Administratoriaus užrašai

# /etc/logrotate.conf
#
# logrotate is designed to ease administration of systems that generate large
# numbers of log files.  It allows automatic rotation, compression, removal, and
# mailing of log files.  Each log file may be handled daily, weekly, monthly, or
# when it grows too large.
#
# logrotate is normally run daily from root's crontab.
#
# For more details, see "man logrotate".

# rotate log files weekly:
weekly

# keep 4 weeks worth of backlogs:
rotate 4

# create new (empty) log files after rotating old ones:
create

# uncomment if you want to use the date as a suffix of the rotated file
#dateext

# uncomment this if you want your log files compressed:
compress

# some packages install log rotation information in this directory:
include /etc/logrotate.d

# Rotate /var/log/wtmp:
/var/log/wtmp {
    monthly
    create 0664 root utmp
        minsize 1M
    rotate 1
}

# Rotate /var/log/btmp:
/var/log/btmp {
    monthly
    create 0600 root root
    rotate 1
}

# Note that /var/log/lastlog is not rotated.  This is intentional, and it should
# not be.  The lastlog file is a database, and is also a sparse file that takes
# up much less space on the drive than it appears.

# system-specific logs may be also be configured below:

# ls /etc/logrotate.d/
viso 28K
-rw-r--r-- 1 root root 213 Spa 17 12:09 httpd
-rw-r--r-- 1 root root 222 Spa 17 12:34 mcelog
-rw-r--r-- 1 root root 790 Spa 17 11:56 mysql
-rw-r--r-- 1 root root 264 Spa 17 12:19 syslog
-rw-r--r-- 1 root root 223 Spa 17 12:19 ulogd
-rw-r--r-- 1 root root 108 Spa 17 12:16 vsftpd
-rw-r--r-- 1 root root 100 Lie 31  2013 wpa_supplicant

/var/log/httpd/*_log {
  olddir /var/log/seni/httpd
  rotate 52
  notifempty
  missingok
  compress
  delaycompress
  create 640 root root
  sharedscripts
  postrotate
    /etc/rc.d/rc.httpd restart
  endscript
}

# logrotate -d /etc/logrotate.d/httpd
reading config file /etc/logrotate.d/httpd
olddir is now /var/log/seni/httpd

Handling 1 logs

rotating pattern: /var/log/httpd/*_log  1048576 bytes (52 rotations)
olddir is /var/log/seni/httpd, empty log files are not rotated, old logs are removed
considering log /var/log/httpd/*_log
  log /var/log/httpd/*_log does not exist -- skipping
not running postrotate script, since no logs were rotated

#!/bin/sh
# Script to generate blacklist in .rsc format
# WTF license by Meisteris
now=$(date);

# Variables
DocRoot=/srv/web/ownsystem.eu/htdocs
RSC=blacklist-temp.rsc
RSCP=blacklist.rsc
owner=apache:apache
header="# Generated by Meisteris on $now"

dshield='http://feeds.dshield.org/block.txt'
spamhaus='http://www.spamhaus.org/drop/drop.lasso'
openbl='http://www.openbl.org/lists/base_30days.txt.gz'
blocklistde='http://lists.blocklist.de/lists/all.txt'
badguys='http://cinsscore.com/list/ci-badguys.txt'
shunlist='http://www.autoshun.org/files/shunlist.csv'
forumspam='http://www.stopforumspam.com/downloads/toxic_ip_cidr.txt'
fullbogons='http://www.team-cymru.org/Services/Bogons/fullbogons-ipv4.txt'
honeypot='http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1'

# Grab a random value between 0-200.
value=$RANDOM
while [ $value -gt 200 ] ; do
  value=$RANDOM
done

# Sleep for that time.
sleep $value

# Setup Header
echo $header > $DocRoot/$RSC
echo "/ip firewall address-list" >> $DocRoot/$RSC

# Dshield http://feeds.dshield.org/block.txt
wget -q -O - $dshield | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.0\t/ { print "add list=blacklist address=" $1 "/24 comment=BlackList";}' >> $DocRoot/$RSC

# Spamhaus http://www.spamhaus.org/drop/drop.lasso
wget -q -O - $spamhaus | awk --posix '/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\// { print "add list=blacklist address=" $1 " comment=BlackList";}' >> $DocRoot/$RSC

# OpenBL http://www.openbl.org/lists/base_30days.txt.gz
wget -q -O - $openbl | gunzip | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=blacklist address=" $1 " comment=BlackList";}' >> $DocRoot/$RSC

# BlocklistDE http://lists.blocklist.de/lists/all.txt
wget -q -O - $blocklistde | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=blacklist address=" $1 " comment=BlackList";}' >> $DocRoot/$RSC

# Cinscore badguys http://cinsscore.com/list/ci-badguys.txt
wget -q -O - $badguys | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=blacklist address=" $1 " comment=BlackList";}' >> $DocRoot/$RSC

# Shunlist http://www.autoshun.org/files/shunlist.csv
wget -q -O - $shunlist | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}" | awk '{ print "add list=blacklist address=" $1 " comment=BlackList";}' >> $DocRoot/$RSC

# Forum SPAM http://www.stopforumspam.com/downloads/toxic_ip_cidr.txt
wget -q -O - $forumspam | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=blacklist address=" $1 " comment=BlackList";}' >> $DocRoot/$RSC

# Full bogons http://www.team-cymru.org/Services/Bogons/fullbogons-ipv4.txt
wget -q -O - $fullbogons | awk --posix '/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ { print "add list=blacklist address=" $1 " comment=BlackList";}' >> $DocRoot/$RSC

# Project Honey Pot Directory of Dictionary Attacker IPs http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1
wget -q -O - $honeypot | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}" | awk '{ print "add list=blacklist address=" $1 " comment=BlackList";}' >> $DocRoot/$RSC

# Remove duplicate entries and sort list
sort -u $DocRoot/$RSC > $DocRoot/$RSCP

# CleanUP and leave
rm $DocRoot/$RSC
chown $owner $DocRoot/$RSCP
chmod 640 $DocRoot/$RSCP
exit 0

# Script which will download the blacklist as a text file
/system script add name="Download_blacklist" source={
/tool fetch url="http://www.ownsystem.eu/blacklist.rsc" mode=http;
:log info "Downloaded blacklist.rsc from ownsystem.eu";
}

# Script which will Remove old Begone list and add new one
/system script add name="Replace_blacklist" source={
:foreach i in=[/ip firewall address-list find ] do={
:if ( [/ip firewall address-list get $i comment] = "BlackList" ) do={
/ip firewall address-list remove $i
}
}
/import file-name=blacklist.rsc;
:log info "Removal old blacklist and add new";
}

# Schedule the download and application of the dshield list
/system scheduler add comment="Download blocklist" interval=7d name="DownloadBlackList" on-event=Download_blacklist start-date=jan/01/1970 start-time=02:42:00
/system scheduler add comment="Apply badguys List" interval=7d name="InstallBlackList" on-event=Replace_blacklist start-date=jan/01/1970 start-time=02:52:00