [error] 1234#1234: *5 user "adam": password mismatch, client: 203.0.113.9, server: example.com, request: "GET / HTTP/1.1"
|
||||
- 2026/10/22 10:00:00 [error] 1234#1234: *5 open() "/var/www/favicon.ico" failed (2: No such file or directory), client: 203.0.113.9, server: example.com
|
||||
Vendored
+3
@@ -0,0 +1,3 @@
|
||||
203.0.113.9 warning: unknown[203.0.113.9]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
|
||||
203.0.113.9 warning: scanner.example.net[203.0.113.9]: SASL PLAIN authentication failed: authentication failure
|
||||
- warning: hostname 203-0-113-9.example.net does not resolve to address 203.0.113.9
|
||||
Vendored
+15
@@ -0,0 +1,15 @@
|
||||
# Each line: the address a match should give (- for none), a tab, the log line.
|
||||
203.0.113.9 Failed password for root from 203.0.113.9 port 51234 ssh2
|
||||
203.0.113.9 Failed password for invalid user admin from 203.0.113.9 port 51234 ssh2
|
||||
2001:db8::9 Failed publickey for git from 2001:db8::9 port 4022 ssh2
|
||||
203.0.113.9 Oct 22 10:00:01 web sshd-session[1234]: Failed password for invalid user oracle from 203.0.113.9 port 4022 ssh2
|
||||
203.0.113.9 Invalid user test from 203.0.113.9 port 40022
|
||||
203.0.113.9 Connection closed by invalid user admin 203.0.113.9 port 40022 [preauth]
|
||||
203.0.113.9 Disconnected from authenticating user root 203.0.113.9 port 40022 [preauth]
|
||||
203.0.113.9 error: maximum authentication attempts exceeded for root from 203.0.113.9 port 40022 ssh2 [preauth]
|
||||
203.0.113.9 Unable to negotiate with 203.0.113.9 port 40022: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1
|
||||
203.0.113.9 banner exchange: Connection from 203.0.113.9 port 40022: invalid format
|
||||
203.0.113.10 Failed password for invalid user x from 198.51.100.1 port 22 from 203.0.113.10 port 4444 ssh2
|
||||
- Accepted publickey for adam from 10.0.10.20 port 51000 ssh2: ED25519 SHA256:xyz
|
||||
- Received disconnect from 203.0.113.9 port 40022:11: disconnected by user
|
||||
- Server listening on 0.0.0.0 port 22.
|
||||
Vendored
+6
@@ -0,0 +1,6 @@
|
||||
203.0.113.9 time=2026-10-22T10:00:00.000Z level=WARN msg="login failed" ip=203.0.113.9 user=admin reason="wrong username or password"
|
||||
2001:db8::9 time=2026-10-22T10:00:00.000Z level=WARN msg="token refused" ip=2001:db8::9 reason="wrong token secret"
|
||||
203.0.113.9 time=2026-10-22T10:00:00.000Z level=WARN msg="login failed" ip=203.0.113.9 user="x ip=8.8.8.8" reason="wrong username or password"
|
||||
203.0.113.9 {"time":"2026-10-22T10:00:00Z","level":"WARN","msg":"login failed","ip":"203.0.113.9","user":"admin","reason":"wrong username or password"}
|
||||
- time=2026-10-22T10:00:00.000Z level=INFO msg="configuration changed" history=3 user=admin
|
||||
- time=2026-10-22T10:00:00.000Z level=WARN msg="token used with its old secret" ip=203.0.113.9
|
||||
Reference in new issue
Block a user