From: mhoellein Date: Tue, 24 Sep 2019 09:25:48 +0000 (+0200) Subject: committing changes in /etc after apt run X-Git-Url: https://git.hoellein.online/?a=commitdiff_plain;h=ef38ecec83a68e3bb0805e4991ef58d98b008605;p=homeserver committing changes in /etc after apt run Package changes: +fail2ban 0.10.2-2 all --- diff --git a/.etckeeper b/.etckeeper index 529c3f5c..498ab7f3 100755 --- a/.etckeeper +++ b/.etckeeper @@ -22,7 +22,6 @@ mkdir -p './davfs2/certs/private' mkdir -p './dbus-1/session.d' mkdir -p './dhcp/ddns-keys' mkdir -p './fail2ban/fail2ban.d' -mkdir -p './fail2ban/jail.d' mkdir -p './glvnd/egl_vendor.d' mkdir -p './guest-session' mkdir -p './icinga/modules' @@ -44,6 +43,7 @@ mkdir -p './letsencrypt/renewal-hooks/deploy' mkdir -p './letsencrypt/renewal-hooks/post' mkdir -p './letsencrypt/renewal-hooks/pre' mkdir -p './libpaper.d' +mkdir -p './monit/conf-available' mkdir -p './mono/certstore' mkdir -p './mysql/mariadb.conf.d' mkdir -p './netplan' @@ -1152,6 +1152,7 @@ maybe chmod 0644 'bash_completion.d/axi-cache' maybe chmod 0644 'bash_completion.d/desktop-file-validate' maybe chmod 0644 'bash_completion.d/dkms' maybe chmod 0644 'bash_completion.d/docker' +maybe chmod 0644 'bash_completion.d/fail2ban' maybe chmod 0644 'bash_completion.d/gem1.9.1' maybe chmod 0644 'bash_completion.d/git-prompt' maybe chmod 0644 'bash_completion.d/grub' @@ -2157,6 +2158,7 @@ maybe chmod 0644 'default/devolo-updates' maybe chmod 0644 'default/devpts' maybe chmod 0644 'default/docker' maybe chmod 0644 'default/dovecot' +maybe chmod 0644 'default/fail2ban' maybe chmod 0644 'default/fetchmail' maybe chmod 0644 'default/grub' maybe chmod 0755 'default/grub.d' @@ -2371,6 +2373,7 @@ maybe chmod 0755 'etckeeper/vcs.d' maybe chmod 0755 'etckeeper/vcs.d/50vcs-cmd' maybe chmod 0755 'fail2ban' maybe chmod 0755 'fail2ban/action.d' +maybe chmod 0644 'fail2ban/action.d/abuseipdb.conf' maybe chmod 0664 'fail2ban/action.d/apf.conf' maybe chmod 0664 'fail2ban/action.d/badips.conf' maybe chmod 0664 'fail2ban/action.d/badips.py' @@ -2381,9 +2384,13 @@ maybe chmod 0664 'fail2ban/action.d/complain.conf' maybe chmod 0664 'fail2ban/action.d/dshield.conf' maybe chmod 0664 'fail2ban/action.d/dummy.conf' maybe chmod 0664 'fail2ban/action.d/firewallcmd-allports.conf' +maybe chmod 0644 'fail2ban/action.d/firewallcmd-common.conf' maybe chmod 0664 'fail2ban/action.d/firewallcmd-ipset.conf' maybe chmod 0664 'fail2ban/action.d/firewallcmd-multiport.conf' maybe chmod 0664 'fail2ban/action.d/firewallcmd-new.conf' +maybe chmod 0644 'fail2ban/action.d/firewallcmd-rich-logging.conf' +maybe chmod 0644 'fail2ban/action.d/firewallcmd-rich-rules.conf' +maybe chmod 0644 'fail2ban/action.d/helpers-common.conf' maybe chmod 0664 'fail2ban/action.d/hostsdeny.conf' maybe chmod 0664 'fail2ban/action.d/ipfilter.conf' maybe chmod 0664 'fail2ban/action.d/ipfw.conf' @@ -2403,9 +2410,12 @@ maybe chmod 0664 'fail2ban/action.d/mail-whois-lines.conf' maybe chmod 0664 'fail2ban/action.d/mail-whois.conf' maybe chmod 0664 'fail2ban/action.d/mail.conf' maybe chmod 0664 'fail2ban/action.d/mynetwatchman.conf' +maybe chmod 0644 'fail2ban/action.d/netscaler.conf' maybe chmod 0664 'fail2ban/action.d/nftables-allports.conf' maybe chmod 0664 'fail2ban/action.d/nftables-common.conf' maybe chmod 0664 'fail2ban/action.d/nftables-multiport.conf' +maybe