iptablesソスソスソスOソスソスソス(IPTables log analyzer)

ソスナ終ソスXソスVソスソスソスF 2014.02.19

<<ソスgソスbソスvソスyソス[ソスW <<ソスVソスソスソスソスソス <<ソスTソスCソスgソスソスソスソスソスソス <<CentOSソスナ趣ソスソスソスTソス[ソスoソス[ソス\ソスz <<Scientific Linuxソスナ趣ソスソスソスTソス[ソスoソス[ソス\ソスz

ソスソスソスTソスv

IPTables log analyzerソス導難ソスソスソスソスト、iptablesソスフソスソスOソスソスWebソスuソスソスソスEソスUソスソスソス辜奇ソスAソスソスソス^ソスCソスソスソスノ参ソスニゑソスソス驍アソスニゑソスソスナゑソスソスソス謔、ソスノゑソスソスソスBソスソスソスXソスiソスbソスvソスVソスソスソスbソスg

ソスソスソスtソス@ソスCソスAソスEソスHソス[ソスソスソスAWebソスTソス[ソスoソス[+PHPソスAMySQLソスfソス[ソス^ソスxソス[ソスXソスソスソス\ソスzソスマでゑソスソス驍アソスソス


ソスソスIPTables log analyzerソスCソスソスソスXソスgソス[ソスソス

[root@fedora ~]# wget http://jaist.dl.sourceforge.net/sourceforge/iptablelog/iptablelog-v0.9.tar.bz2
ソス@ソスソスソス@IPTables log analyzerソス_ソスEソスソスソスソスソス[ソスh

ソスソスソスナ新ソスナゑソスURLソスソスソス_ソスEソスソスソスソスソス[ソスhソスyソス[ソスWソスナ確ソスFソスソスソス驍アソスソス

[root@fedora ~]# tar jxvf iptablelog-v0.9.tar.bz2ソス@ソスソスソス@IPTables log analyzerソスWソスJ

[root@fedora ~]# mv iptablelog/ /var/wwwソス@ソスソスソス@IPTables log analyzerソスWソスJソスソスfソスBソスソスソスNソスgソスソスソスソスソスソスソスソスフデソスBソスソスソスNソスgソスソスソスヨ移難ソス

[root@fedora ~]# rm -f iptablelog-v0.9.tar.bz2ソス@ソスソスソス@ソス_ソスEソスソスソスソスソス[ソスhソスソスソスソスソスtソス@ソスCソスソスソスソスソス除

ソスソスIPTables log analyzerソスpソスfソス[ソス^ソスxソス[ソスXソス成

ソスiソスPソスjIPTables log analyzerソスpソスfソス[ソス^ソスxソス[ソスXソス成
IPTables log analyzerソスソスiptablesソスフソスソスOソスソスMySQLソスfソス[ソス^ソスxソス[ソスXソスノ保托ソスソスソスソス驍スソス゚、IPTables log analyzerソスpソスフデソス[ソス^ソスxソス[ソスXソスソスMySQLソスノ作成ソスソスソスソスB
[root@fedora ~]# mysql -u root -pソス@ソスソスソス@MySQLソスソスrootソスナソスソスOソスCソスソス
Enter password: ソス@ソスソスソス@MySQLソスソスrootソスpソスXソスソスソス[ソスhソスソスソスソス
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 6
Server version: 5.0.37 Source distribution

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> create database iptablelog;ソス@ソスソスソス@iptablelogソスfソス[ソス^ソスxソス[ソスXソス成
Query OK, 1 row affected (0.00 sec)

mysql> grant all on iptablelog.* to iptablelog_user@localhost identified by 'ソスpソスXソスソスソス[ソスh';
ソス@ソスソスソス@iptablelogソスfソス[ソス^ソスxソス[ソスXソスAソスNソスZソスXソスソスソス[ソスUソス成
Query OK, 0 rows affected (0.00 sec)

mysql> exitソス@ソスソスソス@MySQLソスソスソス辜搾ソスOソスAソスEソスg
Bye

[root@fedora ~]# cat /var/www/iptablelog/conf/iptables.mysql | mysql -u iptablelog_user -pソスpソスXソスソスソス[ソスh iptablelog
ソス@ソスソスソス@iptablelogソスfソス[ソス^ソスxソス[ソスXソスソスソスソスソスソスソスソスソスpソスXソスソスソス[ソスhソスソスiptablesソスfソス[ソス^ソスxソス[ソスXソスAソスNソスZソスXソスソスソス[ソスUソスフパソスXソスソスソス[ソスh

