Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to invoke sending an e-mail (or running a particular script, if that would be possible) when a certain iptables DROP rule is being run. (For instance, when I'm blocking an IP after 5 failed SSH logins, I'd like to run mail -s "SSH Blocked" info@example.com or something similar. Is there a way to directly have iptables execute this?

If not, then I guess I'd need to scan the logs with an external tool and then send out emails. Any recommended tool for this? Please note that I'm using systemd so I am using journalctl and not old fashioned log files.

share|improve this question
5  
I think you might want to look into fail2ban –  ponsfonze Dec 31 '12 at 4:03
2  
On a typical Internet facing system, doing this you will likely result in you receiving far more email than you want. –  John Gardeniers Dec 31 '12 at 6:05
1  
fail2ban or denyhosts –  Andy Lester Dec 31 '12 at 6:12

1 Answer 1

up vote 4 down vote accepted

What I have been using for more that 5 years to alert sysadmins to this type of (and many others) event, is ossec hids (http://www.ossec.net) funded by Trend Micro.

Ossec does blocking and alerting by scanning logs in real-time. You can install it on the local machine, or on another server. It can function as a central syslog server. Most features can be tailored to your needs. For log aggregation and inspection (required in PCI environments), I have not found many other applications that surpass what Ossec offers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.