From 628f75303e026bd0dcb9d2bb134b27f578835f76 Mon Sep 17 00:00:00 2001 From: Jens Ahrensfeld Date: Sun, 26 Jul 2026 14:45:08 +0200 Subject: [PATCH] Route attacker-check reports to root@jayfield.org, add dated archive root@jayfield.org didn't resolve to anything (missing from both /etc/aliases and vmail.aliases) - added it as a new alias to jens@jayfield.org, matching the existing postmaster/hostmaster/ webmaster/wlan pattern, so the weekly report doesn't just bounce. Also added per-run dated report files under /var/log/attacker-check/reports/ alongside the existing CSVs, for a plain-text historical archive browsable by date. Co-Authored-By: Claude Sonnet 5 --- README.md | 10 +++++++++- TODO.md | 11 +++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 75ce801..c90fa74 100644 --- a/README.md +++ b/README.md @@ -66,13 +66,21 @@ routine pending package upgrades, don't fail the run). history to cover a full week regardless of exactly when logrotate's daily midnight run lands relative to the cron job) for the past 7 days and turns it into two append-only CSVs for longitudinal analysis, plus a -human-readable weekly summary emailed to `jens@jayfield.org`: +human-readable weekly summary emailed to `root@jayfield.org` and saved +as a dated report file: - `/var/log/attacker-check/per_ip_weekly.csv` — one row per (jail, IP) per week: event count, first/last seen, `/24` subnet, and interval statistics (mean, stdev) between repeat hits. - `/var/log/attacker-check/per_jail_weekly.csv` — weekly rollup per jail: total events, distinct IPs, distinct `/24`s, new bans. +- `/var/log/attacker-check/reports/.txt` — the full + human-readable report for that run, one file per date. + +`root@jayfield.org` didn't resolve to anything before this (not in +`/etc/aliases`, not in the `vmail` aliases table) — added it as a new +`vmail.aliases` row → `jens@jayfield.org`, matching the existing +`postmaster`/`hostmaster`/`webmaster`/`wlan` pattern. Two detection heuristics run on top of the raw data, both modeled directly on real campaigns found earlier this engagement (see `TODO.md`): diff --git a/TODO.md b/TODO.md index 5de73bf..2177c53 100644 --- a/TODO.md +++ b/TODO.md @@ -3,6 +3,17 @@ Outstanding hardening items (see `README.md` for the full service overview). Nothing here is urgent; all are low-risk, no-downtime changes. +- [x] **Weekly attacker-summary report routing to `root@jayfield.org`** — done 2026-07-26. + `attacker-check.py`'s report email was pointed at `root@jayfield.org`, but that address + didn't resolve to anything (not in `/etc/aliases`, not in `vmail.aliases`) — would have + bounced every week. Added it as a new `vmail.aliases` row → `jens@jayfield.org`, matching + the existing `postmaster`/`hostmaster`/`webmaster`/`wlan` pattern. Also added per-run + dated report files (`/var/log/attacker-check/reports/.txt`), alongside the two + existing append-only CSVs. Verified: `postmap -q root@jayfield.org + mysql:/etc/postfix/sql/aliases.cf` resolves correctly, a live re-run delivered to + `jens@jayfield.org` (`orig_to=` in the Postfix log) and wrote + `reports/2026-07-26.txt`. + - [x] **BIND's own DNSSEC validation was broadly broken for signed domains** — found and fixed 2026-07-26 while investigating why third-party apt repos (`download.docker.com`, `ppa.launchpad.net`) kept failing to resolve ("Temporary failure resolving") during prep for an OS release upgrade.