mirror of https://github.com/fail2ban/fail2ban
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
167 lines
4.5 KiB
167 lines
4.5 KiB
# Fail2Ban configuration file |
|
# |
|
# Author: Cyril Jaquier |
|
# |
|
# $Revision$ |
|
# |
|
|
|
# The DEFAULT allows a global definition of the options. They can be override |
|
# in each jail afterwards. |
|
|
|
[DEFAULT] |
|
|
|
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not |
|
# ban a host which matches an address in this list. Several addresses can be |
|
# defined using space separator. |
|
ignoreip = 127.0.0.1 |
|
|
|
# "bantime" is the number of seconds that a host is banned. |
|
bantime = 600 |
|
|
|
# A host is banned if it has generated "maxretry" during the last "findtime" |
|
# seconds. |
|
findtime = 600 |
|
|
|
# "maxretry" is the number of failures before a host get banned. |
|
maxretry = 3 |
|
|
|
# "backend" specifies the backend used to get files modification. Available |
|
# options are "gamin", "polling" and "auto". This option can be overridden in |
|
# each jail too (use "gamin" for a jail and "polling" for another). |
|
# |
|
# gamin: requires Gamin (a file alteration monitor) to be installed. If Gamin |
|
# is not installed, Fail2ban will use polling. |
|
# polling: uses a polling algorithm which does not require external libraries. |
|
# auto: will choose Gamin if available and polling otherwise. |
|
backend = auto |
|
|
|
|
|
# This jail corresponds to the standard configuration in Fail2ban 0.6. |
|
# The mail-whois action send a notification e-mail with a whois request |
|
# in the body. |
|
|
|
[ssh-iptables] |
|
|
|
enabled = false |
|
filter = sshd |
|
action = iptables[name=SSH, port=ssh, protocol=tcp] |
|
mail-whois[name=SSH, dest=yourmail@mail.com] |
|
logpath = /var/log/sshd.log |
|
maxretry = 5 |
|
|
|
[proftpd-iptables] |
|
|
|
enabled = false |
|
filter = proftpd |
|
action = iptables[name=ProFTPD, port=ftp, protocol=tcp] |
|
mail-whois[name=ProFTPD, dest=yourmail@mail.com] |
|
logpath = /var/log/proftpd/proftpd.log |
|
maxretry = 6 |
|
|
|
# This jail forces the backend to "polling". |
|
|
|
[sasl-iptables] |
|
|
|
enabled = false |
|
filter = sasl |
|
backend = polling |
|
action = iptables[name=sasl, port=smtp, protocol=tcp] |
|
mail-whois[name=sasl, dest=yourmail@mail.com] |
|
logpath = /var/log/mail.log |
|
|
|
# Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is |
|
# used to avoid banning the user "myuser". |
|
|
|
[ssh-tcpwrapper] |
|
|
|
enabled = false |
|
filter = sshd |
|
action = hostsdeny |
|
mail-whois[name=SSH, dest=yourmail@mail.com] |
|
ignoreregex = for myuser from |
|
logpath = /var/log/sshd.log |
|
|
|
# This jail demonstrates the use of wildcards in "logpath". |
|
# Moreover, it is possible to give other files on a new line. |
|
|
|
[apache-tcpwrapper] |
|
|
|
enabled = false |
|
filter = apache-auth |
|
action = hostsdeny |
|
logpath = /var/log/apache*/*access.log |
|
/home/www/myhomepage/access.log |
|
maxretry = 6 |
|
|
|
# The hosts.deny path can be defined with the "file" argument if it is |
|
# not in /etc. |
|
|
|
[postfix-tcpwrapper] |
|
|
|
enabled = false |
|
filter = postfix |
|
action = hostsdeny[file=/not/a/standard/path/hosts.deny] |
|
mail[name=Postfix, dest=yourmail@mail.com] |
|
logpath = /var/log/postfix.log |
|
bantime = 300 |
|
|
|
# Do not ban anybody. Just report information about the remote host. |
|
# A notification is sent at most every 600 seconds (bantime). |
|
|
|
[vsftpd-notification] |
|
|
|
enabled = false |
|
filter = vsftpd |
|
action = mail-whois[name=VSFTPD, dest=yourmail@mail.com] |
|
logpath = /var/log/vsftpd.log |
|
maxretry = 5 |
|
bantime = 1800 |
|
|
|
# Same as above but with banning the IP address. |
|
|
|
[vsftpd-iptables] |
|
|
|
enabled = false |
|
filter = vsftpd |
|
action = iptables[name=VSFTPD, port=ftp, protocol=tcp] |
|
mail-whois[name=VSFTPD, dest=yourmail@mail.com] |
|
logpath = /var/log/vsftpd.log |
|
maxretry = 5 |
|
bantime = 1800 |
|
|
|
# Ban hosts which agent identifies spammer robots crawling the web |
|
# for email addresses. The mail outputs are buffered. |
|
|
|
[apache-badbots] |
|
|
|
enabled = false |
|
filter = apache-badbots |
|
action = iptables-multiport[name=BadBots, port="http,https"] |
|
mail-buffered[name=BadBots, lines=5, dest=yourmail@mail.com] |
|
logpath = /var/www/*/logs/access_log |
|
bantime = 172800 |
|
maxretry = 1 |
|
|
|
# Use shorewall instead of iptables. |
|
|
|
[apache-shorewall] |
|
|
|
enabled = false |
|
filter = apache-noscript |
|
action = shorewall |
|
mail[name=Postfix, dest=yourmail@mail.com] |
|
logpath = /var/log/apache2/error_log |
|
|
|
# This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip" |
|
# option is overridden in this jail. Moreover, the action "mail-whois" defines |
|
# the variable "name" which contains a comma using "". The characters '' are |
|
# valid too. |
|
|
|
[ssh-ipfw] |
|
|
|
enabled = false |
|
filter = sshd |
|
action = ipfw[localhost=192.168.0.1] |
|
mail-whois[name="SSH,IPFW", dest=yourmail@mail.com] |
|
logpath = /var/log/auth.log |
|
ignoreip = 168.192.0.1
|
|
|