API tools faq
paste
Guest User

Untitled

a guest
Nov 20th, 2017
134
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 18.88 KB | None | 0 0
raw download clone embed print report
  1. root@localhost:~# fail2ban-client status
  2. Status
  3. |- Number of jail: 2
  4. `- Jail list: nginx-proxy, sshd
  5. root@localhost:~# fail2ban-client status nginx-proxy
  6. Status for the jail: nginx-proxy
  7. |- Filter
  8. | |- Currently failed: 1
  9. | |- Total failed: 2
  10. | `- File list: /var/log/nginx/access.log
  11. `- Actions
  12. |- Currently banned: 1
  13. |- Total banned: 1
  14. `- Banned IP list: 77.72.83.110
  15. root@localhost:~# fail2ban-client status sshd
  16. Status for the jail: sshd
  17. |- Filter
  18. | |- Currently failed: 2
  19. | |- Total failed: 837
  20. | `- File list: /var/log/auth.log
  21. `- Actions
  22. |- Currently banned: 0
  23. |- Total banned: 127
  24. `- Banned IP list:
  25. root@localhost:~#
  26.  
  27. #
  28. # WARNING: heavily refactored in 0.9.0 release. Please review and
  29. # customize settings for your setup.
  30. #
  31. # Changes: in most of the cases you should not modify this
  32. # file, but provide customizations in jail.local file,
  33. # or separate .conf files under jail.d/ directory, e.g.:
  34. #
  35. # HOW TO ACTIVATE JAILS:
  36. #
  37. # YOU SHOULD NOT MODIFY THIS FILE.
  38. #
  39. # It will probably be overwritten or improved in a distribution update.
  40. #
  41. # Provide customizations in a jail.local file or a jail.d/customisation.local.
  42. # For example to change the default bantime for all jails and to enable the
  43. # ssh-iptables jail the following (uncommented) would appear in the .local file.
  44. # See man 5 jail.conf for details.
  45. #
  46. # [DEFAULT]
  47. # bantime = 3600
  48. #
  49. # [sshd]
  50. # enabled = true
  51. #
  52. # See jail.conf(5) man page for more information
  53.  
  54.  
  55.  
  56. # Comments: use '#' for comment lines and ';' (following a space) for inline comments
  57.  
  58.  
  59. [INCLUDES]
  60.  
  61. #before = paths-distro.conf
  62. before = paths-debian.conf
  63.  
  64. # The DEFAULT allows a global definition of the options. They can be overridden
  65. # in each jail afterwards.
  66.  
  67. [DEFAULT]
  68.  
  69. #
  70. # MISCELLANEOUS OPTIONS
  71. #
  72.  
  73. # "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
  74. # ban a host which matches an address in this list. Several addresses can be
  75. # defined using space separator.
  76. ignoreip = 127.0.0.1/8 41.223.117.72 197.220.29.172 164.160.12.30 164.160.12.29 164.160.12.31
  77.  
  78. # External command that will take an tagged arguments to ignore, e.g. <ip>,
  79. # and return true if the IP is to be ignored. False otherwise.
  80. #
  81. # ignorecommand = /path/to/command <ip>
  82. ignorecommand =
  83.  
  84. # "bantime" is the number of seconds that a host is banned.
  85. bantime = 600
  86.  
  87. # A host is banned if it has generated "maxretry" during the last "findtime"
  88. # seconds.
  89. findtime = 600
  90.  
  91. # "maxretry" is the number of failures before a host get banned.
  92. maxretry = 5
  93.  
  94. # "backend" specifies the backend used to get files modification.
  95. # Available options are "pyinotify", "gamin", "polling", "systemd" and "auto".
  96. # This option can be overridden in each jail as well.
  97. #
  98. # pyinotify: requires pyinotify (a file alteration monitor) to be installed.
  99. # If pyinotify is not installed, Fail2ban will use auto.
  100. # gamin: requires Gamin (a file alteration monitor) to be installed.
  101. # If Gamin is not installed, Fail2ban will use auto.
  102. # polling: uses a polling algorithm which does not require external libraries.
  103. # systemd: uses systemd python library to access the systemd journal.
  104. # Specifying "logpath" is not valid for this backend.
  105. # See "journalmatch" in the jails associated filter config
  106. # auto: will try to use the following backends, in order:
  107. # pyinotify, gamin, polling.
