mirror of https://github.com/fail2ban/fail2ban
first attempt to make certain standard actions breakdown safe starting with iptables:
- better check mechanism (using `-C`, option `--check` is available long time); - additionally iptables is a replacement for iptables-common now, several actions using this as include now become obsolete; - many features of different iptables actions are combinable as single chain/rule (can be supplied to action as parameters);pull/2990/merge
sebres
parent
35591db3e8
commit
d26209e2c6
1
MANIFEST
1
MANIFEST
|
|
@ -25,7 +25,6 @@ config/action.d/hostsdeny.conf
|
|||
config/action.d/ipfilter.conf
|
||||
config/action.d/ipfw.conf
|
||||
config/action.d/iptables-allports.conf
|
||||
config/action.d/iptables-common.conf
|
||||
config/action.d/iptables.conf
|
||||
config/action.d/iptables-ipset-proto4.conf
|
||||
config/action.d/iptables-ipset-proto6-allports.conf
|
||||
|
|
|
|||
|
|
@ -4,52 +4,12 @@
|
|||
# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
|
||||
# made active on all ports from original iptables.conf
|
||||
#
|
||||
#
|
||||
# Obsolete: superseded by iptables[type=allports]
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = iptables-common.conf
|
||||
|
||||
before = iptables.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = <iptables> -N f2b-<name>
|
||||
<iptables> -A f2b-<name> -j <returntype>
|
||||
<iptables> -I <chain> -p <protocol> -j f2b-<name>
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = <iptables> -D <chain> -p <protocol> -j f2b-<name>
|
||||
<actionflush>
|
||||
<iptables> -X f2b-<name>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
|
||||
|
||||
[Init]
|
||||
|
||||
type = allports
|
||||
|
|
|
|||
|
|
@ -1,92 +0,0 @@
|
|||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Daniel Black
|
||||
#
|
||||
# This is a included configuration file and includes the definitions for the iptables
|
||||
# used in all iptables based actions by default.
|
||||
#
|
||||
# The user can override the defaults in iptables-common.local
|
||||
#
|
||||
# Modified: Alexander Koeppe <format_c@online.de>, Serg G. Brester <serg.brester@sebres.de>
|
||||
# made config file IPv6 capable (see new section Init?family=inet6)
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
after = iptables-blocktype.local
|
||||
iptables-common.local
|
||||
# iptables-blocktype.local is obsolete
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: actionflush
|
||||
# Notes.: command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
|
||||
# Values: CMD
|
||||
#
|
||||
actionflush = <iptables> -F f2b-<name>
|
||||
|
||||
|
||||
[Init]