ソスiソスQソスjphp-mysqlソスCソスソスソスXソスgソス[ソスソス
IPTables log analyzerソスソスPHPソスナ難ソスソスすソス驍スソス゚、PHPソスソスソスソスMySQLソスfソス[ソス^ソスxソス[ソスXソスヨ接托ソスソスソスソス驍スソス゚のパソスbソスPソス[ソスWソスナゑソスソスソスphp-mysqlソスソスソスCソスソスソスXソスgソス[ソスソスソスソスソスソスB
[root@fedora ~]# rpm -q php-mysqlソス@ソスソスソス@php-mysqlソスCソスソスソスXソスgソス[ソスソスソスmソスF
ソスpソスbソスPソス[ソスW php-mysql ソスヘイソスソスソスXソスgソス[ソスソスソスソスソスソストゑソスソスワゑソスソスソスB

[root@fedora ~]# yum -y install php-mysqlソス@ソスソスソス@php-mysqlソスCソスソスソスXソスgソス[ソスソスソスソスソスCソスソスソスXソスgソス[ソスソスソスソスソスソストゑソスソスネゑソスソス鼾ソスフゑソス

ソスソスulogdソスCソスソスソスXソスgソス[ソスソス

iptablesソスフソスソスOソスソスulogdソスoソスRソスソスMySQLソスfソス[ソス^ソスxソス[ソスXソスノ保托ソスソスソスソス驍スソス゚、ulogdソスソスソスCソスソスソスXソスgソス[ソスソスソスソスソスソスB
[root@fedora ~]# yum -y install ulogd ulogd-mysql

ソスソスulogdソスン抵ソス

iptablesソスフソスソスOソスソスulogdソスoソスRソスソスMySQLソスfソス[ソス^ソスxソス[ソスXソスヨ保托ソスソスソスソスソス謔、ソスノ設定すソスソスB
[root@fedora ~]# vi /etc/ulogd.conf 
#
# ulogd_BASE.so - interpreter plugin for basic IPv4 header fields
#                 you will always need this
plugin="/usr/lib/ulogd/ulogd_BASE.so"
plugin="/usr/lib/ulogd/ulogd_LOCAL.so"ソス@ソスソスソス@ソスヌ会ソス

# output plugins.
#plugin="/usr/lib/ulogd/ulogd_LOGEMU.so"ソス@ソスソスソス@ソスRソスソスソスソスソスgソスAソスEソスg
#plugin="/usr/lib/ulogd/ulogd_OPRINT.so"
plugin="/usr/lib/ulogd/ulogd_MYSQL.so"ソス@ソスソスソス@ソスRソスソスソスソスソスgソスソスソスソス
#plugin="/usr/lib/ulogd/ulogd_PGSQL.so"
#plugin="/usr/lib/ulogd/ulogd_SQLITE3.so"
#plugin="/usr/lib/ulogd/ulogd_PCAP.so"

[MYSQL]
table="ulog"
pass="ソスpソスXソスソスソス[ソスh"ソス@ソスソスソス@iptablelogソスfソス[ソス^ソスxソス[ソスXソスAソスNソスZソスXソスソスソス[ソスUソスpソスXソスソスソス[ソスhソスン抵ソス
user="iptablelog_user"ソス@ソスソスソス@iptablelogソスfソス[ソス^ソスxソス[ソスXソスAソスNソスZソスXソスソスソス[ソスUソスソスソスン抵ソス
db="iptablelog"ソス@ソスソスソス@iptablelogソスfソス[ソス^ソスxソス[ソスXソスソスソスン抵ソス
host="localhost"

ソスソスulogdソスNソスソス

[root@fedora ~]# /etc/rc.d/init.d/ulogd start
ulogd ソスソスソスNソスソスソスソス:                                            [  OK  ]

[root@fedora ~]# chkconfig ulogd on

[root@fedora ~]# chkconfig --list ulogd 
ulogd           0:off   1:off   2:on    3:on    4:on    5:on    6:off

ソスソスiptablesソスン抵ソス

iptablesソスソスソスOソスソスulogdソスノ出ソスヘゑソスソスソス謔、ソスソスiptablesソスソスン定すソスソスB
ソスソスソスソスソスナは、ソスソスニゑソスソスト、ソスソスMソスpソスPソスbソスgソスソスiptablesソスフソスソスOソスLソス^ソスン抵ソスソスソスソスソスソスソスB
iptables -A INPUT -m limit --limit 1/s -j ULOG --ulog-nlgroup 1 --ulog-prefix 'INPUT'