  108. #
  109. # Note: if systemd backend is choses as the default but you enable a jail
  110. # for which logs are present only in its own log files, specify some other
  111. # backend for that jail (e.g. polling) and provide empty value for
  112. # journalmatch. See https://github.com/fail2ban/fail2ban/issues/959#issuecomment-74901200
  113. backend = auto
  114.  
  115. # "usedns" specifies if jails should trust hostnames in logs,
  116. # warn when DNS lookups are performed, or ignore all hostnames in logs
  117. #
  118. # yes: if a hostname is encountered, a DNS lookup will be performed.
  119. # warn: if a hostname is encountered, a DNS lookup will be performed,
  120. # but it will be logged as a warning.
  121. # no: if a hostname is encountered, will not be used for banning,
  122. # but it will be logged as info.
  123. usedns = warn
  124.  
  125. # "logencoding" specifies the encoding of the log files handled by the jail
  126. # This is used to decode the lines from the log file.
  127. # Typical examples: "ascii", "utf-8"
  128. #
  129. # auto: will use the system locale setting
  130. logencoding = auto
  131.  
  132. # "enabled" enables the jails.
  133. # By default all jails are disabled, and it should stay this way.
  134. # Enable only relevant to your setup jails in your .local or jail.d/*.conf
  135. #
  136. # true: jail will be enabled and log files will get monitored for changes
  137. # false: jail is not enabled
  138. enabled = false
  139.  
  140.  
  141. # "filter" defines the filter to use by the jail.
  142. # By default jails have names matching their filter name
  143. #
  144. filter = %(__name__)s
  145.  
  146.  
  147. #
  148. # ACTIONS
  149. #
  150.  
  151. # Some options used for actions
  152.  
  153. # Destination email address used solely for the interpolations in
  154. # jail.{conf,local,d/*} configuration files.
  155. destemail = root@localhost
  156.  
  157. # Sender email address used solely for some actions
  158. sender = root@localhost
  159.  
  160. # E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA for the
  161. # mailing. Change mta configuration parameter to mail if you want to
  162. # revert to conventional 'mail'.
  163. mta = sendmail
  164.  
  165. # Default protocol
  166. protocol = tcp
  167.  
  168. # Specify chain where jumps would need to be added in iptables-* actions
  169. chain = INPUT
  170.  
  171. # Ports to be banned
  172. # Usually should be overridden in a particular jail
  173. port = 0:65535
  174.  
  175. #
  176. # Action shortcuts. To be used to define action parameter
  177.  
  178. # Default banning action (e.g. iptables, iptables-new,
  179. # iptables-multiport, shorewall, etc) It is used to define
  180. # action_* variables. Can be overridden globally or per
  181. # section within jail.local file
  182. banaction = iptables-multiport
  183.  
  184. # The simplest action to take: ban only
  185. action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
  186.  
  187. # ban & send an e-mail with whois report to the destemail.
  188. action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
  189. %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]
  190.  
  191. # ban & send an e-mail with whois report and relevant log lines
  192. # to the destemail.
  193. action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
  194. %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
  195.  
  196. # See the IMPORTANT note in action.d/xarf-login-attack for when to use this action
  197. #
  198. # ban & send a xarf e-mail to abuse contact of IP address and include relevant log lines
  199. # to the destemail.
  200. action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
  201. xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]
  202.  
  203. # ban IP on CloudFlare & send an e-mail with whois report and relevant log lines
  204. # to the destemail.
  205. action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
  206. %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
  207.  
  208. # Report block via blocklist.de fail2ban reporting service API
  209. #
  210. # See the IMPORTANT note in action.d/blocklist_de.conf for when to
  211. # use this action. Create a file jail.d/blocklist_de.local containing
  212. # [Init]
  213. # blocklist_de_apikey = {api key from registration]
  214. #
  215. action_blocklist_de = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s"]
  216.  
  217. # Report ban via badips.com, and use as blacklist
  218. #
  219. # See BadIPsAction docstring in config/action.d/badips.py for
  220. # documentation for this action.
  221. #
  222. # NOTE: This action relies on banaction being present on start and therefore
  223. # should be last action defined for a jail.
  224. #
  225. action_badips = badips.py[category="%(name)s", banaction="%(banaction)s"]
  226.  
  227. # Choose default action. To change, just override value of 'action' with the
  228. # interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local
  229. # globally (section [DEFAULT]) or per specific section
  230. action = %(action_)s
  231.  
  232.  
  233. #
  234. # JAILS
  235. #
  236.  
  237. #
  238. # SSH servers
  239. #
  240.  
  241. [sshd]
  242.  
