github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

DOC: when to use xarf messages to network owner

pull/468/head
Daniel Black 2013-12-03 20:40:42 +11:00
parent 8c37d2e4de
commit 1846056606
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
config/action.d/xarf-login-attack.conf
View File

@ -1,10 +1,21 @@
# Fail2Ban action for sending xarf Login-Attack messages to IP owner # Fail2Ban action for sending xarf Login-Attack messages to IP owner
# #
# IMPORTANT:
#
# Emailing a IP owner of abuse is a serious complain. Make sure that it is
# serious. Fail2ban developers and network owners recommend you only use this
# action for:
# * The recidive where the IP has been banned multiple times
# * Where maxretry has been set quite high, beyond the normal user typing
# password incorrectly.
# * For filters that have a low likelyhood of receiving human errors
#
# DEPENDANCIES:
#
# This requires the dig command from bind-utils # This requires the dig command from bind-utils
# #
# This uses the https://abusix.com/contactdb.html to lookup abuse contacts. # This uses the https://abusix.com/contactdb.html to lookup abuse contacts.
# #
#
# XARF is a specification for sending a formatted response # XARF is a specification for sending a formatted response
# for non-messaging based abuse including: # for non-messaging based abuse including:
# #

2
config/jail.conf
View File

@ -151,6 +151,8 @@ action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protoc
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
%(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"] %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
# See the IMPORTANT note in action.d/xarf-login-attack for when to use this action
#
# ban & send a xarf e-mail to abuse contact of IP address and include relevant log lines # ban & send a xarf e-mail to abuse contact of IP address and include relevant log lines
# to the destemail. # to the destemail.
action_xarf = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] action_xarf = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]