Linux · 2011-04-04

修改bfd的proftpd配置文件

无意间查看bfd的日志,没想竟然对proftpd的日志抓取有问题,没有更改的话 日志是这样的:

# 日志路径 /var/log/bfd_log
Apr  3 04:15:02 servername bfd(8813): {proftpd} ffffxx.xx.xx.xx exceeded login failures; executed ban command '/etc/apf/apf -d ffffxx.xx.xx.xx  {bfd.proftpd}'.
# 实际上,apf屏蔽的命令是 apf -d ffffxx.xx.xx.xx  

可能作者笔误吧,sed没有加上g,g的意思为全局替换,修改如下:

# bfd的规则 /usr/local/bfd/rules/proftpd
# failed logins from a single address before ban
# uncomment to override conf.bfd trig value
# TRIG="10"

# file must exist for rule to be active
REQ="/usr/sbin/proftpd"

if [ -f "$REQ" ]; then
 LP="$AUTH_LOG_PATH"
 TLOG_TF="proftpd"

 ## PROFTPD
 ## 修改这行 ARG_VAL=`$TLOG_PATH $LP $TLOG_TF | sed -e 's/::ffff://' | grep -E '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | tr -d ':' | sed -n -e '/proft
pd/s/.*USER \(.*\) no such user found from \([^ ]*\).*/\2:\1/p'`
fi

 ARG_VAL=`$TLOG_PATH $LP $TLOG_TF | sed -e 's/::ffff://g' | grep -E '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | tr -d ':' | sed -n -e '/proft
pd/s/.*USER \(.*\) no such user found from \([^ ]*\).*/\2:\1/p'`
fi
# 新版本的bfd不知道是否有修正这个BUG,否则bfd无法调用apf 自动对proftpd恶意连接进行屏蔽!
# 重启BFD, bfd -s