  243. port = ssh
  244. logpath = %(sshd_log)s
  245.  
  246.  
  247. [sshd-ddos]
  248. # This jail corresponds to the standard configuration in Fail2ban.
  249. # The mail-whois action send a notification e-mail with a whois request
  250. # in the body.
  251. port = ssh
  252. logpath = %(sshd_log)s
  253.  
  254.  
  255. [dropbear]
  256.  
  257. port = ssh
  258. logpath = %(dropbear_log)s
  259.  
  260.  
  261. [selinux-ssh]
  262.  
  263. port = ssh
  264. logpath = %(auditd_log)s
  265. maxretry = 5
  266.  
  267.  
  268. #
  269. # HTTP servers
  270. #
  271.  
  272. [apache-auth]
  273.  
  274. port = http,https
  275. logpath = %(apache_error_log)s
  276.  
  277.  
  278. [apache-badbots]
  279. # Ban hosts which agent identifies spammer robots crawling the web
  280. # for email addresses. The mail outputs are buffered.
  281. port = http,https
  282. logpath = %(apache_access_log)s
  283. bantime = 172800
  284. maxretry = 1
  285.  
  286.  
  287. [apache-noscript]
  288.  
  289. port = http,https
  290. logpath = %(apache_error_log)s
  291. maxretry = 6
  292.  
  293.  
  294. [apache-overflows]
  295.  
  296. port = http,https
  297. logpath = %(apache_error_log)s
  298. maxretry = 2
  299.  
  300.  
  301. [apache-nohome]
  302.  
  303. port = http,https
  304. logpath = %(apache_error_log)s
  305. maxretry = 2
  306.  
  307.  
  308. [apache-botsearch]
  309.  
  310. port = http,https
  311. logpath = %(apache_error_log)s
  312. maxretry = 2
  313.  
  314.  
  315. [apache-fakegooglebot]
  316.  
  317. port = http,https
  318. logpath = %(apache_access_log)s
  319. maxretry = 1
  320. ignorecommand = %(ignorecommands_dir)s/apache-fakegooglebot <ip>
  321.  
  322.  
  323. [apache-modsecurity]
  324.  
  325. port = http,https
  326. logpath = %(apache_error_log)s
  327. maxretry = 2
  328.  
  329. [apache-shellshock]
  330.  
  331. port = http,https
  332. logpath = %(apache_error_log)s
  333. maxretry = 1
  334.  
  335. [nginx-http-auth]
  336.  
  337. port = http,https
  338. logpath = %(nginx_error_log)s
  339.  
  340. [nginx-botsearch]
  341.  
  342. port = http,https
  343. logpath = %(nginx_error_log)s
  344. maxretry = 2
  345.  
  346. # Ban attackers that try to use PHP's URL-fopen() functionality
  347. # through GET/POST variables. - Experimental, with more than a year
  348. # of usage in production environments.
  349.  
  350. [php-url-fopen]
  351.  
  352. port = http,https
  353. logpath = %(nginx_access_log)s
  354. %(apache_access_log)s
  355.  
  356.  
  357. [suhosin]
  358.  
  359. port = http,https
  360. logpath = %(suhosin_log)s
  361.  
  362.  
  363. [lighttpd-auth]
  364. # Same as above for Apache's mod_auth
  365. # It catches wrong authentifications
  366. port = http,https
  367. logpath = %(lighttpd_error_log)s
  368.  
  369.  
  370. #
  371. # Webmail and groupware servers
  372. #
  373.  
  374. [roundcube-auth]
  375.  
  376. port = http,https
  377. logpath = logpath = %(roundcube_errors_log)s
  378.  
  379.  
  380. [openwebmail]
  381.  
  382. port = http,https
  383. logpath = /var/log/openwebmail.log
  384.  
  385.  
  386. [horde]
  387.  
  388. port = http,https
  389. logpath = /var/log/horde/horde.log
  390.  
  391.  
  392. [groupoffice]
  393.  
  394. port = http,https
  395. logpath = /home/groupoffice/log/info.log
  396.  
  397.  
  398. [sogo-auth]
  399. # Monitor SOGo groupware server
  400. # without proxy this would be:
  401. # port = 20000
  402. port = http,https
  403. logpath = /var/log/sogo/sogo.log
  404.  
  405.  
  406. [tine20]
  407.  
  408. logpath = /var/log/tine20/tine20.log
  409. port = http,https
  410. maxretry = 5
  411.  
  412.  
  413. #
  414. # Web Applications
  415. #
  416. #
  417.  
