Information about Router login attempts

Elmo · May 17, 2021, 8:14pm

In the "System Log" in the web interface there is only information some hours back.

I'll need the following information:

login attempts on the wi-fi lan
login attempts on the web interface
login attempts via ssh to the Router

Is there some real-time monitoring software doing this or do I need to write log files myself. And please point me to info about this subject.

flygarn12 · May 17, 2021, 9:49pm

It really isn’t any longterm “pushbutton” quick fix solution for this.
I think you need to leave the built in log interface for this, that is only for very simple overview. You need to expand your network with a long time log server and work with the logs with maybe rsyslog or similar to filter out what you want. And probably also get some log analyzing program to work with the data you get out from rsyslog or what ever you choose to use.

If you only want to block bad actors from brute force login attempts. BanIP has a blocking function of failed login attempts.

anon50098793 · May 18, 2021, 5:38am

yeah... persistent storage is a big catch for most implementations local to the router....

even on my build where I do store a few things on flash(sdcard)... I haven't bothered persisting the 'login-log'...

basically assuming you want to store it on the router... you just need a cronjob to get the stuff you need... maybe also take a parameter to 'show' so you can use it in luci app commands...

here is an example of what you might get...

Elmo · May 19, 2021, 3:47pm

Thanks for the answer :))

Basicalle Openwrt is a linux system so I guess I have to learn linux in general and routing too of course.

About the BanIP topic I can see that there are two packages in the OpenWRT repository. A package just called "banip" and a package called "luci-app-banip". Is there some documentation on how they work and how to configure.

Again, thanks

Elmo · May 19, 2021, 3:49pm

Thanks for the answer

I'll certainly look into how to work with cronjob

Elmo · May 19, 2021, 4:36pm

Found the info on BanIP:

github.com

openwrt/packages/blob/master/net/banip/files/README.md

<!-- markdownlint-disable -->

# banIP - ban incoming and/or outgoing ip adresses via ipsets

## Description
IP address blocking is commonly used to protect against brute force attacks, prevent disruptive or unauthorized address(es) from access or it can be used to restrict access to or from a particular geographic area — for example.  

## Main Features
* Support of the following fully pre-configured domain blocklist sources (free for private usage, for commercial use please check their individual licenses)

| Source              | Focus                          | Information                                                                       |
| :------------------ | :----------------------------: | :-------------------------------------------------------------------------------- |
| asn                 | ASN block                      | [Link](https://asn.ipinfo.app)                                                    |
| bogon               | Bogon prefixes                 | [Link](https://team-cymru.com)                                                    |
| country             | Country blocks                 | [Link](https://www.ipdeny.com/ipblocks)                                           |
| darklist            | blocks suspicious attacker IPs | [Link](https://darklist.de)                                                       |
| debl                | Fail2ban IP blacklist          | [Link](https://www.blocklist.de)                                                  |
| doh                 | Public DoH-Provider            | [Link](https://github.com/dibdot/DoH-IP-blocklists)                               |
| drop                | Spamhaus drop compilation      | [Link](https://www.spamhaus.org)                                                  |
| dshield             | Dshield IP blocklist           | [Link](https://www.dshield.org)                                                   |

This file has been truncated. show original

Latest commit : Apr 21, 2021

flygarn12 · May 19, 2021, 5:33pm

It helps, but the UCI in OWRT doesn’t demand Linux knowledge. There is a instruction for UCI in the OWRT user guide.

I don’t know if you are a mac or pc person.
But Linux isn’t so bad as the reputation say, yes there are some work done in the terminal but the modern GUI in Linux distros will work for a Windows person.
After a while you will feel what work fits best in the terminal and what works best in the graphical interface.

But do not expect Windows like hardware plug-n-play i any Linux, that doesn’t exist.

But I recommend to aim for Debian based Linux platforms if you want to learn, then you will recognize yourself over the different systems you will probably use in the network.

And everything you wonder and everything you want to do in Linux is googleble (or Duck Duck Go:ing) these days anyway, and the answer comes with ether a movie or a manual with pictures or both.

It is only little over a year ago I got the first real Linux other than OWRT. First a RaspberryPi 3. Then I got a “old” laptop I installed Linux Mint on. Now I have three RaspberryPi, the old laptop with Linux Mint and a virtual Ubuntu. And the usual Windows PC.
But after feeling Ubuntu in the virtual install I am thinking about droping the Linux Mint and install Ubuntu on the laptop, Linux Mint is a bridge between Windows geeks and Linux geeks but I feel now that I handle the hardcore Ubuntu without problem so Mint feels to easy😄

flygarn12 · May 19, 2021, 6:06pm

“BanIP” is the actual program.

Luci-app-banip is the optional Luci GUI for the BanIP you find in the system menu if you choose to install.

If you have Luci in your OWRT I recommend to install the BanIP luci interface because it makes the set up a lot easier.