1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

Action Log to file?

Discussion in 'Plesk 11.x for Linux' started by littlefrog, Nov 3, 2012.

  1. littlefrog

    littlefrog Regular Pleskian

    25
     
    Joined:
    Jul 30, 2008
    Messages:
    176
    Likes Received:
    0
    I have fail2ban running on my server and i want to have it be able to check brute force attacks on the plesk panel login itself.

    Action log today recorded 43,000 attempts to log in... would have been nice to ban after the first 4 but the results are in a database from what i can tell and not a physical file.

    Does anyone know of a way to get fail2ban to read DB or to get action log into file so i can stop this from happening.
     
  2. Sergey L

    Sergey L Golden Pleskian Staff Member

    32
    43%
    Joined:
    Aug 10, 2006
    Messages:
    1,195
    Likes Received:
    30
  3. littlefrog

    littlefrog Regular Pleskian

    25
     
    Joined:
    Jul 30, 2008
    Messages:
    176
    Likes Received:
    0
    hmm... might work if... event handlers worked

    according to the documentation

    it doesn't work.

    1) If you create Shell script EXACTLY as described and choose the event panel user failed login no vars are passed on to the shell script.

    2) Because no vars are passed on there is no way to add to auto ban script.
    a) No IP passed on
    b) No user name passed on
     
  4. littlefrog

    littlefrog Regular Pleskian

    25
     
    Joined:
    Jul 30, 2008
    Messages:
    176
    Likes Received:
    0
    file and output

    Here is my shell script

    #!/bin/bash
    COMPDATE=`/bin/date`
    echo "$COMPDATE - [${COMP_IP_ADDRESS}] - (${COMP_LOGIN_NAME}) User Authentication Failed" >> /var/log/psa-cp.log

    Here is what it outputs

    Tue Nov 6 17:37:37 CST 2012 - [] - () User Authentication Failed
     
  5. littlefrog

    littlefrog Regular Pleskian

    25
     
    Joined:
    Jul 30, 2008
    Messages:
    176
    Likes Received:
    0
    anyone have any ideas when the Event Viewer will be fixed to work per the documentation?

    Its clearly not passing variables on like it states it does.
     
Loading...