CheckAuthLog Reference documentation - Revision history

John: /* CheckAuthLog Processing Logic */

2016-06-13T16:42:05Z

CheckAuthLog Processing Logic

← Older revision		Revision as of 18:42, 13 June 2016
Line 8:		Line 8:
	* update a Postfix access file		* update a Postfix access file
	* update a MySQL database		* update a MySQL database
	* update an Exim ~~block~~ file		* update an Exim acl file

	==Running from Crontab==		==Running from Crontab==

John: /* CheckAuthLog Processing Logic */

2016-06-13T16:41:06Z

CheckAuthLog Processing Logic

← Older revision		Revision as of 18:41, 13 June 2016
Line 4:		Line 4:

	The processing window is configured via the "expire" configuration variable. The limit for authentications is configured via the "auth_limit" variable. The limit for different ip addresses is configured via the "ip_limit" variable. To disable the authentication check or the ip limit check, set the value to 0.		The processing window is configured via the "expire" configuration variable. The limit for authentications is configured via the "auth_limit" variable. The limit for different ip addresses is configured via the "ip_limit" variable. To disable the authentication check or the ip limit check, set the value to 0.

			The blocking action taken by CheckAuthLog can be:
			* update a Postfix access file
			* update a MySQL database
			* update an Exim block file

	==Running from Crontab==		==Running from Crontab==

John: /* CheckAuthLog Processing Logic */

2016-06-13T16:40:11Z

CheckAuthLog Processing Logic

← Older revision		Revision as of 18:40, 13 June 2016
Line 3:		Line 3:
	CheckAuthLog defines a configurable processing window, default 3600 seconds (1 hour). CheckAuthLog allows an administrator to define the maximum number of authentications by a user in that processing window and/or the maximum number of different ip addresses used in the authentications. If those limits are exceeded the predefined blocking action is taken.		CheckAuthLog defines a configurable processing window, default 3600 seconds (1 hour). CheckAuthLog allows an administrator to define the maximum number of authentications by a user in that processing window and/or the maximum number of different ip addresses used in the authentications. If those limits are exceeded the predefined blocking action is taken.

	The processing window is configured via the "expire" configuration variable. The limit for authentications is configured via the "auth_limit" variable. The limit for different ip addresses is configured via the "ip_limit" variable.		The processing window is configured via the "expire" configuration variable. The limit for authentications is configured via the "auth_limit" variable. The limit for different ip addresses is configured via the "ip_limit" variable. To disable the authentication check or the ip limit check, set the value to 0.

	==Running from Crontab==		==Running from Crontab==

John: /* CheckAuthLog Processing Logic */

2016-06-13T16:36:15Z

CheckAuthLog Processing Logic

← Older revision		Revision as of 18:36, 13 June 2016
Line 1:		Line 1:
	==CheckAuthLog Processing Logic==		==CheckAuthLog Processing Logic==

			CheckAuthLog defines a configurable processing window, default 3600 seconds (1 hour). CheckAuthLog allows an administrator to define the maximum number of authentications by a user in that processing window and/or the maximum number of different ip addresses used in the authentications. If those limits are exceeded the predefined blocking action is taken.

			The processing window is configured via the "expire" configuration variable. The limit for authentications is configured via the "auth_limit" variable. The limit for different ip addresses is configured via the "ip_limit" variable.

	==Running from Crontab==		==Running from Crontab==

John at 16:31, 13 June 2016

2016-06-13T16:31:45Z

← Older revision		Revision as of 18:31, 13 June 2016
Line 1:		Line 1:
			==CheckAuthLog Processing Logic==



	==Running from Crontab==		==Running from Crontab==

John: /* Configuration File Reference */

2016-06-13T16:30:47Z

Configuration File Reference

← Older revision		Revision as of 18:30, 13 June 2016
Line 50:		Line 50:

	==Configuration File Reference==		==Configuration File Reference==
			<pre>
			;mta:
			; the mta. Default is postfix, also supported: exim
			mta = postfix

			;logfile:
			; the mail log file to parse, this must already exist and be readable.
			logfile = /var/log/maillog

			;logfile_rotated:
			; the mail log file to parse, this must already exist and be readable.
			logfile_rotated = /var/log/maillog-YYYYMMDD

			;cachefile:
			; a suitable location for storing info about last log file line read.
			; This file is created if it does not exist.
			cachefile = /tmp/.check_auth_log_cache

			;dbfile:
			; a suitable location for storing info about sasl authentications
			; login name, ip and timestamp are stored.
			; This file is created if it does not exist.
			dbfile = /tmp/.check_auth_log_db

			;dbtype:
			; type of database (depends on those supported by your install)
			; db4 is recommended.
			; This is a database for internal use and should not be confused
			; with the databsae used to hold uers (e.g. mysql). Do not set
			; this value to mysql.
			dbtype = db4

			;expire:
			; window time in seconds before sasl authentication records are
			; removed
			expire = 3600

			;auth_limit:
			; how many authentications per sasl username are allowed within
			; the expire window
			auth_limit = 100

			;ip_limit:
			; how many different ips per sasl username are allowed within the
			; expire window
			ip_limit = 5

