github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

ENH: moved jail definition for recidive into jail.conf + swapped/commented durations + non-groupping ?: 

thanks @cepheid666 for the useful comments
_tent/robust_datematching
Yaroslav Halchenko 2012-01-26 23:28:44 -05:00
parent 0eaa4c2750
commit 1807be5a8c
2 changed files with 12 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
config/filter.d/recidive.conf
View File

@ -14,20 +14,6 @@
# different blocking mechanism for this jail versus others (e.g. hostsdeny # different blocking mechanism for this jail versus others (e.g. hostsdeny
# for most jails, and shorewall for this one). # for most jails, and shorewall for this one).
# #
# Configuration example for jail.conf:
#
# [recidive]
# enabled = true
# filter = recidive
# logpath = /var/log/fail2ban.log
# action = iptables-allports[name=recidive]
# sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log]
# findtime = 604800
# bantime = 86400
# maxretry = 5
#
# $Revision: $
#
[Definition] [Definition]
@ -42,7 +28,7 @@ _jailname = recidive
# (?:::f{4,6}:)?(?P<host>\S+) # (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT # Values: TEXT
# #
failregex = fail2ban.actions:\s+WARNING\s+\[(.*)\]\s+Ban\s+<HOST> failregex = fail2ban.actions:\s+WARNING\s+\[(?:.*)\]\s+Ban\s+<HOST>
# Option: ignoreregex # Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored. # Notes.: regex to ignore. If this regex matches, the line is ignored.

11
config/jail.conf
View File

@ -264,3 +264,14 @@ action = iptables-multiport[name=Named, port="domain,953", protocol=tcp]
logpath = /var/log/named/security.log logpath = /var/log/named/security.log
ignoreip = 168.192.0.1 ignoreip = 168.192.0.1
# Jail for more extended banning of persistent abusers
[recidive]
enabled = false
filter = recidive
logpath = /var/log/fail2ban.log
action = iptables-allports[name=recidive]
sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log]
bantime = 604800 # 1 week
findtime = 86400 # 1 day
maxretry = 5