|
|
|
@ -5,12 +5,67 @@
|
|
|
|
|
# $Revision$ |
|
|
|
|
# |
|
|
|
|
|
|
|
|
|
[dummy] |
|
|
|
|
|
|
|
|
|
enabled = false |
|
|
|
|
filter = sshd |
|
|
|
|
action = hostsdeny[file=/tmp/hosts.deny] |
|
|
|
|
mail[name=SSH, dest=cyril.jaquier@bluewin.ch] |
|
|
|
|
logpath = /home/cyril/workspace/fail2ban-unstable/testcases/files/testcase01.log |
|
|
|
|
maxretry = 2 |
|
|
|
|
bantime = 10 |
|
|
|
|
# This jail corresponds to the standard configuration in Fail2ban 0.6. |
|
|
|
|
# The mail-whois action send a notification e-mail with a whois request |
|
|
|
|
# in the body. |
|
|
|
|
|
|
|
|
|
[ssh-iptables] |
|
|
|
|
|
|
|
|
|
enabled = false |
|
|
|
|
filter = sshd |
|
|
|
|
action = iptables[name=SSH, port=ssh, protocol=tcp] |
|
|
|
|
mail-whois[name=SSH, dest=yourmail@mail.com] |
|
|
|
|
logpath = /var/log/sshd.log |
|
|
|
|
maxretry = 5 |
|
|
|
|
bantime = 600 |
|
|
|
|
|
|
|
|
|
# This one behaves like the previous and sends a report when the jail |
|
|
|
|
# is stopped. |
|
|
|
|
|
|
|
|
|
[ssh-iptables-report] |
|
|
|
|
|
|
|
|
|
enabled = false |
|
|
|
|
filter = sshd |
|
|
|
|
action = iptables[name=SSH, port=ssh, protocol=tcp] |
|
|
|
|
mail-whois[name=SSH, dest=yourmail@mail.com] |
|
|
|
|
mail-report[dest=yourmail@mail.com] |
|
|
|
|
logpath = /var/log/sshd.log |
|
|
|
|
maxretry = 5 |
|
|
|
|
bantime = 600 |
|
|
|
|
|
|
|
|
|
# Here we use TCP-Wrappers instead of Netfilter/Iptables. |
|
|
|
|
|
|
|
|
|
[ssh-tcpwrapper] |
|
|
|
|
|
|
|
|
|
enabled = false |
|
|
|
|
filter = sshd |
|
|
|
|
action = hostsdeny |
|
|
|
|
mail-whois[name=SSH, dest=yourmail@mail.com] |
|
|
|
|
logpath = /var/log/sshd.log |
|
|
|
|
maxretry = 3 |
|
|
|
|
bantime = 600 |
|
|
|
|
|
|
|
|
|
# The hosts.deny path can be defined with the "file" argument if it is |
|
|
|
|
# not in /etc. |
|
|
|
|
|
|
|
|
|
[postfix-tcpwrapper] |
|
|
|
|
|
|
|
|
|
enabled = false |
|
|
|
|
filter = postfix |
|
|
|
|
action = hostsdeny[file=/not/a/standard/path/hosts.deny] |
|
|
|
|
mail[name=Postfix, dest=yourmail@mail.com] |
|
|
|
|
logpath = /var/log/postfix.log |
|
|
|
|
maxretry = 6 |
|
|
|
|
bantime = 300 |
|
|
|
|
|
|
|
|
|
# Do not ban anybody. Just report information about the remote host. |
|
|
|
|
# A notification is sent at most every 600 seconds (bantime). |
|
|
|
|
|
|
|
|
|
[vsftpd-notification] |
|
|
|
|
|
|
|
|
|
enabled = false |
|
|
|
|
filter = vsftpd |
|
|
|
|
action = mail-whois[name=VSFTPD, dest=yourmail@mail.com] |
|
|
|
|
logpath = /var/log/vsftpd.log |
|
|
|
|
maxretry = 3 |
|
|
|
|
bantime = 600 |
|
|
|
|