|
||||
|
||||
# Option: chain
|
||||
# Notes specifies the iptables chain to which the Fail2Ban rules should be
|
||||
# added
|
||||
# Values: STRING Default: INPUT
|
||||
chain = INPUT
|
||||
|
||||
# Default name of the chain
|
||||
#
|
||||
name = default
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = ssh
|
||||
|
||||
# Option: protocol
|
||||
# Notes.: internally used by config reader for interpolations.
|
||||
# Values: [ tcp | udp | icmp | all ] Default: tcp
|
||||
#
|
||||
protocol = tcp
|
||||
|
||||
# Option: blocktype
|
||||
# Note: This is what the action does with rules. This can be any jump target
|
||||
# as per the iptables man page (section 8). Common values are DROP
|
||||
# REJECT, REJECT --reject-with icmp-port-unreachable
|
||||
# Values: STRING
|
||||
blocktype = REJECT --reject-with icmp-port-unreachable
|
||||
|
||||
# Option: returntype
|
||||
# Note: This is the default rule on "actionstart". This should be RETURN
|
||||
# in all (blocking) actions, except REJECT in allowing actions.
|
||||
# Values: STRING
|
||||
returntype = RETURN
|
||||
|
||||
# Option: lockingopt
|
||||
# Notes.: Option was introduced to iptables to prevent multiple instances from
|
||||
# running concurrently and causing irratic behavior. -w was introduced
|
||||
# in iptables 1.4.20, so might be absent on older systems
|
||||
# See https://github.com/fail2ban/fail2ban/issues/1122
|
||||
# Values: STRING
|
||||
lockingopt = -w
|
||||
|
||||
# Option: iptables
|
||||
# Notes.: Actual command to be executed, including common to all calls options
|
||||
# Values: STRING
|
||||
iptables = iptables <lockingopt>
|
||||
|
||||
|
||||
[Init?family=inet6]
|
||||
|
||||
# Option: blocktype (ipv6)
|
||||
# Note: This is what the action does with rules. This can be any jump target
|
||||
# as per the iptables man page (section 8). Common values are DROP
|
||||
# REJECT, REJECT --reject-with icmp6-port-unreachable
|
||||
# Values: STRING
|
||||
blocktype = REJECT --reject-with icmp6-port-unreachable
|
||||
|
||||
# Option: iptables (ipv6)
|
||||
# Notes.: Actual command to be executed, including common to all calls options
|
||||
# Values: STRING
|
||||
iptables = ip6tables <lockingopt>
|
||||
|
||||
|
|
@ -19,7 +19,7 @@
|
|||
|
||||
[INCLUDES]
|
||||
|
||||
before = iptables-common.conf
|
||||
before = iptables.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@
|
|||
|
||||
[INCLUDES]
|
||||
|
||||
before = iptables-common.conf
|
||||
before = iptables.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@
|
|||
|
||||
[INCLUDES]
|
||||
|
||||
before = iptables-common.conf
|
||||
before = iptables.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@
|
|||
|
||||
[INCLUDES]
|
||||
|
||||
before = iptables-common.conf
|
||||
before = iptables.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
|
|
|
|||
|
|
@ -3,50 +3,12 @@
|
|||
# Author: Cyril Jaquier
|
||||
# Modified by Yaroslav Halchenko for multiport banning
|
||||
#
|
||||
# Obsolete: superseded by iptables[type=multiport]
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = iptables-common.conf
|
||||
before = iptables.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = <iptables> -N f2b-<name>
|
||||
<iptables> -A f2b-<name> -j <returntype>
|
||||
<iptables> -I <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -j f2b-<name>
|
||||
<actionflush>
|
||||
<iptables> -X f2b-<name>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
|
||||
|
||||
[Init]
|
||||
|
||||
type = multiport
|
||||
|
|
|
|||
|
|
@ -4,51 +4,12 @@
|
|||
# Copied from iptables.conf and modified by Yaroslav Halchenko
|
||||
# to fulfill the needs of bugreporter dbts#350746.
|
||||
#
|
||||
#
|
||||
# Obsolete: superseded by iptables[pre-rule='-m state --state NEW<sp>']
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = iptables-common.conf
|
||||
before = iptables.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = <iptables> -N f2b-<name>
|
||||
<iptables> -A f2b-<name> -j <returntype>
|
||||
<iptables> -I <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = <iptables> -D <chain> -m state --state NEW -p <protocol> --dport <port> -j f2b-<name>
|
||||
<actionflush>
|
||||
<iptables> -X f2b-<name>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
|
||||
|
||||
[Init]
|
||||
|
||||
pre-rule = -m state --state NEW<sp>
|
||||
|
|
@ -7,7 +7,7 @@
|
|||
|
||||
[INCLUDES]
|
||||
|
||||
before = iptables-common.conf
|
||||
before = iptables.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
|
|
@ -52,7 +52,7 @@ actionstop = echo / > /proc/net/xt_recent/<iptname>
|
|||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = test -e /proc/net/xt_recent/<iptname>
|
||||
actioncheck = { <known/actioncheck>; } && test -e /proc/net/xt_recent/<iptname>
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
|
|
|
|||
|
|
@ -1,28 +1,42 @@
|
|||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
# Authors: Sergey G. Brester (sebres), Cyril Jaquier, Daniel Black,
|
||||
# Yaroslav O. Halchenko, Alexander Koeppe et al.
|
||||
#
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = iptables-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: type
|
||||
# Notes.: type of the action.
|
||||
# Values: [ oneport | multiport | allports ] Default: oneport
|
||||
#
|
||||
type = oneport
|
||||
|
||||
# Option: rule
|
||||
# Notes.: type of the iptables rule.
|
||||
# Values: [ iptables | ipset ] Default: iptables
|
||||
#
|
||||
rule = iptables
|
||||
|
||||
# Option: actionflush
|
||||
# Notes.: command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action)
|
||||
# Values: CMD
|
||||
#
|
||||
actionflush = <iptables> -F f2b-<name>
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = <iptables> -N f2b-<name>
|
||||
<iptables> -A f2b-<name> -j <returntype>
|
||||
<iptables> -I <chain> -p <protocol> --dport <port> -j f2b-<name>
|
||||
<iptables> -I <chain> %(_ipt_chain_rule)s
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = <iptables> -D <chain> -p <protocol> --dport <port> -j f2b-<name>
|
||||
actionstop = <iptables> -D <chain> %(_ipt_chain_rule)s
|
||||
<actionflush>
|
||||
<iptables> -X f2b-<name>
|
||||
|
||||
|
|
@ -30,7 +44,7 @@ actionstop = <iptables> -D <chain> -p <protocol> --dport <port> -j f2b-<name>
|
|||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
|
||||
actioncheck = %(_ipt_check_rule)s
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
|
|
@ -48,5 +62,90 @@ actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
|
|||
#
|
||||
actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
|
||||
|
||||
# Option: pre-rule
|
||||
# Notes.: prefix parameter(s) inserted to the begin of rule. No default (empty)
|
||||
#
|
||||
pre-rule =
|
||||
|
||||
# Several capabilities used internaly:
|
||||
|
||||
_ipt_chain_rule = <pre-rule><ipt_<type>/_chain_rule>
|
||||
_ipt_check_rule = <iptables> -C <chain> %(_ipt_chain_rule)s
|
||||
|
||||
[ipt_oneport]
|
||||
|
||||
_chain_rule = -p <protocol> --dport <port> -j f2b-<name>
|
||||
|
||||
[ipt_multiport]
|
||||
|
||||
_chain_rule = -p <protocol> -m multiport --dports <port> -j f2b-<name>
|
||||
|
||||
[ipt_allports]
|
||||
|
||||
_chain_rule = -p <protocol> -j f2b-<name>
|
||||
|
||||
|
||||
[Init]
