![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
hotshot# portinstall security/swatch [Gathering depends for security/swatch ................ done] ---> Installing 'swatch-3.2.3' from a port (security/swatch) ---> Building '/usr/ports/security/swatch'
/etc/rc.conf http://www.hodogaya.org/home-server/swatch-ipfw.html
swatch_enable="YES" swatch_rules="1" swatch_1_flags="--tail-file=/var/log/auth.log --awk-field-syntax --config-file=/usr/local/etc/swatchrc -r 00:01 --daemon" swatch_1_user="root" swatch_1_pidfile="/var/run/swatch1.pid"
↓
swatch_enable="YES" swatch_rules="1" swatch_1_flags="--tail-file=/var/log/maillog --awk-field-syntax --config-file=/usr/local/etc/swatchrc -r 00:01 --daemon" swatch_1_user="root" swatch_1_pidfile="/var/run/swatch1.pid"
/usr/local/etc/swatchrc
watchfor /Failed password for root from/
exec /sbin/ipfw add 1 deny all from $11:255.255.255.255 to any
mail=root,subject=Failed_password_for_root_from
↓
watchfor /_DIE: Suicide in child_init_hook/
exec amavisd reload
mail=root,subject=Amavisd-new reloaded!
swatch --tail-file=/var/log/maillog --awk-field-syntax --config-file=/usr/local/etc/swatchrc -r 00:01 --daemon
Apr 3 11:06:00 hotshot amavis[19297]: (!!)TROUBLE in child_init_hook: BDB no dbS: Lock table is out of available locker entries, . at (eval 97) line 27. Apr 3 11:06:00 hotshot amavis[19297]: (!)_DIE: Suicide in child_init_hook: BDB no dbS: Lock table is out of available locker entries, . at (eval 97) line 27. Apr 3 11:06:00 hotshot amavis[17631]: (17631-08) (!)TempDir removal: tempdir is to be PRESERVED: /var/amavis/tmp/amavis-20100403T080159-17631 Apr 3 11:06:05 hotshot postfix/smtp[19229]: 332485642D: to=<root@smb.net>, orig_to=<root>, relay=none, delay=0.05, delays=0.05/0/0/0, dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]:10024: Connection refused) Apr 3 11:06:06 hotshot amavis[19207]: starting. /usr/local/sbin/amavisd at hotshot.smb.net amavisd-new-2.6.4 (20090625), Unicode aware Apr 3 11:06:06 hotshot amavis[19207]: Perl version 5.008009 Apr 3 11:06:06 hotshot postfix/pickup[19084]: 2F9C656428: uid=0 from=<root> Apr 3 11:06:06 hotshot postfix/cleanup[19202]: 2F9C656428: message-id=<20100403020606.2F9C656428@hotshot.smb.net> Apr 3 11:06:06 hotshot postfix/qmgr[1324]: 2F9C656428: from=<root@smb.net>, size=455, nrcpt=1 (queue active) Apr 3 11:06:06 hotshot postfix/smtp[19233]: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused Apr 3 11:06:06 hotshot postfix/smtp[19233]: 2F9C656428: to=<root@smb.net>, orig_to=<root>, relay=none, delay=0.07, delays=0.07/0/0/0, dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]:10024: Connection refused) Apr 3 11:06:06 hotshot amavis[19226]: starting. /usr/local/sbin/amavisd at hotshot.smb.net amavisd-new-2.6.4 (20090625), Unicode aware Apr 3 11:06:06 hotshot amavis[19226]: Perl version 5.008009 Apr 3 11:06:06 hotshot postfix/pickup[19084]: 8CEC056430: uid=0 from=<root> Apr 3 11:06:06 hotshot postfix/cleanup[19202]: 8CEC056430: message-id=<20100403020606.8CEC056430@hotshot.smb.net> Apr 3 11:06:06 hotshot postfix/qmgr[1324]: 8CEC056430: from=<root@smb.net>, size=455, nrcpt=1 (queue active) Apr 3 11:06:06 hotshot postfix/smtp[19241]: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused Apr 3 11:06:06 hotshot postfix/smtp[19241]: 8CEC056430: to=<root@smb.net>, orig_to=<root>, relay=none, delay=0.09, delays=0.09/0/0/0, dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]:10024: Connection refused) Apr 3 11:06:07 hotshot postfix/pickup[19084]: B440856424: uid=0 from=<root> Apr 3 11:06:07 hotshot postfix/cleanup[19202]: B440856424: message-id=<20100403020607.B440856424@hotshot.smb.net> Apr 3 11:06:07 hotshot postfix/qmgr[1324]: B440856424: from=<root@smb.net>, size=455, nrcpt=1 (queue active) Apr 3 11:06:07 hotshot postfix/smtp[19203]: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused Apr 3 11:06:07 hotshot postfix/smtp[19203]: B440856424: to=<root@smb.net>, orig_to=<root>, relay=none, delay=0.55, delays=0.55/0/0/0, dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]:10024: Connection refused)
