github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

cherry-pick from debian: debian default banactions are nftables, systemd backend for sshd 

closes gh-3292
pull/3727/head
sebres 2024-04-26 00:25:19 +02:00
parent c14327565d
commit d0d0728523
3 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -11,6 +11,13 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
----------- -----------
### Fixes ### Fixes
* `jail.conf`:
- default banactions need to be specified in `paths-*.conf` (maintainer level) now
- since stock fail2ban includes `paths-debian.conf` by default, banactions are `nftables`
(can be overwritten in `jail.local` by user)
* `paths-debian.conf`:
- default banactions are `nftables`
- sshd backend switched to `systemd` (gh-3292)
### New Features and Enhancements ### New Features and Enhancements

4
config/jail.conf
View File

@ -205,8 +205,8 @@ fail2ban_agent = Fail2Ban/%(fail2ban_version)s
# iptables-multiport, shorewall, etc) It is used to define # iptables-multiport, shorewall, etc) It is used to define
# action_* variables. Can be overridden globally or per # action_* variables. Can be overridden globally or per
# section within jail.local file # section within jail.local file
banaction = iptables-multiport #banaction = iptables-multiport
banaction_allports = iptables-allports #banaction_allports = iptables-allports
# The simplest action to take: ban only # The simplest action to take: ban only
action_ = %(banaction)s[port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] action_ = %(banaction)s[port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

5
config/paths-debian.conf
View File

@ -9,6 +9,11 @@ after = paths-overrides.local
[DEFAULT] [DEFAULT]
banaction = nftables
banaction_allports = nftables[type=allports]
sshd_backend = systemd
syslog_mail = /var/log/mail.log syslog_mail = /var/log/mail.log
# control the `mail.warn` setting, see `/etc/rsyslog.d/50-default.conf` (if commented `mail.*` wins). # control the `mail.warn` setting, see `/etc/rsyslog.d/50-default.conf` (if commented `mail.*` wins).