|
||||
|
||||
# Option: chain
|
||||
# Notes specifies the iptables chain to which the Fail2Ban rules should be
|
||||
# added
|
||||
# Values: STRING Default: INPUT
|
||||
chain = INPUT
|
||||
|
||||
# Default name of the chain
|
||||
#
|
||||
name = default
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = ssh
|
||||
|
||||
# Option: protocol
|
||||
# Notes.: internally used by config reader for interpolations.
|
||||
# Values: [ tcp | udp | icmp | all ] Default: tcp
|
||||
#
|
||||
protocol = tcp
|
||||
|
||||
# Option: blocktype
|
||||
# Note: This is what the action does with rules. This can be any jump target
|
||||
# as per the iptables man page (section 8). Common values are DROP
|
||||
# REJECT, REJECT --reject-with icmp-port-unreachable
|
||||
# Values: STRING
|
||||
blocktype = REJECT --reject-with icmp-port-unreachable
|
||||
|
||||
# Option: returntype
|
||||
# Note: This is the default rule on "actionstart". This should be RETURN
|
||||
# in all (blocking) actions, except REJECT in allowing actions.
|
||||
# Values: STRING
|
||||
returntype = RETURN
|
||||
|
||||
# Option: lockingopt
|
||||
# Notes.: Option was introduced to iptables to prevent multiple instances from
|
||||
# running concurrently and causing irratic behavior. -w was introduced
|
||||
# in iptables 1.4.20, so might be absent on older systems
|
||||
# See https://github.com/fail2ban/fail2ban/issues/1122
|
||||
# Values: STRING
|
||||
lockingopt = -w
|
||||
|
||||
# Option: iptables
|
||||
# Notes.: Actual command to be executed, including common to all calls options
|
||||
# Values: STRING
|
||||
iptables = iptables <lockingopt>
|
||||
|
||||
|
||||
[Init?family=inet6]
|
||||
|
||||
# Option: blocktype (ipv6)
|
||||
# Note: This is what the action does with rules. This can be any jump target
|
||||
# as per the iptables man page (section 8). Common values are DROP
|
||||
# REJECT, REJECT --reject-with icmp6-port-unreachable
|
||||
# Values: STRING
|
||||
blocktype = REJECT --reject-with icmp6-port-unreachable
|
||||
|
||||
# Option: iptables (ipv6)
|
||||
# Notes.: Actual command to be executed, including common to all calls options
|
||||
# Values: STRING
|
||||
iptables = ip6tables <lockingopt>
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
|
||||
[INCLUDES]
|
||||
|
||||
before = iptables-common.conf
|
||||
before = iptables.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
|
|
@ -41,6 +41,11 @@ actionban = echo 'all' >| /etc/symbiosis/firewall/blacklist.d/<ip>.auto
|
|||
actionunban = rm -f /etc/symbiosis/firewall/blacklist.d/<ip>.auto
|
||||
<iptables> -D <chain> -s <ip> -j <blocktype> || :
|
||||
|
||||
# [TODO] Flushing is currently not implemented for symbiosis blacklist.d
|
||||
#
|
||||
actionflush =
|
||||
|
||||
|
||||
[Init]
|
||||
|
||||
# Option: chain
|
||||
|
|
|
|||
|
|
@ -656,7 +656,7 @@ class JailsReaderTestCache(LogCaptureTestCase):
|
|||
cnt = self._getLoggedReadCount(r'filter\.d/common\.conf')
|
||||
self.assertTrue(cnt == 1, "Unexpected count by reading of filter files, cnt = %s" % cnt)
|
||||
# same with action:
|
||||
cnt = self._getLoggedReadCount(r'action\.d/iptables-common\.conf')
|
||||
cnt = self._getLoggedReadCount(r'action\.d/iptables\.conf')
|
||||
self.assertTrue(cnt == 1, "Unexpected count by reading of action files, cnt = %s" % cnt)
|
||||
finally:
|
||||
configparserinc.logLevel = saved_ll
|
||||
|
|
|
|||
|
|
@ -1511,10 +1511,10 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
|||
"`ip6tables -w -X f2b-j-w-iptables-mp`",
|
||||
),
|
||||
'ip4-check': (
|
||||
r"""`iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-mp[ \t]'`""",
|
||||
r"""`iptables -w -C INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`""",
