All pastes #898258 Raw Edit

Unnamed

public text v1 · immutable
·published 2008-02-10 05:10 UTC
rendered paste body
file "/var/log/messages" {
  syslog =1;
  type "failed su(1) attempt" {
    match = "BAD SU %USER:FROM% to %USER:TO% on %TTY%";
    reaction = "echo 'Failed su(1): %USER:FROM% -> %USER:TO% (%TTY%)'";
  };
  type "ftp repeat offender" {
    match = "FTP LOGIN FAILED FROM %IP";
    threshold = "5";
    interval = 60;
    reaction = "ipfw -q table 1 add %IP%";
  };
};