chmod 0644 'fail2ban/action.d/nginx-block-map.conf' +maybe chmod 0644 'fail2ban/action.d/npf.conf' maybe chmod 0664 'fail2ban/action.d/nsupdate.conf' maybe chmod 0664 'fail2ban/action.d/osx-afctl.conf' maybe chmod 0664 'fail2ban/action.d/osx-ipfw.conf' @@ -2450,6 +2460,7 @@ maybe chmod 0664 'fail2ban/filter.d/courier-auth.conf' maybe chmod 0664 'fail2ban/filter.d/courier-smtp.conf' maybe chmod 0664 'fail2ban/filter.d/cyrus-imap.conf' maybe chmod 0664 'fail2ban/filter.d/directadmin.conf' +maybe chmod 0644 'fail2ban/filter.d/domino-smtp.conf' maybe chmod 0664 'fail2ban/filter.d/dovecot.conf' maybe chmod 0664 'fail2ban/filter.d/dropbear.conf' maybe chmod 0664 'fail2ban/filter.d/drupal-auth.conf' @@ -2468,6 +2479,7 @@ maybe chmod 0755 'fail2ban/filter.d/ignorecommands' maybe chmod 0775 'fail2ban/filter.d/ignorecommands/apache-fakegooglebot' maybe chmod 0664 'fail2ban/filter.d/kerio.conf' maybe chmod 0664 'fail2ban/filter.d/lighttpd-auth.conf' +maybe chmod 0644 'fail2ban/filter.d/mongodb-auth.conf' maybe chmod 0664 'fail2ban/filter.d/monit.conf' maybe chmod 0664 'fail2ban/filter.d/murmur.conf' maybe chmod 0664 'fail2ban/filter.d/mysqld-auth.conf' @@ -2484,6 +2496,7 @@ maybe chmod 0664 'fail2ban/filter.d/oracleims.conf' maybe chmod 0664 'fail2ban/filter.d/pam-generic.conf' maybe chmod 0664 'fail2ban/filter.d/perdition.conf' maybe chmod 0664 'fail2ban/filter.d/php-url-fopen.conf' +maybe chmod 0644 'fail2ban/filter.d/phpmyadmin-syslog.conf' maybe chmod 0664 'fail2ban/filter.d/portsentry.conf' maybe chmod 0664 'fail2ban/filter.d/postfix-rbl.conf' maybe chmod 0664 'fail2ban/filter.d/postfix-sasl.conf' @@ -2499,6 +2512,7 @@ maybe chmod 0664 'fail2ban/filter.d/selinux-ssh.conf' maybe chmod 0664 'fail2ban/filter.d/sendmail-auth.conf' maybe chmod 0664 'fail2ban/filter.d/sendmail-reject.conf' maybe chmod 0664 'fail2ban/filter.d/sieve.conf' +maybe chmod 0644 'fail2ban/filter.d/slapd.conf' maybe chmod 0664 'fail2ban/filter.d/sogo-auth.conf' maybe chmod 0664 'fail2ban/filter.d/solid-pop3d.conf' maybe chmod 0664 'fail2ban/filter.d/squid.conf' @@ -2513,9 +2527,12 @@ maybe chmod 0664 'fail2ban/filter.d/vsftpd.conf' maybe chmod 0664 'fail2ban/filter.d/webmin-auth.conf' maybe chmod 0664 'fail2ban/filter.d/wuftpd.conf' maybe chmod 0664 'fail2ban/filter.d/xinetd-fail.conf' +maybe chmod 0644 'fail2ban/filter.d/zoneminder.conf' maybe chmod 0664 'fail2ban/jail.conf' maybe chmod 0755 'fail2ban/jail.d' +maybe chmod 0644 'fail2ban/jail.d/defaults-debian.conf' maybe chmod 0644 'fail2ban/jail.local' +maybe chmod 0644 'fail2ban/paths-arch.conf' maybe chmod 0664 'fail2ban/paths-common.conf' maybe chmod 0664 'fail2ban/paths-debian.conf' maybe chmod 0664 'fail2ban/paths-fedora.conf' @@ -5903,6 +5920,7 @@ maybe chmod 0644 'logrotate.d/consolekit' maybe chmod 0644 'logrotate.d/cups-daemon' maybe chmod 0644 'logrotate.d/dbconfig-common' maybe chmod 0644 'logrotate.d/dpkg' +maybe chmod 0644 'logrotate.d/fail2ban' maybe chmod 0644 'logrotate.d/homematic' maybe chmod 0644 'logrotate.d/iptraf' maybe chmod 0644 'logrotate.d/iptraf-ng' @@ -5987,6 +6005,10 @@ maybe chmod 0644 'modprobe.d/vmwgfx-fbdev.conf' maybe chmod 0644 'modules' maybe chmod 0755 'modules-load.d' maybe chmod 0644 'modules-load.d/cups-filters.conf' +maybe chmod 0755 'monit' +maybe chmod 0755 'monit/conf-available' +maybe chmod 