{"id":13583495,"url":"https://github.com/acouvreur/ssh-log-to-influx","last_synced_at":"2025-09-15T06:33:35.963Z","repository":{"id":38173574,"uuid":"234941051","full_name":"acouvreur/ssh-log-to-influx","owner":"acouvreur","description":"Send SSH authentication logs to influxdb with geohashing IP","archived":false,"fork":false,"pushed_at":"2024-06-24T13:31:22.000Z","size":3332,"stargazers_count":102,"open_issues_count":18,"forks_count":25,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-04-12T21:29:30.991Z","etag":null,"topics":["docker","grafana","hacktoberfest","influx","influxdb","rsyslog","ssh-log","tcp-server"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/acouvreur.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-01-19T17:54:34.000Z","updated_at":"2025-04-07T03:40:29.000Z","dependencies_parsed_at":"2024-06-24T15:04:21.969Z","dependency_job_id":null,"html_url":"https://github.com/acouvreur/ssh-log-to-influx","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/acouvreur/ssh-log-to-influx","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/acouvreur%2Fssh-log-to-influx","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/acouvreur%2Fssh-log-to-influx/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/acouvreur%2Fssh-log-to-influx/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/acouvreur%2Fssh-log-to-influx/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/acouvreur","download_url":"https://codeload.github.com/acouvreur/ssh-log-to-influx/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/acouvreur%2Fssh-log-to-influx/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":275218395,"owners_count":25425871,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-15T02:00:09.272Z","response_time":75,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","grafana","hacktoberfest","influx","influxdb","rsyslog","ssh-log","tcp-server"],"created_at":"2024-08-01T15:03:31.312Z","updated_at":"2025-09-15T06:33:35.926Z","avatar_url":"https://github.com/acouvreur.png","language":"JavaScript","funding_links":[],"categories":["JavaScript"],"sub_categories":[],"readme":"# Visualize bruteforce SSH attacker's location in real time\n\n![Build, test and deploy](https://github.com/acouvreur/ssh-log-to-influx/workflows/Build,%20test%20and%20deploy/badge.svg)\n![Docker Image Size](https://img.shields.io/docker/image-size/acouvreur/ssh-log-to-influx)\n![Docker Pulls](https://img.shields.io/docker/pulls/acouvreur/ssh-log-to-influx)\n\nMultiarch supported `linux/amd64,linux/arm/v7,linux/arm64` for Raspberry Pis 😄\n\nThanks to **Schkn** for its original post https://devconnected.com/geolocating-ssh-hackers-in-real-time/\n\n## Preview\n\n![Dashboard](./dashboard.png)\n\n[Grafana dashboard](https://grafana.com/grafana/dashboards/12323) id : **12323**\n\n`docker run -e INFLUX_HOST=myinfluxdb.com -e INFLUX_DB=geoloc -p 7070:7070 acouvreur/ssh-log-to-influx`\n\n## Prerequisites\n\n- Docker\n- Rsyslog\n- _An InfluxDB instance (or use docker-compose.standalone.yml)_\n- _A Grafana instance (or use docker-compose.standalone.yml)_\n\n## Getting started\n\n### With a bundled InfluxDB and Grafana\n\n`docker-compose -f docker-compose.standalone.yml up`\n\n### With an external InfluxDB\n\n- `INFLUX_PROTOCOL` _optional_ _default: http_ Protocol to use, http or https.\n- `INFLUX_HOST` Influx (FQDN) host to connect to.\n- `INFLUX_PORT` _optional_ _default: 8086_ Influx port to connect to.\n- `INFLUX_USER` _optional_ _default: root_ Username for connecting to the database.\n- `INFLUX_PWD` _optional_ _default: root_ Password for connecting to the database.\n- `INFLUX_DB` Database to operate on.\n\n_Note: You can use the Docker network FQDN if you put the service in the same Docker network as your InfluxDB instance. INFLUX_HOST will be `influx` if your service name is influx._\n\n`docker-compose up -d`\n\n## Test the TCP server\n\n1. `docker-compose -f docker-compose.standalone.yml up`\n2. `netcat localhost 7070` or `ncat localhost 7070` with Git bash for Windows\n3. type: `Failed password for username from 206.253.167.10 port 11111 ssh2`\n4. Data should be parsed and added\n\n## Rsyslog configuration\n\nAdd this under `/etc/rsyslog.conf` to forward ssh auth failures to local server :\n\n### I have 'PasswordAuthentication' activated\n\n```\ntemplate(name=\"OnlyMsg\" type=\"string\" string=\"%msg:::drop-last-lf%\\n\")\nif $programname == 'sshd' then {\n   if $msg startswith ' Failed' then {\n      action(type=\"omfwd\" target=\"127.0.0.1\" port=\"7070\" protocol=\"tcp\" template=\"OnlyMsg\")\n   }\n}\n```\n\n### I have 'PubkeyAuthentication' activated\n\n```\ntemplate(name=\"OnlyMsg\" type=\"string\" string=\"%msg:::drop-last-lf%\\n\")\nif $programname == 'sshd' then {\n   if $msg startswith ' Invalid' then {\n      action(type=\"omfwd\" target=\"127.0.0.1\" port=\"7070\" protocol=\"tcp\" template=\"OnlyMsg\")\n   } else if $msg startswith ' Disconnected from authenticating' then {\n      action(type=\"omfwd\" target=\"127.0.0.1\" port=\"7070\" protocol=\"tcp\" template=\"OnlyMsg\")\n   }\n}\n```\n\n## Debug configuration\n\n- If you want to skip certificate validation, set `NODE_TLS_REJECT_UNAUTHORIZED` to 0, but don't do this without understanding the implications.\n- `DEBUG_LEVEL`: level of logging in log4js, default is \"info\".\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Facouvreur%2Fssh-log-to-influx","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Facouvreur%2Fssh-log-to-influx","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Facouvreur%2Fssh-log-to-influx/lists"}