ソスソスソスtソス@ソスCソスAソスEソスHソス[ソスソスソス\ソスz(iptables)ソスソスソスQソスlソスノゑソスソストフソス@ソスCソスAソスEソスHソス[ソスソスソスン抵ソスXソスNソスソスソスvソスgソスソスソス成ソスソスソストゑソスソスソス鼾ソスヘ、ソスtソス@ソスCソスAソスEソスHソス[ソスソスソスン抵ソスXソスNソスソスソスvソスgソスフ奇ソスソスソスソスソスソスOソスoソスヘコソス}ソスソスソスhソスソスソスソスヨ、ulogdソスヨのソスソスOソスoソスヘコソス}ソスソスソスhソスソスヌ会ソスソスソスソストフソス@ソスCソスAソスEソスHソス[ソスソスソスン抵ソスXソスNソスソスソスvソスgソスソスソスソスソスsソスソスソス驍アソスソス(ソスソスソスLソスQソスソス)
iptables -A INPUT -m limit --limit 1/s -j LOG --log-prefix '[IPTABLES INPUT] : '
iptables -A INPUT -m limit --limit 1/s -j ULOG --ulog-nlgroup 1 --ulog-prefix 'INPUT'ソス@ソスソスソス@ソスヌ会ソス

ソスソスIPTables log analyzerソスン抵ソス

[root@fedora ~]# cp /var/www/iptablelog/conf/config.php.default /var/www/iptablelog/conf/config.php

[root@fedora ~]# vi /var/www/iptablelog/conf/config.php
# Password of the MySQL database
$db_password="ソスpソスXソスソスソス[ソスh";ソス@ソスソスソス@iptablelogソスfソス[ソス^ソスxソス[ソスXソスAソスNソスZソスXソスソスソス[ソスUソスpソスXソスソスソス[ソスhソスン抵ソス

# File Path to your installation
$file_base="/var/www/iptablelog"; # i.e. "/var/www/html/iptablelog"ソス@ソスソスソス@iptablelogWebソスfソスBソスソスソスNソスgソスソスソスソスソスン抵ソス

[root@fedora ~]# cp /var/www/iptablelog/conf/iptables_resolve.default /etc/cron.hourly/iptables_resolve
ソス@ソスソスソス@IPソスAソスhソスソスソスXソスソスソスOソスソスソスソスソスXソスNソスソスソスvソスgソスソスソスソスソスソスソスソスソスソスソスsソスfソスBソスソスソスNソスgソスソスソスヨコソスsソス[

[root@fedora ~]# vi /etc/cron.hourly/iptables_resolveソス@ソスソスソス@IPソスAソスhソスソスソスXソスソスソスOソスソスソスソスソスXソスNソスソスソスvソスgソスメ集
$iptablelog_path = "/var/www/iptablelog"; # Change thisソス@ソスソスソス@iptablelogWebソスfソスBソスソスソスNソスgソスソスソスソスソスン抵ソス

db_connect("localhost","iptablelog","iptablelog_user", "ソスpソスXソスソスソス[ソスh");  # Change these db settings
ソス@ソスソスソス@iptablelogソスfソス[ソス^ソスxソス[ソスXソスAソスNソスZソスXソスソスソスン抵ソス

ソスソスApacheソスン抵ソス

[root@fedora ~]# vi /etc/httpd/conf.d/iptables.confソス@ソスソスソス@IPTables log analyzerソスpApacheソスン抵ソスtソス@ソスCソスソスソス成
Alias /iptablelog /var/www/iptablelog

ソスソスソスネ会ソスソスヘ難ソスソスソスソスソスソスソスフみ参ソスニでゑソスソスソス謔、ソスノゑソスソスソス鼾ソスフゑソス
<Location /iptablelog>
    Order deny,allow
    Deny from all
    Allow from 127.0.0.1
    Allow from 192.168.1.0/24ソス@ソスソスソス@ソスソスソスソスソスlソスbソスgソスソスソス[ソスNソスAソスhソスソスソスXソスソスソスwソスソス
</Location>

[root@fedora ~]# /etc/rc.d/init.d/httpd reloadソス@ソスソスソス@Apacheソスン定反ソスf
httpd ソスソスソスト読み搾ソスソスン抵ソス:                                      [  OK  ]

ソスソスIPTables log analyzerソスmソスF

http://ソスTソス[ソスoソス[ソスソス/iptablelog/ソスナアソスNソスZソスXソスソスソスト、ソスIPTables logsソスソスyソス[ソスWソスソスソス\ソスソスソスソスソスソス驍アソスニゑソスソスmソスF


ソスソスソスヨ連ソスRソスソスソスeソスソスソスc

<!ソス\ソスeソスLソスXソスgソスフみゑソス4ソスsソス\ソスソスソスノ追会ソスソスソスCソスソスソスソスソスソス\>



ソスソスソスソスソスフペソス[ソスWソスフトソスbソスvソスヨ戻ゑソス

ソスvソスソスソスCソスoソスVソス[ソス|ソスソスソスVソス[