0755 'monit/monitrc.d' +maybe chmod 0644 'monit/monitrc.d/fail2ban' maybe chmod 0755 'mono' maybe chmod 0755 'mono/2.0' maybe chmod 0755 'mono/2.0/Browsers' diff --git a/bash_completion.d/fail2ban b/bash_completion.d/fail2ban new file mode 100644 index 00000000..b8887001 --- /dev/null +++ b/bash_completion.d/fail2ban @@ -0,0 +1,182 @@ +# fail2ban bash-completion -*- shell-script -*- +# +# This file is part of Fail2Ban. +# +# Fail2Ban is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Fail2Ban is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Fail2Ban; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + +__fail2ban_jails () { + "$1" status 2>/dev/null | awk -F"\t+" '/Jail list/{print $2}' | sed 's/, / /g' +} +__fail2ban_jail_actions () { + "$1" get "$2" actions 2>/dev/null | sed -n '$s/\([^,]\+\),\?/\1/gp' +} +__fail2ban_jail_action_properties () { + "$1" get "$2" actionproperties "$3" 2>/dev/null | sed -n '$s/\([^,]\+\),\?/\1/gp' +} +__fail2ban_jail_action_methods () { + "$1" get "$2" actionmethods "$3" 2>/dev/null | sed -n '$s/\([^,]\+\),\?/\1/gp' +} + +_fail2ban () { + local cur prev words cword + _init_completion || return + + case $prev in + -V|--version|-h|--help) + return 0 # No further completion valid + ;; + -c) + _filedir -d # Directories + return 0 + ;; + -s|-p) + _filedir # Files + return 0 + ;; + *) + if [[ "$cur" == "-"* ]];then + COMPREPLY=( $( compgen -W \ + "$( _parse_help "$1" --help 2>/dev/null) -V" \ + -- "$cur") ) + return 0 + fi + ;; + esac + + if [[ "$1" == *"fail2ban-regex" ]];then + _filedir + return 0 + elif [[ "$1" == *"fail2ban-client" ]];then + local cmd jail action + case $prev in + "$1") + COMPREPLY=( $( compgen -W \ + "$( "$1" --help 2>/dev/null | awk '/^ [a-z]+/{print $1}')" \ + -- "$cur") ) + return 0 + ;; + start|reload|stop|status) + COMPREPLY=( $(compgen -W "$(__fail2ban_jails "$1")" -- "$cur" ) ) + return 0 + ;; + set|get) + COMPREPLY=( $( compgen -W \ + "$( "$1" --help 2>/dev/null | awk '/^ '$prev' [^<]/{print $2}')" \ + -- "$cur") ) + COMPREPLY+=( $(compgen -W "$(__fail2ban_jails "$1")" -- "$cur" ) ) + return 0 + ;; + *) + if [[ "${words[$cword-2]}" == "add" ]];then + COMPREPLY=( $( compgen -W "auto polling gamin pyinotify systemd" -- "$cur" ) ) + return 0 + elif [[ "${words[$cword-2]}" == "set" || "${words[$cword-2]}" == "get" ]];then + cmd="${words[cword-2]}" + # Handle in section below + elif [[ "${words[$cword-3]}" == "set" || "${words[$cword-3]}" == "get" ]];then + cmd="${words[$cword-3]}" + jail="${words[$cword-2]}" + # Handle in section below + elif [[ "${words[$cword-4]}" == "set" || "${words[$cword-4]}" == "get" && ${words[$cword-2]} == action* ]];then + cmd="${words[$cword-4]}" + jail="${words[$cword-3]}" + action="${words[$cword-1]}" + # Handle in section below + fi + ;; + esac + + if [[ -z "$jail" && -n "$cmd" ]];then + case $prev in + loglevel) + if [[ "$cmd" == "set" ]];then + COMPREPLY=( $( compgen -W "CRITICAL ERROR WARNING NOTICE INFO DEBUG" -- "$cur" ) ) + fi + return 0 + ;; + logtarget) + if [[ "$cmd" == "set" ]];then + COMPREPLY=( $( compgen -W "STDOUT STDERR SYSLOG SYSOUT" -- "$cur" ) ) + _filedir # And files + fi + return 0 + ;; + *) # Jail name + COMPREPLY=( $( compgen -W \ + "$( "$1" --help 2>/dev/null | awk '/^ '${cmd}' /{print $3}')" \ + -- "$cur") ) + return 0 + ;; + esac + elif [[ -n "$jail" && -n "$action" ]];then + case ${words[$cwords-3]} in + action) + COMPREPLY=( $( compgen -W \ + "$( __fail2ban_jail_action_properties "$1" "$jail" "$action")" \ + -- "$cur" ) ) + if [[ "$cmd" == "set" ]];then + COMPREPLY+=( $(compgen -W "$(__fail2ban_jail_action_methods "$1" "$jail" "$action")" -- "$cur" ) ) + fi + return 0 + ;; + esac + elif [[ -n "$jail" && $prev == action* ]];then + case $prev in + action|actionproperties|actionmethods) + COMPREPLY=( $(compgen -W "$(__fail2ban_jail_actions "$1" "$jail")" -- "$cur" ) ) + return 0 + ;; + esac + elif [[ -n "$jail" && "$cmd" == "set" ]];then + case $prev in + addlogpath) + _filedir + return 0 + ;; + dellogpath|delignoreip) + COMPREPLY=( $( compgen -W \ + "$( "$1" get "$jail" "${prev/del/}" 2>/dev/null | awk -F- '{print $2}')" \ + -- "$cur" ) ) + if [[ -z "$COMPREPLY" && "$prev" == "dellogpath" ]];then + _filedir + fi + return 0 + ;; + delfailregex|delignoreregex) + COMPREPLY=( $( compgen -W \ + "$( "$1" get "$jail" "${prev/del/}" 2>/dev/null | awk -F"[][]" '{print $2}')" \ + -- "$cur" ) ) + return 0 + ;; + unbanip) + COMPREPLY=( $( compgen -W \ + "$( "$1" status "$jail" 2>/dev/null | awk -F"\t+" '/IP list:/{print $2}')" \ + -- "$cur" ) ) + return 0 + ;; + idle) + COMPREPLY=( $( compgen -W "on off" -- "$cur" ) ) + return 0 + ;; + usedns) + COMPREPLY=( $( compgen -W "yes no warn" -- "$cur" ) ) + return 0 + ;; + esac + fi + + fi # fail2ban-client +} && +complete -F _fail2ban fail2ban-client fail2ban-server fail2ban-regex diff --git a/default/fail2ban b/default/fail2ban new file mode 100644 index 00000000..35bb3771 --- /dev/null +++ b/default/fail2ban @@ -0,0 +1,39 @@ +# This file is part of Fail2Ban. +# +# Fail2Ban is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Fail2Ban is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Fail2Ban; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# +# Author: Cyril Jaquier +# +# $Revision$ + +# Command line options for Fail2Ban. Refer to "fail2ban-client -h" for +# valid options. +FAIL2BAN_OPTS="" + +# Run fail2ban as a different user. If not set, fail2ban +# will run as root. +# +# The user is not created automatically. +# The user can be created e.g. with +# useradd --system --no-create-home --home-dir / --groups adm fail2ban +# Log files are readable by group adm by default. Adding the fail2ban +# user to this group allows it to read the logfiles. +# +# Another manual step that needs to be taken is to allow write access +# for fail2ban user to fail2ban log files. The /etc/init.d/fail2ban +# script will change the ownership when starting fail2ban. Logrotate +# needs to be configured separately, see /etc/logrotate.d/fail2ban. +# +# FAIL2BAN_USER="fail2ban" diff --git a/fail2ban/action.d/abuseipdb.conf b/fail2ban/action.d/abuseipdb.conf new file mode 100644 index 00000000..15e41fbe --- /dev/null +++ b/fail2ban/action.d/abuseipdb.conf @@ -0,0 +1,105 @@ +# Fail2ban configuration file +# +# Action to report IP address to abuseipdb.com +# You must sign up to obtain an API key from abuseipdb.com. +# +# NOTE: These reports may include sensitive Info. +# If you want cleaner reports that ensure no user data see the helper script at the below website. +# +# IMPORTANT: +# +# Reporting an IP of abuse is a serious complaint. Make sure that it is +# serious. Fail2ban