diff --git a/config/jail.conf b/config/jail.conf index 1d58edbe..1db5b5da 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -75,6 +75,22 @@ usedns = warn # The mail-whois action send a notification e-mail with a whois request # in the body. +[pam-generic] + +enabled = false +filter = pam-generic +action = iptables-allports[name=pam,protocol=all] +logpath = /var/log/secure + + +[xinetd-fail] + +enabled = false +filter = xinetd-fail +action = iptables-allports[name=xinetd,protocol=all] +logpath = /var/log/daemon*log + + [ssh-iptables] enabled = false @@ -84,6 +100,25 @@ action = iptables[name=SSH, port=ssh, protocol=tcp] logpath = /var/log/sshd.log maxretry = 5 + +[ssh-ddos] + +enabled = false +filter = sshd-ddos +action = iptables[name=SSHDDOS, port=ssh, protocol=tcp] +logpath = /var/log/sshd.log +maxretry = 2 + + +[dropbear] + +enabled = false +filter = dropbear +action = iptables[name=dropbear, port=ssh, protocol=tcp] +logpath = /var/log/messages +maxretry = 5 + + [proftpd-iptables] enabled = false @@ -94,6 +129,35 @@ logpath = /var/log/proftpd/proftpd.log maxretry = 6 +[gssftpd-iptables] + +enabled = false +filter = gssftpd +action = iptables[name=GSSFTPd, port=ftp, protocol=tcp] + sendmail-whois[name=GSSFTPd, dest=you@example.com] +logpath = /var/log/daemon.log +maxretry = 6 + + +[pure-ftpd] + +enabled = false +filter = pure-ftpd +action = iptables[name=pureftpd, port=ftp, protocol=tcp] +logpath = /var/log/pureftpd.log +maxretry = 6 + + +[wuftpd] + +enabled = false +filter = wuftpd +action = iptables[name=wuftpd, port=ftp, protocol=tcp] +logpath = /var/log/daemon.log +maxretry = 6 + + + # This jail forces the backend to "polling". [sasl-iptables] @@ -197,7 +261,26 @@ logpath = /var/log/apache*/*error.log maxretry = 2 -[nginx-http-auth] +[apache-overflows] + +enabled = false +filter = apache-overflows +action = iptables-multiport[name=apache-overflows,port="80,443"] +logpath = /var/log/apache*/*error.log + /home/www/myhomepage/error.log +maxretry = 2 + + +[apache-nohome] + +enabled = false +filter = apache-nohome +action = iptables-multiport[name=apache-nohome,port="80,443"] +logpath = /var/log/apache*/*error.log + /home/www/myhomepage/error.log +maxretry = 2 + + [nginx-http-auth] enabled = false @@ -206,6 +289,14 @@ action = iptables-multiport[name=nginx-http-auth,port="80,443"] logpath = /var/log/nginx/error.log +[squid] + +enabled = false +filter = squid +action = iptables-multiport[name=squid,port="80,443,8080"] +logpath = /var/log/squid/access.log + + # The hosts.deny path can be defined with the "file" argument if it is # not in /etc. [postfix-tcpwrapper] @@ -218,6 +309,46 @@ logpath = /var/log/postfix.log bantime = 300 +[cyrus-imap] + +enabled = false +filter = cyrus-imap +action = iptables-multiport[name=cyrus-imap,port="143,993"] +logpath = /var/log/mail*log + + +[courierlogin] + +enabled = false +filter = courierlogin +action = iptables-multiport[name=courierlogin,port="25,110,143,465,587,993,995"] +logpath = /var/log/mail*log + + +[couriersmtp] + +enabled = false +filter = couriersmtp +action = iptables-multiport[name=couriersmtp,port="25,465,587"] +logpath = /var/log/mail*log + + +[qmail-rbl] + +enabled = false +filter = qmail +action = iptables-multiport[name=qmail-rbl,port="25,465,587"] +logpath = /service/qmail/log/main/current + + +[sieve] + +enabled = false +filter = sieve +action = iptables-multiport[name=sieve,port="25,465,587"] +logpath = /var/log/mail*log + + # Do not ban anybody. Just report information about the remote host. # A notification is sent at most every 600 seconds (bantime). [vsftpd-notification] @@ -295,6 +426,25 @@ action = ipfw maxretry = 5 +[horde] + +enabled = false +filter = horde +logpath = /var/log/horde/horde.log +action = iptables-multiport[name=horde, port="http,https"] +maxretry = 5 + + +# Ban attackers that try to use PHP's URL-fopen() functionality +# through GET/POST variables. - Experimental, with more than a year +# of usage in production environments. +[php-url-fopen] + +enabled = false +action = iptables-multiport[name=php-url-open, port="http,https"] +filter = php-url-fopen +logpath = /var/www/*/logs/access_log +maxretry = 1 # Ban attackers that try to use PHP's URL-fopen() functionality # through GET/POST variables. - Experimental, with more than a year # of usage in production environments. @@ -372,6 +522,15 @@ logpath = /var/log/named/security.log ignoreip = 168.192.0.1 +[nsd] + +enabled = false +filter = nsd +action = iptables-multiport[name=nsd-tcp, port="domain", protocol=tcp] + iptables-multiport[name=nsd-udp, port="domain", protocol=udp] +logpath = /var/log/nsd.log + + [asterisk] enabled = false @@ -565,9 +724,9 @@ logpath = /var/log/mail.log [selinux-ssh] -enabled = false -filter = selinux-ssh -action = iptables[name=SELINUX-SSH, port=ssh, protocol=tcp] +enabled = false +filter = selinux-ssh +action = iptables[name=SELINUX-SSH, port=ssh, protocol=tcp] logpath = /var/log/audit/audit.log maxretry = 5