github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Updated How to ban something other as host (IP address), like user or mail, etc. (markdown)

master
Sergey G. Brester 2018-02-01 20:26:06 +01:00
parent 66809c0552
commit b77a6f8e3b
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
How-to-ban-something-other-as-host-(IP-address),-like-user-or-mail,-etc..md

@ -48,6 +48,10 @@ Action config file `action.d/test-ban-user.local`:
actionstart = actionstart =
actionstop = actionstop =
actioncheck = actioncheck =
# v. 0.10:
actionban = echo 'ban f2b-<name> --user "<fid>"'
actionunban = echo 'unban f2b-<name> --user "<fid>"'
# v. 0.9:
actionban = echo 'ban f2b-<name> --user <ip>' actionban = echo 'ban f2b-<name> --user <ip>'
actionunban = echo 'unban f2b-<name> --user <ip>' actionunban = echo 'unban f2b-<name> --user <ip>'
``` ```
@ -89,7 +93,7 @@ failregex = ^<F-ID>DDOS</F-ID> attack detected$
* set small `bantime` (e. g. 1 second) to this "jail" (otherwise no "ban" action will be executed in this time, because "already banned" occurs), e. g. `bantime = 1` * set small `bantime` (e. g. 1 second) to this "jail" (otherwise no "ban" action will be executed in this time, because "already banned" occurs), e. g. `bantime = 1`
* you need to specify only `actionban` parameter in your custom action file: * you need to specify only `actionban` parameter in your custom action file:
```INI ```INI
actionban = /user/bin/ids-attack.sh '<fid>' actionban = /user/bin/ids-attack.sh "<fid>"
``` ```
* `actionban` script will be executed as root (or with user, fail2ban running), so use `su` if other/restricted user needed; * `actionban` script will be executed as root (or with user, fail2ban running), so use `su` if other/restricted user needed;
- set `usedns`, `ignoreip`, `ignorecommand` as suggested above, otherwise you can get error by comparison with empty/illegal host (that will be found by "failure"); - set `usedns`, `ignoreip`, `ignorecommand` as suggested above, otherwise you can get error by comparison with empty/illegal host (that will be found by "failure");