developers and network owners recommend you only use this +# action for: +# * The recidive where the IP has been banned multiple times +# * Where maxretry has been set quite high, beyond the normal user typing +# password incorrectly. +# * For filters that have a low likelihood of receiving human errors +# +# This action relies on a api_key being added to the above action conf, +# and the appropriate categories set. +# +# Example, for ssh bruteforce (in section [sshd] of `jail.local`): +# action = %(known/action)s +# %(action_abuseipdb)s[abuseipdb_apikey="my-api-key", abuseipdb_category="18,22"] +# +# See below for catagories. +# +# Original Ref: https://wiki.shaunc.com/wikka.php?wakka=ReportingToAbuseIPDBWithFail2Ban +# Added to fail2ban by Andrew James Collett (ajcollett) + +## abuseIPDB Catagories, `the abuseipdb_category` MUST be set in the jail.conf action call. +# Example, for ssh bruteforce: action = %(action_abuseipdb)s[abuseipdb_category="18,22"] +# ID Title Description +# 3 Fraud Orders +# 4 DDoS Attack +# 9 Open Proxy +# 10 Web Spam +# 11 Email Spam +# 14 Port Scan +# 18 Brute-Force +# 19 Bad Web Bot +# 20 Exploited Host +# 21 Web App Attack +# 22 SSH Secure Shell (SSH) abuse. Use this category in combination with more specific categories. +# 23 IoT Targeted +# See https://abuseipdb.com/categories for more descriptions + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# +# ** IMPORTANT! ** +# +# By default, this posts directly to AbuseIPDB's API, unfortunately +# this results in a lot of backslashes/escapes appearing in the +# reports. This also may include info like your hostname. +# If you have your own web server with PHP available, you can +# use my (Shaun's) helper PHP script by commenting out the first #actionban +# line below, uncommenting the second one, and pointing the URL at +# wherever you install the helper script. For the PHP helper script, see +# +# +# --ciphers ecdhe_ecdsa_aes_256_sha is used to workaround a +# "NSS error -12286" from curl as it attempts to connect using +# SSLv3. See https://www.centos.org/forums/viewtopic.php?t=52732 +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = curl --fail --ciphers ecdhe_ecdsa_aes_256_sha --data 'key=' --data-urlencode 'comment=' --data 'ip=' --data 'category=' "https://www.abuseipdb.com/report/json" + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = + +[Init] +# Option: abuseipdb_apikey +# Notes Your API key from abuseipdb.com +# Values: STRING Default: None +# Register for abuseipdb [https://www.abuseipdb.com], get api key and set below. +# You will need to set the catagory in the action call. +abuseipdb_apikey = diff --git a/fail2ban/action.d/badips.py b/fail2ban/action.d/badips.py index 025289ca..473fbf33 100644 --- a/fail2ban/action.d/badips.py +++ b/fail2ban/action.d/badips.py @@ -34,7 +34,7 @@ else: from fail2ban.server.actions import ActionBase -class BadIPsAction(ActionBase): +class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable """Fail2Ban action which reports bans to badips.com, and also blacklist bad IPs listed on badips.com by using another action's ban method. @@ -80,14 +80,17 @@ class BadIPsAction(ActionBase): If invalid `category`, `score`, `banaction` or `updateperiod`. """ + TIMEOUT = 10 _badips = "http://www.badips.com" def _Request(self, url, **argv): return Request(url, headers={'User-Agent': self.agent}, **argv) def __init__(self, jail, name, category, score=3, age="24h", key=None, - banaction=None, bancategory=None, bankey=None, updateperiod=900, agent="Fail2Ban"): + banaction=None, bancategory=None, bankey=None, updateperiod=900, agent="Fail2Ban", + timeout=TIMEOUT): super(BadIPsAction, self).