Bonjour,

le script perl fail2ban, dans logwatch ne remonte pas l'information des host bannis, dont voici le rapport :
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6
7
 --------------------- fail2ban-messages Begin ------------------------ 
 
 
 Banned services with Fail2Ban:                          Bans:Unbans
    ssh:                                                    [  2:0  ]
 
 ---------------------- fail2ban-messages End -------------------------

Voci le script :
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
#!/usr/bin/perl
 
use strict;
use Logwatch ':all';
 
my $Debug = $ENV{'LOGWATCH_DEBUG'} || 0;
my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
my $IgnoreHost = $ENV{'sshd_ignore_host'} || "";
my $DebugCounter = 0;
my $ReInitializations = 0;
my @IptablesErrors = ();
my @ActionErrors = ();
my $NotValidIP = 0;             # reported invalid IPs number
my @OtherList = ();
 
my %ServicesBans = ();
 
if ( $Debug >= 5 ) {
        print STDERR "\n\nDEBUG: Inside Fail2Ban Filter \n\n";
        $DebugCounter = 1;
}
 
while (defined(my $ThisLine = <STDIN>)) {
    if ( $Debug >= 5 ) {
        print STDERR "DEBUG($DebugCounter): $ThisLine";
        $DebugCounter++;
    }
    chomp($ThisLine);
    if ( ($ThisLine =~ /..,... DEBUG: /) or
         ($ThisLine =~ /..,... \S*\s*: DEBUG /) or # syntax of 0.7.? fail2ban
         ($ThisLine =~ /..,... INFO: (Fail2Ban v.* is running|Exiting|Enabled sections:)/) or
    ($ThisLine =~ /INFO.*Log rotation detected for/) or
         ($ThisLine =~ /..,... \S+\s*: INFO\s+(Set |Socket|Exiting|Gamin|Created|Added|Using)/) or # syntax of 
0.7.? fail2ban
         ($ThisLine =~ /..,... WARNING: Verbose level is /) or
         ($ThisLine =~ /..,... WARNING: Restoring firewall rules/)
         )
    {
        if ( $Debug >= 6 ) {
            print STDERR "DEBUG($DebugCounter): line ignored\n";
        }
    } elsif ( my ($Service,$Action,$Host) = ($ThisLine =~ m/WARNING:?\s\[?(.*?)[]:]?\s(Ban|Unban)[^\.]* (\S+)/)
) {
        if ( $Debug >= 6 ) {
            print STDERR "DEBUG($DebugCounter): Found $Action for $Service from $Host\n";
        }
        $ServicesBans{$Service}{$Host}{$Action}++;
        $ServicesBans{$Service}{"(all)"}{$Action}++;
    } elsif ( my ($Service,$Host,$NumFailures) = ($ThisLine =~ m/INFO: (\S+): (.+) has (\d+) login failure\(s\)
. Banned./)) {
        if ($Debug >= 4) {
            print STDERR "DEBUG: Found host $Host trying to access $Service - failed $NumFailures times\n";
        }
        push @{$ServicesBans{$Service}{$Host}{'Failures'}}, $NumFailures;
    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ ERROR:\s(.*):\s(\S+)\salready in ban list/)) {
         $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/WARNING\s*\[(.*)\]\s*(\S+)\s*already banned/)) {
       $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ WARNING:\s(.*):\sReBan (\S+)/)) {
            $ServicesBans{$Service}{$Host}{'ReBan'}++;
    } elsif ($ThisLine =~ / ERROR:?\s*(Execution of command )?\'?iptables/) {
            push @IptablesErrors, "$ThisLine\n";
    } elsif ($ThisLine =~ /ERROR.*returned \d+$/) {
       push @ActionErrors, "$ThisLine\n";
    } elsif (($ThisLine =~ /..,... WARNING: \#\S+ reinitialization of firewalls/) or
            ($ThisLine =~ / ERROR\s*Invariant check failed. Trying to restore a sane environment/)) {
            $ReInitializations++;
    } elsif ($ThisLine =~ /..,... WARNING:  is not a valid IP address/) {
        # just ignore - this will be fixed within fail2ban and is harmless warning
    }
    else
    {
        # Report any unmatched entries...
        push @OtherList, "$ThisLine\n";
    }
}
 
###########################################################
 
 
if (keys %ServicesBans) {
    printf("\nBanned services with Fail2Ban:                             Bans:Unbans\n");
    foreach my $service (sort {$a cmp $b} keys %ServicesBans) {
        printf("   %-55s [%3d:%-3d]\n", "$service:",
               $ServicesBans{$service}{'(all)'}{'Ban'},
               $ServicesBans{$service}{'(all)'}{'Unban'});
        delete $ServicesBans{$service}{'(all)'};
        my $totalSort = TotalCountOrder(%{$ServicesBans{$service}}, \&SortIP);
        if ($Detail >= 5) {
            foreach my $ip (sort $totalSort keys %{$ServicesBans{$service}}) {
                   my $name = LookupIP($ip);
                   printf("      %-53s %3d:%-3d\n",
                       $name,
                       $ServicesBans{$service}{$ip}{'Ban'},
                       $ServicesBans{$service}{$ip}{'Unban'});
                   if (($Detail >= 10) and ($ServicesBans{$service}{$ip}{'Failures'}>0)) {
                      print "      Failed ";
                      foreach my $fails (@{$ServicesBans{$service}{$ip}{'Failures'}}) {
                              print " $fails";
                      }
                    print " times";
                    printf("\n     %d Duplicate Ban attempts", $ServicesBans{$service}{$ip}{'AlreadyInTheList'}
) ;
                    printf("\n     %d ReBans due to rules reinitilizations", $ServicesBans{$service}{$ip}{'ReBa
n'}) ;
                    print "\n";
                   }
            }
           }
    }
}
 
 
if ($Detail>0) {
    if ($#IptablesErrors > 0) {
           printf("\n%d faulty iptables invocation(s)", $#IptablesErrors);
           if ($Detail > 5) {
            print ":\n";
            print @IptablesErrors ;
           }
    }
    if ($#ActionErrors > 0) {
       printf("\n%d error(s) returned from actions", $#ActionErrors);
       if ($Detail > 5) {
           print ":\n";
           print @ActionErrors ;
       }
    }
    if ($ReInitializations > 0) {
           printf("\n%d fail2ban rules reinitialization(s)", $ReInitializations);
    }
    if ($#OtherList >= 0) {
           print "\n**Unmatched Entries**\n";
           print @OtherList;
    }
}
 
exit(0);
Si j’exécute ce script tout seul j'ai le message d'erreur suivant :
Can't locate Logwatch.pm in @INC (@INC contains: /etc/perl /usr/local/lib/perl/5.10.1 /usr/local/share/perl/5.10.1 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.10 /usr/share/perl/5.10 /usr/local/lib/site_perl .) at ./scripts/services/fail2ban line 42.
BEGIN failed--compilation aborted at ./scripts/services/fail2ban line 42.

Quelqu'un pourrait m'aider à résoudre ce problème ???

D'avance merci ........