GrayLog配置SSH暴力破解攻击日志告警并推送到钉钉机器人

yuanfan2012

发布于 2021-12-28 09:24:08

9520

发布于 2021-12-28 09:24:08

文章被收录于专栏：WalkingCloud

GrayLog配置SSH暴力破解攻击日志告警并推送到钉钉机器人

接上一篇文章，【实践】GrayLog4.2使用webhook成功推送日志告警到钉钉群机器人，在前面的基础上进行优化和功能探索

1、webhook启动设置优化

由于webhook默认端口为9000，与GrayLog Web端口冲突，所以建议使用其它端口

firewall-cmd --add-port=8080/tcp --permanent --zone=public 
firewall-cmd --reload
mkdir /var/lib/webhook

(图片可点击放大查看)

设置webhook服务开机自启动

vi /usr/lib/systemd/system/webhook.service 
[Unit]
Description=Webhook service
After=network.target

[Service]
Type=simple
User=root
Group=root
LimitNOFILE=1024

Restart=on-failure
RestartSec=10
startLimitIntervalSec=60

WorkingDirectory=/var/lib/webhook
ExecStart=/opt/webhook -hooks /opt/hooks.json -port 8080 -verbose

# make sure log directory exists and owned by syslog
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=webhookd

[Install]
WantedBy=multi-user.target

(图片可点击放大查看)

systemctl enable webhook.service 
systemctl start webhook.service
systemctl status webhook.service

(图片可点击放大查看)

2、配置HTTP告警类型

http://192.168.31.127:8080/hooks/push2dingtalk

(图片可点击放大查看)

(图片可点击放大查看)

3、设置GrayLog Alert告警

我使用聚合结果到达阀值的方式 Aggregation of results reaches a threshold

关键字“failed password" ,查询窗口为1分钟内超过6次就产生告警

(图片可点击放大查看)

(图片可点击放大查看)

(图片可点击放大查看)

4、测试

比如对主机192.168.31.232进行SSH暴力破解测试

 watch -n 1 "hydra -l root -p admin@123 192.168.31.232 ssh"

(图片可点击放大查看)

这时理论上应该会发送钉钉机器人告警，但未收到

一度以为是配置哪里出问题了，在这个问题上卡了很久

最终查看graylog服务日志

tail -f /var/log/graylog-server/server.log 

2021-12-21T20:20:32.369+08:00 ERROR [PivotAggregationSearch] Aggregation search query <streams-query-1> returned an error: Elasticsearch exception [type=illegal_argument_exception, reason=maxSize must be >= 0 and < 2147483631; got: 2147483647].
ElasticsearchException{message=Search type returned error: , errorDetails=[]}

(图片可点击放大查看)

根据这个报错在官方论坛上找到答案了

https://community.graylog.org/t/elasticsearch-pivotaggregationsearch-errors-after-upgrade-to-4-1-es-7-14/21006

(图片可点击放大查看)

5、解决办法:升级Elasticsearch至7.16.2版本

https://mirrors.cloud.tencent.com/elasticstack/7.x/yum/7.16.2/elasticsearch-7.16.2-x86_64.rpm

rpm -Uvh elasticsearch-7.16.2-x86_64.rpm 
systemctl daemon-reload
systemctl restart elasticsearch.service