Package: intrusion-monitor
Intrusion MonitorAn SSH log watchdog, which exports failed login attempts to an InfluxDB timeseries database.IntroductionExposing ports from your homelab is a potential security threat. If you monitor everything else, why not also monitor brute-force attacks to your server?It is common to find brute-force SSH attempts, to random IP ranges and login credentials (username and password), on the most probable ports where SSH is listening,
such as port22(the SSH port),2222, and so on.SSH login attempts are stored logged in/var/log/auth.log. For instance take a look at this log snippet:Mar 25 22:53:37 ubuntu sshd[26265]: Connection closed by invalid user dev 37.120.235.76 port 59304 [preauth]
Mar 25 22:54:48 ubuntu sshd[26772]: Connection closed by authenticating user root 123.56.161.195 port 44312 [preauth]
Mar 26 13:51:38 ubuntu sshd[503448]: Connection closed by 5.8.10.202 port 64319 [preauth]
Mar 27 15:50:17 ubuntu sshd[23939]: Failed password for ubnt from 106.75.246.203 port 48580 ssh2None of these logins were made by me, nor I recognised these IPs. They are even from different countries!Therefore, the aim of this tool is the following:Watch your/var/log/auth.logfor (failed) login attempts;Grab the username, IP and port the attempt comes from;Get IP information, latitude and longitude fromIPstack(you will need to register for afreeAPI keyhere);Store all this information in an InfluxDB database;You can then use this data to build a neat dashboards with your favourite tool (mine isGrafana)But the best part is that all of this runs onDocker🐳!Operation ModesThis tool has two main operation modes:Log watchdog (default):The mounted log file is watched for new entries, which are then processed (extract username, IP and port, request IP information from IPstack and store in the database);Supports both SSH configurations with password authentication or only public key authentication.TCP socket for Rsyslog(under development):It listens for Rsyslog json messages in the format{"ip": "<IP>", "username": "<username>", "port": "<port>"};There is a greatMedium article,
that uses Rsyslog for this purpose. This offers similar functionality with a python TCP socket on a Docker container, instead of the article's node.js server;Docker InstallationCurrently, images are supported for bothx86-64andarm64architectures, so this is also suitable for your Raspberry Pi:ArchitectureTagx86-64latestarm64latestThere are also development images with the latest on master branch:ArchitectureTagx86-64dev-latestarm64dev-latestDocker CLITo create a container using the command line:dockerrun-d\--nameintrusion-monitor\-eTZ=Europe/London`#default`  \-eINFLUXDB_HOST=<InfluxDBHost>\-eINFLUXDB_PORT=8086`#default`  \-eINFLUXDB_DATABASE=intrusion-monitor`#default`  \-eINFLUXDB_USER=`#optional` \-eINFLUXDB_PASSWORD=`#optional` \-eOPERATION_MODE=watchdog`#default`  \-eLOG_LEVEL=info`#default`  \-v/var/log/auth.log:/watchdog/log/auth.log:ro\afonsoc12/intrusion-monitor:latestDocker-composeTo create a standalone container with docker-compose, assuming that you have an InfluxDB instance already running:version:'3.5'services:intrusion-monitor:image:afonsoc12/intrusion-monitor:latestcontainer_name:intrusion-monitorenvironment:-TZ=Europe/London#default-INFLUXDB_HOST=<InfluxDB host>-INFLUXDB_PORT=8086#default-INFLUXDB_DATABASE=intrusion-monitor#default-INFLUXDB_USER=#optional-INFLUXDB_PASSWORD=#optional-OPERATION_MODE=watchdog#default-LOG_LEVEL=info#defaultvolumes:-/var/log/auth.log:/watchdog/log/auth.logports:-7007:7007restart:unless-stoppedIf you would like to create a stack with bothintrusion-monitorand InfluxDB, you can either fork this repo or download thedocker-compose.ymlandenv.samplefiles (rename the latter to.env).Don't forget to edit your.env! Then run it with:docker-compose-pintrusion-monitor-fdocker-compose.yml--env-file.envup-dParametersHere are the image's parameters for ports (-p), environment variables (-e) and volume mappings (-v).
For docker-compose,-pcorresponds toports:,-etoenvironment:and-vtovolumes:.It is highly recommended that you store your environment variables, especially your secrets, in a.envfile. You may use the.env.sampleas a template.
If you would like to know more about environment variables in Docker, please see these articles aboutEnvironment variables in Composeand theEnvironment file.ParameterMandatory?FunctionDefault-e TZSpecify the system's timezoneEurope/London-e OPERATION_MODEOperation modewatchdog-e INFLUXDB_HOST✔InfluxDB database host. It can be the container name, if both are in the same network.Seedocker-compose.ymllocalhost-e INFLUXDB_PORTInfluxDB port8086-e INFLUXDB_DATABASEInfluxDB database name. Creates a new one if does not existintrusion-monitor-e INFLUXDB_USERInfluxDB useroptional-e INFLUXDB_PASSWORDInfluxDB passwordoptional-e LOG_LEVELLog level. Supports "debug" or "info"info-p 7007:7007TCP socket port(under development)---v /var/log/auth.log:/watchdog/log/auth.log:ro✔(in watchdog mode)Map to the log file, in read-only mode.mandatoryHow can I protect myself in the first place?The first thing you can do is to disable password authentication on your machine, and opt only for public key authentication.This method is the most secure type of authentication credentials and uses a pairs of two cryptographically secure keys: apublic keyand aprivate key. You can learn more about this in this article fromSSH.com.I also recommend disabling root authentication and changing the port SSH is listening to an uncommon one (don't use any of22,2222,32222,52222, and so on).Moreover, if you have a "smart" router, configure your firewall to only allow connections from countries you are likely to access your server from, and deny everything else.CreditsCopyright 2022 Afonso CostaLicensed under theApache License, Version 2.0(the "License")Icons made byCreaticca Creative Agencyfromwww.flaticon.com