|
|
|
@ -48,16 +48,16 @@ Action files specify which commands are executed to ban an IP address. They are
|
|
|
|
|
Like jail.conf files if you desire local changes create a [actionname].local file in the /etc/fail2ban/action.d directory
|
|
|
|
|
and override the required settings.
|
|
|
|
|
|
|
|
|
|
The action files are ini files that have two sections, \fBDefination\fR and \fBInit\fR .
|
|
|
|
|
The action files are ini files that have two sections, \fBDefinition\fR and \fBInit\fR .
|
|
|
|
|
|
|
|
|
|
The [Init] section allows for settings relevant to the action. In jail.conf/jail.local these can be overwritten for a particular jail.
|
|
|
|
|
|
|
|
|
|
The commands are specified in the [Defination] section as below..
|
|
|
|
|
The commands are specified in the [Definition] section as below..
|
|
|
|
|
|
|
|
|
|
The commands are executed through a system shell so shell redirection and process control is allowed. The commands should
|
|
|
|
|
return 0 to indicate success which will prevent fail2ban attempting to retry (up to \fBmaxretry\fR times to ban the IP again.
|
|
|
|
|
|
|
|
|
|
The following action parameters are in the [Defination] section.
|
|
|
|
|
The following action parameters are in the [Definition] section.
|
|
|
|
|
.TP
|
|
|
|
|
\fBactionstart\fR
|
|
|
|
|
This is the commands that are executed when the jail starts.
|
|
|
|
@ -101,14 +101,14 @@ The concatinated string of the log file lines of the matches that generated the
|
|
|
|
|
|
|
|
|
|
.SH FILTER FILES
|
|
|
|
|
|
|
|
|
|
Filter definations are those in /etc/fail2ban/filter.d/*.conf and filter.d/*.local.
|
|
|
|
|
Filter definitions are those in /etc/fail2ban/filter.d/*.conf and filter.d/*.local.
|
|
|
|
|
|
|
|
|
|
These are used to identify failed authenicate attempts in logs and to extract the host IP address or hostname.
|
|
|
|
|
|
|
|
|
|
Like action files, filter files are ini files. The main section is the [Definition] section.
|
|
|
|
|
|
|
|
|
|
There are two filter definations used in the [Defination] section, failregex and ignoreregex.
|
|
|
|
|
Other definations are allowed and can be used to substitue into other definations with %(defnname). For example.
|
|
|
|
|
There are two filter definitions used in the [Definition] section, failregex and ignoreregex.
|
|
|
|
|
Other definitions are allowed and can be used to substitue into other definitions with %(defnname). For example.
|
|
|
|
|
|
|
|
|
|
baduseragents = IE|wget
|
|
|
|
|
|
|
|
|
@ -130,11 +130,11 @@ Filters can also have a section called [INCLUDES]. This is used to read other co
|
|
|
|
|
|
|
|
|
|
.TP
|
|
|
|
|
\fBbefore\fR
|
|
|
|
|
indicates that this file is read before the [Defination] section.
|
|
|
|
|
indicates that this file is read before the [Definition] section.
|
|
|
|
|
|
|
|
|
|
.TP
|
|
|
|
|
\fBafter\fR
|
|
|
|
|
indicates that this file is read after the [Defination] section.
|
|
|
|
|
indicates that this file is read after the [Definition] section.
|
|
|
|
|
|
|
|
|
|
.SH AUTHOR
|
|
|
|
|
Fail2ban Written by Cyril Jaquier <cyril.jaquier@fail2ban.org> with many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
|
|
|
|
|