GrayLog配置SSH暴力破解攻击日志告警并推送到钉钉机器人

接上一篇文章，【实践】GrayLog4.2使用webhook成功推送日志告警到钉钉群机器人，在前面的基础上进行优化和功能探索

1、webhook启动设置优化

由于webhook默认端口为9000，与GrayLog Web端口冲突，所以建议使用其它端口

firewall-cmd --add-port=8080/tcp --permanent --zone=public firewall-cmd --reloadmkdir /var/lib/webhook

(图片可点击放大查看)

设置webhook服务开机自启动

vi /usr/lib/systemd/system/webhook.service [Unit]Description=Webhook serviceAfter=network.target[Service]Type=simpleUser=rootGroup=rootLimitNOFILE=1024Restart=on-failureRestartSec=10startLimitIntervalSec=60WorkingDirectory=/var/lib/webhookExecStart=/opt/webhook -hooks /opt/hooks.json -port 8080 -verbose# make sure log directory exists and owned by syslogStandardOutput=syslogStandardError=syslogSyslogIdentifier=webhookd[Install]WantedBy=multi-user.target

(图片可点击放大查看)

systemctl enable webhook.service systemctl start webhook.servicesystemctl status webhook.service

(图片可点击放大查看)

2、配置HTTP告警类型

http://192.168.31.127:8080/hooks/push2dingtalk

(图片可点击放大查看)

(图片可点击放大查看)

3、设置GrayLog Alert告警

我使用聚合结果到达阀值的方式 Aggregation of results reaches a threshold

关键字“failed password" ,查询窗口为1分钟内超过6次就产生告警

(图片可点击放大查看)

(图片可点击放大查看)

(图片可点击放大查看)

4、测试

比如对主机192.168.31.232进行SSH暴力破解测试

 watch -n 1 "hydra -l root -p admin@123 192.168.31.232 ssh"

(图片可点击放大查看)

这时理论上应该会发送钉钉机器人告警，但未收到

一度以为是配置哪里出问题了，在这个问题上卡了很久

最终查看graylog服务日志

tail -f /var/log/graylog-server/server.log 2021-12-21T20:20:32.369+08:00 ERROR [PivotAggregationSearch] Aggregation search query <streams-query-1> returned an error: Elasticsearch exception [type=illegal_argument_exception, reason=maxSize must be >= 0 and < 2147483631; got: 2147483647].ElasticsearchException{message=Search type returned error: , errorDetails=[]}

(图片可点击放大查看)

根据这个报错在官方论坛上找到答案了

https://community.graylog.org/t/elasticsearch-pivotaggregationsearch-errors-after-upgrade-to-4-1-es-7-14/21006

(图片可点击放大查看)

5、解决办法:升级Elasticsearch至7.16.2版本

https://mirrors.cloud.tencent.com/elasticstack/7.x/yum/7.16.2/elasticsearch-7.16.2-x86_64.rpmrpm -Uvh elasticsearch-7.16.2-x86_64.rpm systemctl daemon-reloadsystemctl restart elasticsearch.service 

(图片可点击放大查看)

6、接下来就可以正常收到钉钉机器人告警

(图片可点击放大查看)

(图片可点击放大查看)