diff --git a/config/action.d/pf.conf b/config/action.d/pf.conf index 40f4620a..b7476fa2 100644 --- a/config/action.d/pf.conf +++ b/config/action.d/pf.conf @@ -72,10 +72,6 @@ tablename = f2b protocol = tcp -# Option: port -# Notes.: specifies port to monitor -# Values: [ NUM | STRING ] Default: -port = ssh # Option: actiontype # Notes.: defines additions to the blocking rule @@ -90,5 +86,5 @@ allports = any # Option: multiport # Notes.: addition to block access only to specific ports -# Usage.: use in jail config: "banaction = pf[actiontype=, port="%(port)s"]" +# Usage.: use in jail config: "banaction = pf[actiontype=]" multiport = any port diff --git a/fail2ban/tests/servertestcase.py b/fail2ban/tests/servertestcase.py index 5fbf8cd6..fabf77b9 100644 --- a/fail2ban/tests/servertestcase.py +++ b/fail2ban/tests/servertestcase.py @@ -1372,12 +1372,12 @@ class ServerConfigReaderTests(LogCaptureTestCase): r"`echo -2001:db8:: > /proc/net/xt_recent/f2b-j-w-iptables-xtre6`", ), }), - # pf default - multiport on ssh -- + # pf default -- multiport on default port (tag set in jail.conf, but not in this test case) ('j-w-pf', 'pf[name=%(__name__)s]', { 'ip4': (), 'ip6': (), 'start': ( '`echo "table persist counters" | pfctl -f-`', - '`echo "block proto tcp from to any port ssh" | pfctl -f-`', + '`echo "block proto tcp from to any port " | pfctl -f-`', ), 'stop': ( '`pfctl -sr 2>/dev/null | grep -v f2b-j-w-pf | pfctl -f-`', @@ -1411,7 +1411,7 @@ class ServerConfigReaderTests(LogCaptureTestCase): 'ip6-unban': ("`pfctl -t f2b-j-w-pf-mp -T delete 2001:db8::`",), }), # pf allports -- - ('j-w-pf-ap', 'pf[name=%(__name__)s,actiontype=]', { + ('j-w-pf-ap', 'pf[actiontype=][name=%(__name__)s]', { 'ip4': (), 'ip6': (), 'start': ( '`echo "table persist counters" | pfctl -f-`',