github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

- Added missing svn:keywords 

- Split failregex in sshd.conf
- Added sshd-ddos.conf. Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@510 a942ae1a-1317-0410-a47c-b1dcaea8d605
0.x
Cyril Jaquier 2007-01-04 12:21:44 +00:00
parent 7719c00d37
commit 44d75eb54f
14 changed files with 37 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
config/action.d/ipfw.conf
View File

@ -3,7 +3,7 @@
# Author: Nick Munger # Author: Nick Munger
# Modified by: Cyril Jaquier # Modified by: Cyril Jaquier
# #
# $Revision: 254 $ # $Revision$
# #
[Definition] [Definition]

2
config/action.d/mail-whois.conf
View File

@ -2,7 +2,7 @@
# #
# Author: Cyril Jaquier # Author: Cyril Jaquier
# #
# $Revision: 254 $ # $Revision$
# #
[Definition] [Definition]

2
config/action.d/mail.conf
View File

@ -2,7 +2,7 @@
# #
# Author: Cyril Jaquier # Author: Cyril Jaquier
# #
# $Revision: 254 $ # $Revision$
# #
[Definition] [Definition]

2
config/action.d/shorewall.conf
View File

@ -2,7 +2,7 @@
# #
# Author: Cyril Jaquier # Author: Cyril Jaquier
# #
# $Revision: 394 $ # $Revision$
# #
[Definition] [Definition]

2
config/filter.d/apache-noscript.conf
View File

@ -2,7 +2,7 @@
# #
# Author: Cyril Jaquier # Author: Cyril Jaquier
# #
# $Revision: 394 $ # $Revision$
# #
[Definition] [Definition]

2
config/filter.d/courierlogin.conf
View File

@ -3,7 +3,7 @@
# Author: Christoph Haas # Author: Christoph Haas
# Modified by: Cyril Jaquier # Modified by: Cyril Jaquier
# #
# $Revision: 267 $ # $Revision$
# #
[Definition] [Definition]

2
config/filter.d/couriersmtp.conf
View File

@ -2,7 +2,7 @@
# #
# Author: Cyril Jaquier # Author: Cyril Jaquier
# #
# $Revision: 267 $ # $Revision$
# #
[Definition] [Definition]

2
config/filter.d/exim.conf
View File

@ -2,7 +2,7 @@
# #
# Author: Cyril Jaquier # Author: Cyril Jaquier
# #
# $Revision: 267 $ # $Revision$
# #
[Definition] [Definition]

2
config/filter.d/postfix.conf
View File

@ -2,7 +2,7 @@
# #
# Author: Cyril Jaquier # Author: Cyril Jaquier
# #
# $Revision: 267 $ # $Revision$
# #
[Definition] [Definition]

2
config/filter.d/proftpd.conf
View File

@ -2,7 +2,7 @@
# #
# Author: Yaroslav Halchenko # Author: Yaroslav Halchenko
# #
# $Revision: 331 $ # $Revision$
# #
[Definition] [Definition]

2
config/filter.d/qmail.conf
View File

@ -2,7 +2,7 @@
# #
# Author: Cyril Jaquier # Author: Cyril Jaquier
# #
# $Revision: 267 $ # $Revision$
# #
[Definition] [Definition]

2
config/filter.d/sasl.conf
View File

@ -2,7 +2,7 @@
# #
# Author: Yaroslav Halchenko # Author: Yaroslav Halchenko
# #
# $Revision: 331 $ # $Revision$
# #
[Definition] [Definition]

23
config/filter.d/sshd-ddos.conf Normal file
View File

@ -0,0 +1,23 @@
# Fail2Ban configuration file
#
# Author: Yaroslav Halchenko
#
# $Revision$
#
[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = sshd\[\S*\]: Did not receive identification string from <HOST>
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

3
config/filter.d/sshd.conf
View File

@ -14,7 +14,8 @@
# (?:::f{4,6}:)?(?P<host>\S+) # (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT # Values: TEXT
# #
failregex = (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) <HOST> failregex = (?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid))? user .*(?: from|FROM) <HOST>
ROOT LOGIN REFUSED .*(?: from|FROM) <HOST>
# Option: ignoreregex # Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored. # Notes.: regex to ignore. If this regex matches, the line is ignored.