|
||||
),
|
||||
'ip6-check': (
|
||||
r"""`ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-mp[ \t]'`""",
|
||||
r"""`ip6tables -w -C INPUT -p tcp -m multiport --dports http,https -j f2b-j-w-iptables-mp`""",
|
||||
),
|
||||
'ip4-ban': (
|
||||
r"`iptables -w -I f2b-j-w-iptables-mp 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`",
|
||||
|
|
@ -1555,10 +1555,10 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
|||
"`ip6tables -w -X f2b-j-w-iptables-ap`",
|
||||
),
|
||||
'ip4-check': (
|
||||
r"""`iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-ap[ \t]'`""",
|
||||
r"""`iptables -w -C INPUT -p tcp -j f2b-j-w-iptables-ap`""",
|
||||
),
|
||||
'ip6-check': (
|
||||
r"""`ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-ap[ \t]'`""",
|
||||
r"""`ip6tables -w -C INPUT -p tcp -j f2b-j-w-iptables-ap`""",
|
||||
),
|
||||
'ip4-ban': (
|
||||
r"`iptables -w -I f2b-j-w-iptables-ap 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`",
|
||||
|
|
@ -1645,7 +1645,7 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
|||
r"`ipset del f2b-j-w-iptables-ipset-ap6 2001:db8:: -exist`",
|
||||
),
|
||||
}),
|
||||
# iptables --
|
||||
# iptables (oneport) --
|
||||
('j-w-iptables', 'iptables[name=%(__name__)s, bantime="10m", port="http", protocol="tcp", chain="<known/chain>"]', {
|
||||
'ip4': ('`iptables ', 'icmp-port-unreachable'), 'ip6': ('`ip6tables ', 'icmp6-port-unreachable'),
|
||||
'ip4-start': (
|
||||
|
|
@ -1671,10 +1671,10 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
|||
"`ip6tables -w -X f2b-j-w-iptables`",
|
||||
),
|
||||
'ip4-check': (
|
||||
r"""`iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables[ \t]'`""",
|
||||
r"""`iptables -w -C INPUT -p tcp --dport http -j f2b-j-w-iptables`""",
|
||||
),
|
||||
'ip6-check': (
|
||||
r"""`ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables[ \t]'`""",
|
||||
r"""`ip6tables -w -C INPUT -p tcp --dport http -j f2b-j-w-iptables`""",
|
||||
),
|
||||
'ip4-ban': (
|
||||
r"`iptables -w -I f2b-j-w-iptables 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`",
|
||||
|
|
@ -1715,10 +1715,10 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
|||
"`ip6tables -w -X f2b-j-w-iptables-new`",
|
||||
),
|
||||
'ip4-check': (
|
||||
r"""`iptables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-new[ \t]'`""",
|
||||
r"""`iptables -w -C INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`""",
|
||||
),
|
||||
'ip6-check': (
|
||||
r"""`ip6tables -w -n -L INPUT | grep -q 'f2b-j-w-iptables-new[ \t]'`""",
|
||||
r"""`ip6tables -w -C INPUT -m state --state NEW -p tcp --dport http -j f2b-j-w-iptables-new`""",
|
||||
),
|
||||
'ip4-ban': (
|
||||
r"`iptables -w -I f2b-j-w-iptables-new 1 -s 192.0.2.1 -j REJECT --reject-with icmp-port-unreachable`",
|
||||
|
|
@ -1749,10 +1749,10 @@ class ServerConfigReaderTests(LogCaptureTestCase):
|
|||
"`if [ `id -u` -eq 0 ];then ip6tables -w -D INPUT -m recent --update --seconds 3600 --name f2b-j-w-iptables-xtre6 -j REJECT --reject-with icmp6-port-unreachable;fi`",
|
||||
),
|
||||
'ip4-check': (
|
||||
r"`test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre`",
|
||||
r"`{ iptables -w -C INPUT -p tcp --dport ssh -j f2b-j-w-iptables-xtre; } && test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre`",
|
||||
),
|
||||
'ip6-check': (
|
||||
r"`test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre6`",
|
||||
r"`{ ip6tables -w -C INPUT -p tcp --dport ssh -j f2b-j-w-iptables-xtre; } && test -e /proc/net/xt_recent/f2b-j-w-iptables-xtre6`",
|
||||
),
|
||||
'ip4-ban': (
|
||||
r"`echo +192.0.2.1 > /proc/net/xt_recent/f2b-j-w-iptables-xtre`",
|
||||
|
|
|
|||
Loading…
Reference in New Issue