github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge branch '0.10-ipset-tout' into 0.10, amend to #2703: resolves names conflict (command action timeout and ipset timeout); closes #2790

pull/2814/head
sebres 2020-08-04 13:51:55 +02:00
parent 62a6771b33 73a8175bb0
commit 9100d07c03
4 changed files with 28 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
config/action.d/firewallcmd-ipset.conf
View File

@ -18,7 +18,7 @@ before = firewallcmd-common.conf
[Definition] [Definition]
actionstart = ipset create <ipmset> hash:ip timeout <default-timeout> <familyopt> actionstart = ipset create <ipmset> hash:ip timeout <default-ipsettime> <familyopt>
firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype> firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
actionflush = ipset flush <ipmset> actionflush = ipset flush <ipmset>
@ -27,7 +27,7 @@ actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 <acti
<actionflush> <actionflush>
ipset destroy <ipmset> ipset destroy <ipmset>
actionban = ipset add <ipmset> <ip> timeout <timeout> -exist actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
actionunban = ipset del <ipmset> <ip> -exist actionunban = ipset del <ipmset> <ip> -exist
@ -40,18 +40,18 @@ actionunban = ipset del <ipmset> <ip> -exist
# #
chain = INPUT_direct chain = INPUT_direct
# Option: default-timeout # Option: default-ipsettime
# Notes: specifies default timeout in seconds (handled default ipset timeout only) # Notes: specifies default timeout in seconds (handled default ipset timeout only)
# Values: [ NUM ] Default: 0 (no timeout, managed by fail2ban by unban) # Values: [ NUM ] Default: 0 (no timeout, managed by fail2ban by unban)
default-timeout = 0 default-ipsettime = 0
# Option: timeout # Option: ipsettime
# Notes: specifies ticket timeout (handled ipset timeout only) # Notes: specifies ticket timeout (handled ipset timeout only)
# Values: [ NUM ] Default: 0 (managed by fail2ban by unban) # Values: [ NUM ] Default: 0 (managed by fail2ban by unban)
timeout = 0 ipsettime = 0
# expresion to caclulate timeout from bantime, example: # expresion to caclulate timeout from bantime, example:
# banaction = %(known/banaction)s[timeout='<timeout-bantime>'] # banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0) timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
# Option: actiontype # Option: actiontype

14
config/action.d/iptables-ipset-proto6-allports.conf
View File

@ -26,7 +26,7 @@ before = iptables-common.conf
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
# Values: CMD # Values: CMD
# #
actionstart = ipset create <ipmset> hash:ip timeout <default-timeout> <familyopt> actionstart = ipset create <ipmset> hash:ip timeout <default-ipsettime> <familyopt>
<iptables> -I <chain> -m set --match-set <ipmset> src -j <blocktype> <iptables> -I <chain> -m set --match-set <ipmset> src -j <blocktype>
# Option: actionflush # Option: actionflush
@ -49,7 +49,7 @@ actionstop = <iptables> -D <chain> -m set --match-set <ipmset> src -j <blocktype
# Tags: See jail.conf(5) man page # Tags: See jail.conf(5) man page
# Values: CMD # Values: CMD
# #
actionban = ipset add <ipmset> <ip> timeout <timeout> -exist actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
# Option: actionunban # Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the # Notes.: command executed when unbanning an IP. Take care that the
@ -61,18 +61,18 @@ actionunban = ipset del <ipmset> <ip> -exist
[Init] [Init]
# Option: default-timeout # Option: default-ipsettime
# Notes: specifies default timeout in seconds (handled default ipset timeout only) # Notes: specifies default timeout in seconds (handled default ipset timeout only)
# Values: [ NUM ] Default: 0 (no timeout, managed by fail2ban by unban) # Values: [ NUM ] Default: 0 (no timeout, managed by fail2ban by unban)
default-timeout = 0 default-ipsettime = 0
# Option: timeout # Option: ipsettime
# Notes: specifies ticket timeout (handled ipset timeout only) # Notes: specifies ticket timeout (handled ipset timeout only)
# Values: [ NUM ] Default: 0 (managed by fail2ban by unban) # Values: [ NUM ] Default: 0 (managed by fail2ban by unban)
timeout = 0 ipsettime = 0
# expresion to caclulate timeout from bantime, example: # expresion to caclulate timeout from bantime, example:
# banaction = %(known/banaction)s[timeout='<timeout-bantime>'] # banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0) timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
ipmset = f2b-<name> ipmset = f2b-<name>