__init__(jail, name) + self.timeout = timeout self.agent = agent self.category = category self.score = score @@ -102,6 +105,16 @@ class BadIPsAction(ActionBase): # Used later for threading.Timer for updating badips self._timer = None + @staticmethod + def isAvailable(timeout=1): + try: + response = urlopen(Request("/".join([BadIPsAction._badips]), + headers={'User-Agent': "Fail2Ban"}), timeout=timeout) + return True, '' + except Exception as e: # pragma: no cover + return False, e + + def getCategories(self, incParents=False): """Get badips.com categories. @@ -119,7 +132,7 @@ class BadIPsAction(ActionBase): """ try: response = urlopen( - self._Request("/".join([self._badips, "get", "categories"])), None, 3) + self._Request("/".join([self._badips, "get", "categories"])), timeout=self.timeout) except HTTPError as response: messages = json.loads(response.read().decode('utf-8')) self._logSys.error( @@ -173,7 +186,7 @@ class BadIPsAction(ActionBase): urlencode({'age': age})]) if key: url = "&".join([url, urlencode({'key': key})]) - response = urlopen(self._Request(url)) + response = urlopen(self._Request(url), timeout=self.timeout) except HTTPError as response: messages = json.loads(response.read().decode('utf-8')) self._logSys.error( @@ -358,7 +371,7 @@ class BadIPsAction(ActionBase): url = "/".join([self._badips, "add", self.category, aInfo['ip']]) if self.key: url = "?".join([url, urlencode({'key': self.key})]) - response = urlopen(self._Request(url)) + response = urlopen(self._Request(url), timeout=self.timeout) except HTTPError as response: messages = json.loads(response.read().decode('utf-8')) self._logSys.error( diff --git a/fail2ban/action.d/bsd-ipfw.conf b/fail2ban/action.d/bsd-ipfw.conf index 8b0a51aa..cbd6a15d 100644 --- a/fail2ban/action.d/bsd-ipfw.conf +++ b/fail2ban/action.d/bsd-ipfw.conf @@ -14,7 +14,7 @@ # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = ipfw show | fgrep -q 'table()' || ( ipfw show | awk 'BEGIN { b = 1 } { if ($1 <= b) { b = $1 + 1 } else { e = b } } END { if (e) exit e
else exit b }'; num=$?; ipfw -q add $num from table\(
\) to me ; echo $num > "" ) +actionstart = ipfw show | fgrep -c -m 1 -s 'table(
)' > /dev/null 2>&1 || ( ipfw show | awk 'BEGIN { b = } { if ($1 < b) {} else if ($1 == b) { b = $1 + 1 } else { e = b } } END { if (e) exit e
else exit b }'; num=$?; ipfw -q add $num from table\(
\) to me ; echo $num > "" ) # Option: actionstop @@ -81,3 +81,11 @@ block = ip # Values: STRING # blocktype = unreach port + +# Option: lowest_rule_num +# Notes: When fail2ban starts with action and there is no rule for the given table yet +# then fail2ban will start looking for an empty slot starting with this rule number. +# Values: NUM +lowest_rule_num = 111 + + diff --git a/fail2ban/action.d/cloudflare.conf b/fail2ban/action.d/cloudflare.conf index aa87163c..89df5b9e 100644 --- a/fail2ban/action.d/cloudflare.conf +++ b/fail2ban/action.d/cloudflare.conf @@ -40,7 +40,12 @@ actioncheck = #