  418. [drupal-auth]
  419.  
  420. port = http,https
  421. logpath = %(syslog_daemon)s
  422.  
  423. [guacamole]
  424.  
  425. port = http,https
  426. logpath = /var/log/tomcat*/catalina.out
  427.  
  428. [monit]
  429. #Ban clients brute-forcing the monit gui login
  430. filter = monit
  431. port = 2812
  432. logpath = /var/log/monit
  433.  
  434.  
  435. [webmin-auth]
  436.  
  437. port = 10000
  438. logpath = %(syslog_authpriv)s
  439.  
  440.  
  441. [froxlor-auth]
  442.  
  443. port = http,https
  444. logpath = %(syslog_authpriv)s
  445.  
  446.  
  447. #
  448. # HTTP Proxy servers
  449. #
  450. #
  451.  
  452. [squid]
  453.  
  454. port = 80,443,3128,8080
  455. logpath = /var/log/squid/access.log
  456.  
  457.  
  458. [3proxy]
  459.  
  460. port = 3128
  461. logpath = /var/log/3proxy.log
  462.  
  463.  
  464. #
  465. # FTP servers
  466. #
  467.  
  468.  
  469. [proftpd]
  470.  
  471. port = ftp,ftp-data,ftps,ftps-data
  472. logpath = %(proftpd_log)s
  473.  
  474.  
  475. [pure-ftpd]
  476.  
  477. port = ftp,ftp-data,ftps,ftps-data
  478. logpath = %(pureftpd_log)s
  479. maxretry = 6
  480.  
  481.  
  482. [gssftpd]
  483.  
  484. port = ftp,ftp-data,ftps,ftps-data
  485. logpath = %(syslog_daemon)s
  486. maxretry = 6
  487.  
  488.  
  489. [wuftpd]
  490.  
  491. port = ftp,ftp-data,ftps,ftps-data
  492. logpath = %(wuftpd_log)s
  493. maxretry = 6
  494.  
  495.  
  496. [vsftpd]
  497. # or overwrite it in jails.local to be
  498. # logpath = %(syslog_authpriv)s
  499. # if you want to rely on PAM failed login attempts
  500. # vsftpd's failregex should match both of those formats
  501. port = ftp,ftp-data,ftps,ftps-data
  502. logpath = %(vsftpd_log)s
  503.  
  504.  
  505. #
  506. # Mail servers
  507. #
  508.  
  509. # ASSP SMTP Proxy Jail
  510. [assp]
  511.  
  512. port = smtp,465,submission
  513. logpath = /root/path/to/assp/logs/maillog.txt
  514.  
  515.  
  516. [courier-smtp]
  517.  
  518. port = smtp,465,submission
  519. logpath = %(syslog_mail)s
  520.  
  521.  
  522. [postfix]
  523.  
  524. port = smtp,465,submission
  525. logpath = %(postfix_log)s
  526.  
  527.  
  528. [postfix-rbl]
  529.  
  530. port = smtp,465,submission
  531. logpath = %(syslog_mail)s
  532. maxretry = 1
  533.  
  534.  
  535. [sendmail-auth]
  536.  
  537. port = submission,465,smtp
  538. logpath = %(syslog_mail)s
  539.  
  540.  
  541. [sendmail-reject]
  542.  
  543. port = smtp,465,submission
  544. logpath = %(syslog_mail)s
  545.  
  546.  
  547. [qmail-rbl]
  548.  
  549. filter = qmail
  550. port = smtp,465,submission
  551. logpath = /service/qmail/log/main/current
  552.  
  553.  
  554. # dovecot defaults to logging to the mail syslog facility
  555. # but can be set by syslog_facility in the dovecot configuration.
  556. [dovecot]
  557.  
  558. port = pop3,pop3s,imap,imaps,submission,465,sieve
  559. logpath = %(dovecot_log)s
  560.  
  561.  
  562. [sieve]
  563.  
  564. port = smtp,465,submission
  565. logpath = %(dovecot_log)s
  566.  
  567.  
  568. [solid-pop3d]
  569.  
  570. port = pop3,pop3s
  571. logpath = %(solidpop3d_log)s
  572.  
  573.  
  574. [exim]
  575.  
  576. port = smtp,465,submission
  577. logpath = %(exim_main_log)s
  578.  
  579.  
  580. [exim-spam]
  581.  
  582. port = smtp,465,submission
  583. logpath = %(exim_main_log)s
  584.  
  585.  
