S8C88/LogWarden
GitHub: S8C88/LogWarden
LogWarden 是一个 Python 编写的 SSH 认证日志分析器，用于快速扫描 auth.log、检测暴力破解模式并生成汇总报告。
Stars: 0 | Forks: 0
# LogWarden
Auth log 分析器。扫描 `/var/log/auth.log` 以查找失败的 SSH 尝试、暴力破解模式和可疑 IP。用于对遭到入侵或攻击的服务器进行快速分流排查。
## 工作原理
```
flowchart LR
A[auth.log] --> B[Parse Lines]
B --> C{Match failed?}
C -->|Yes| D[Extract IP + User]
D --> E[Counter Update]
E --> F[Brute-Force Detection]
C -->|Accepted| G[Record Login]
C -->|No Match| H[Skip]
F --> I{>= 5 attempts?}
I -->|Yes| J[Alert Source]
I -->|No| K[Log Only]
J & G & K --> L[Summary Report]
```
## 用法
```
# 分析 auth log
python3 logwarden.py /var/log/auth.log
# 导出为 JSON
python3 logwarden.py /var/log/auth.log -o report.json
# 自定义 thresholds
python3 logwarden.py /var/log/auth.log --top-users 20 --min-attempts 3
```
## 示例输出
```
============================================================
LogWarden Analysis Report
File: /var/log/auth.log
============================================================
Total lines parsed: 15234
Failed auth attempts: 892
Accepted logins: 12
Invalid user attempts: 445
Unique attacking IPs: 127
Top attacked usernames:
root 423 attempts
admin 89 attempts
ubuntu 45 attempts
user 32 attempts
test 28 attempts
Brute-force sources (>=5 attempts):
103.235.46.92 234 attempts (first: Jul 14 03:12:31, last: Jul 14 13:48:12)
185.220.101.42 156 attempts (first: Jul 13 22:04:15, last: Jul 14 11:22:08)
45.33.32.156 89 attempts (first: Jul 12 01:45:03, last: Jul 14 09:33:41)
```
## 功能特性
- **SSH 暴力破解检测** — 标记有 5 次以上失败尝试的 IP
- **用户枚举** — 显示哪些账户正受到最多的攻击
- **成功登录追踪** — 区分合法访问与攻击行为
- **JSON 导出** — 支持机器读取，便于集成至 pipeline
- **自定义阈值** — 可根据环境调整敏感度
## 项目结构
```
LogWarden/
├── logwarden.py
├── README.md
├── LICENSE
├── requirements.txt
├── tests/
│ └── test_logwarden.py
└── docs/
└── engineering-report.md
```
## 许可证
MIT
标签：PB级数据处理, Python, 免杀技术, 安全运维, 无后门, 暴力破解检测, 逆向工具