			;max_auth_records:
			; the maximum number of auth session records to store
			; per sasl username
			max_auth_records = 200

			;posix:
			; whether to include posix functions for checking existing running
			; processes. Requires php posix extension. You can skip this
			; requirement (and relative checking) by setting to false. In
			; this case the stale_lock_time is used to determine how long
			; another process should be considered active before removing
			; its lock.
			;posix = true
			;
			;stale_lock_time:
			; the time to wait before considering another process not active
			;stale_lock_time = 300

			;block_type:
			; type of blocking method when users exceed predetermined limits
			; mysql: run a query defined by query_block.
			; access: write username to postfix access file defined by accessfile.
			; exim: use a file of blocked accounts
			block_type = mysql

			;accesfile:
			; defines the output file for postfix access map
			; This file is created if it does not exist.
			accessfile = /etc/postfix/smtp_auth_access.in

			;reject_msg:
			; the value to use on rhs of postfix access map
			reject_msg = REJECT send quota exceeded. Contact support to re-enable

			;sql_connect:
			; connect string for database in format
			; mysql://username:password@hostname:port/database
			sql_connect = mysql://username:password@hostname:port/database

			;sql_block:
			; query to run for blocking user access. %u is substituted with
			; the username
			sql_block = "update mailbox set active=0 where username='%u'"

			;sql_unblock:
			; query to run for unblocking user access. %u is substituted
			; with the username
			; example
			sql_unblock = "update mailbox set active=1 where username='%u'"

			;exim_block_file
			; file used by exim containing blocked email accounts
			;
			;exim_blcok_file = /tmp/blocklist

			; exim_temp_file
			; file used when updating the exim blocklist. Modifications are
			; done to a temporary file and then it is renamed
			; in order to avoid exim using the file while it is still being
			; updated.
			;
			;exim_temp_file = /tmp/blocklist.out
			</pre>

John: /* -d username */

2016-06-13T16:29:50Z

-d username

← Older revision		Revision as of 18:29, 13 June 2016
Line 23:		Line 23:
	===-d username===		===-d username===

	~~Deletes~~ the block, thereby re-enabling mail sending for the user.		Manually deletes the block, thereby re-enabling mail sending for the user.

	===-e email===		===-e email===

John at 16:29, 13 June 2016

2016-06-13T16:29:26Z

← Older revision		Revision as of 18:29, 13 June 2016
Line 17:		Line 17:
	Manually adds the user to the blocked users		Manually adds the user to the blocked users

	-c config_file~~: uses~~ the named configuration file instead of checking in /etc/check_auth_log.conf		===-c config_file===
	-d username~~: deletes~~ the block, thereby re-enabling mail sending for the user.
	-e email~~: sends~~ a test blocking notification email to the specified address. Useful for testing email setup and template without having to trigger a block.		Uses the named configuration file instead of checking in /etc/check_auth_log.conf
	-t ~~activates~~ tracing to standard output. Useful for debugging.
	-v ~~prints~~ the version and terminates		===-d username===
	-x ~~extract~~ the ~~authenication~~ entries from internal db. The database contains info on the authentication times and ip addresses. When new entries are added old ones are purged if no longer needed (older than expire time)
	-y ~~extract~~ the cache file entries from internal cache file db. The cache file contains info on the log lines already parsed and their offset in the mail log file.		Deletes the block, thereby re-enabling mail sending for the user.
	-z ~~runs~~ the self check routines only
			===-e email===

			Sends a test blocking notification email to the specified address. Useful for testing email setup and template without having to trigger a block.

			===-t===

			Activates tracing to standard output. Useful for debugging.

			===-v===

			Prints the version and terminates

			===-x===

			Extracts the authentication entries from internal db. The database contains info on the authentication times and ip addresses. When new entries are added old ones are purged if no longer needed (older than expire time).

			===-y===

			Extract the cache file entries from internal cache file db. The cache file contains info on the log lines already parsed and their offset in the mail log file.

			===-z===

			Runs the self check routines only

	==Configuration File Reference==		==Configuration File Reference==

John at 16:27, 13 June 2016

2016-06-13T16:27:13Z

← Older revision		Revision as of 18:27, 13 June 2016
Line 13:		Line 13:
	==Command Line Parameter Reference==		==Command Line Parameter Reference==

	~~This is a list of all parameters accepted:~~		===-a username===
	-a username~~: manually~~ adds the user to the blocked users
			Manually adds the user to the blocked users

	-c config_file: uses the named configuration file instead of checking in /etc/check_auth_log.conf		-c config_file: uses the named configuration file instead of checking in /etc/check_auth_log.conf
	-d username: deletes the block, thereby re-enabling mail sending for the user.		-d username: deletes the block, thereby re-enabling mail sending for the user.

John: /* Running from Crontab */

2016-06-13T16:12:50Z

Running from Crontab

← Older revision		Revision as of 18:12, 13 June 2016
Line 1:		Line 1:
	==Running from Crontab==		==Running from Crontab==

	After installing Check Auth Log the best way to run it is to schedule it in crontab, for example:		After installing and configuring Check Auth Log the best way to run it is to schedule it in crontab, for example:

	<pre>vi /etc/crontab</pre>		<pre>vi /etc/crontab</pre>