14
config/action.d/iptables-ipset-proto6.conf
View File

@ -26,7 +26,7 @@ before = iptables-common.conf
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
# Values: CMD # Values: CMD
# #
actionstart = ipset create <ipmset> hash:ip timeout <default-timeout> <familyopt> actionstart = ipset create <ipmset> hash:ip timeout <default-ipsettime> <familyopt>
<iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype> <iptables> -I <chain> -p <protocol> -m multiport --dports <port> -m set --match-set <ipmset> src -j <blocktype>
# Option: actionflush # Option: actionflush
@ -49,7 +49,7 @@ actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m
# Tags: See jail.conf(5) man page # Tags: See jail.conf(5) man page
# Values: CMD # Values: CMD
# #
actionban = ipset add <ipmset> <ip> timeout <timeout> -exist actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist
# Option: actionunban # Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the # Notes.: command executed when unbanning an IP. Take care that the
@ -61,18 +61,18 @@ actionunban = ipset del <ipmset> <ip> -exist
[Init] [Init]
# Option: default-timeout # Option: default-ipsettime
# Notes: specifies default timeout in seconds (handled default ipset timeout only) # Notes: specifies default timeout in seconds (handled default ipset timeout only)
# Values: [ NUM ] Default: 0 (no timeout, managed by fail2ban by unban) # Values: [ NUM ] Default: 0 (no timeout, managed by fail2ban by unban)
default-timeout = 0 default-ipsettime = 0
# Option: timeout # Option: ipsettime
# Notes: specifies ticket timeout (handled ipset timeout only) # Notes: specifies ticket timeout (handled ipset timeout only)
# Values: [ NUM ] Default: 0 (managed by fail2ban by unban) # Values: [ NUM ] Default: 0 (managed by fail2ban by unban)
timeout = 0 ipsettime = 0
# expresion to caclulate timeout from bantime, example: # expresion to caclulate timeout from bantime, example:
# banaction = %(known/banaction)s[timeout='<timeout-bantime>'] # banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0) timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)
ipmset = f2b-<name> ipmset = f2b-<name>

14
config/action.d/shorewall-ipset-proto6.conf
View File

@ -51,7 +51,7 @@
# Values: CMD # Values: CMD
# #
actionstart = if ! ipset -quiet -name list f2b-<name> >/dev/null; actionstart = if ! ipset -quiet -name list f2b-<name> >/dev/null;
then ipset -quiet -exist create f2b-<name> hash:ip timeout <default-timeout>; then ipset -quiet -exist create f2b-<name> hash:ip timeout <default-ipsettime>;
fi fi
# Option: actionstop # Option: actionstop
@ -66,7 +66,7 @@ actionstop = ipset flush f2b-<name>
# Tags: See jail.conf(5) man page # Tags: See jail.conf(5) man page
# Values: CMD # Values: CMD
# #
actionban = ipset add f2b-<name> <ip> timeout <timeout> -exist actionban = ipset add f2b-<name> <ip> timeout <ipsettime> -exist
# Option: actionunban # Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the # Notes.: command executed when unbanning an IP. Take care that the
@ -76,16 +76,16 @@ actionban = ipset add f2b-<name> <ip> timeout <timeout> -exist
# #
actionunban = ipset del f2b-<name> <ip> -exist actionunban = ipset del f2b-<name> <ip> -exist
# Option: default-timeout # Option: default-ipsettime
# Notes: specifies default timeout in seconds (handled default ipset timeout only) # Notes: specifies default timeout in seconds (handled default ipset timeout only)
# Values: [ NUM ] Default: 0 (no timeout, managed by fail2ban by unban) # Values: [ NUM ] Default: 0 (no timeout, managed by fail2ban by unban)
default-timeout = 0 default-ipsettime = 0
# Option: timeout # Option: ipsettime
# Notes: specifies ticket timeout (handled ipset timeout only) # Notes: specifies ticket timeout (handled ipset timeout only)
# Values: [ NUM ] Default: 0 (managed by fail2ban by unban) # Values: [ NUM ] Default: 0 (managed by fail2ban by unban)
timeout = 0 ipsettime = 0
# expresion to caclulate timeout from bantime, example: # expresion to caclulate timeout from bantime, example:
# banaction = %(known/banaction)s[timeout='<timeout-bantime>'] # banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0) timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)