  586. [kerio]
  587.  
  588. port = imap,smtp,imaps,465
  589. logpath = /opt/kerio/mailserver/store/logs/security.log
  590.  
  591.  
  592. #
  593. # Mail servers authenticators: might be used for smtp,ftp,imap servers, so
  594. # all relevant ports get banned
  595. #
  596.  
  597. [courier-auth]
  598.  
  599. port = smtp,465,submission,imap3,imaps,pop3,pop3s
  600. logpath = %(syslog_mail)s
  601.  
  602.  
  603. [postfix-sasl]
  604.  
  605. port = smtp,465,submission,imap3,imaps,pop3,pop3s
  606. # You might consider monitoring /var/log/mail.warn instead if you are
  607. # running postfix since it would provide the same log lines at the
  608. # "warn" level but overall at the smaller filesize.
  609. logpath = %(postfix_log)s
  610.  
  611.  
  612. [perdition]
  613.  
  614. port = imap3,imaps,pop3,pop3s
  615. logpath = %(syslog_mail)s
  616.  
  617.  
  618. [squirrelmail]
  619.  
  620. port = smtp,465,submission,imap2,imap3,imaps,pop3,pop3s,http,https,socks
  621. logpath = /var/lib/squirrelmail/prefs/squirrelmail_access_log
  622.  
  623.  
  624. [cyrus-imap]
  625.  
  626. port = imap3,imaps
  627. logpath = %(syslog_mail)s
  628.  
  629.  
  630. [uwimap-auth]
  631.  
  632. port = imap3,imaps
  633. logpath = %(syslog_mail)s
  634.  
  635.  
  636. #
  637. #
  638. # DNS servers
  639. #
  640.  
  641.  
  642. # !!! WARNING !!!
  643. # Since UDP is connection-less protocol, spoofing of IP and imitation
  644. # of illegal actions is way too simple. Thus enabling of this filter
  645. # might provide an easy way for implementing a DoS against a chosen
  646. # victim. See
  647. # http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
  648. # Please DO NOT USE this jail unless you know what you are doing.
  649. #
  650. # IMPORTANT: see filter.d/named-refused for instructions to enable logging
  651. # This jail blocks UDP traffic for DNS requests.
  652. # [named-refused-udp]
  653. #
  654. # filter = named-refused
  655. # port = domain,953
  656. # protocol = udp
  657. # logpath = /var/log/named/security.log
  658.  
  659. # IMPORTANT: see filter.d/named-refused for instructions to enable logging
  660. # This jail blocks TCP traffic for DNS requests.
  661.  
  662. [named-refused]
  663.  
  664. port = domain,953
  665. logpath = /var/log/named/security.log
  666.  
  667.  
  668. [nsd]
  669.  
  670. port = 53
  671. action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
  672. %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
  673. logpath = /var/log/nsd.log
  674.  
  675.  
  676. #
  677. # Miscellaneous
  678. #
  679.  
  680. [asterisk]
  681.  
  682. port = 5060,5061
  683. action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
  684. %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
  685. %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]
  686. logpath = /var/log/asterisk/messages
  687. maxretry = 10
  688.  
  689.  
  690. [freeswitch]
  691.  
  692. port = 5060,5061
  693. action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
  694. %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
  695. %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]
  696. logpath = /var/log/freeswitch.log
  697. maxretry = 10
  698.  
  699.  
  700. # To log wrong MySQL access attempts add to /etc/my.cnf in [mysqld] or
  701. # equivalent section:
  702. # log-warning = 2
  703. #
  704. # for syslog (daemon facility)
  705. # [mysqld_safe]
  706. # syslog
  707. #
  708. # for own logfile
  709. # [mysqld]
  710. # log-error=/var/log/mysqld.log
  711. [mysqld-auth]
  712.  
  713. port = 3306
  714. logpath = %(mysql_log)s
  715. maxretry = 5
  716.  
  717.  
  718. # Jail for more extended banning of persistent abusers
  719. # !!! WARNINGS !!!
  720. # 1. Make sure that your loglevel specified in fail2ban.conf/.local
  721. # is not at DEBUG level -- which might then cause fail2ban to fall into
  722. # an infinite loop constantly feeding itself with non-informative lines
  723. # 2. Increase dbpurgeage defined in fail2ban.conf to e.g. 648000 (7.5 days)
  724. # to maintain entries for failed logins for sufficient amount of time
  725. [recidive]
  726.  
  727. logpath = /var/log/fail2ban.log
  728. banaction = iptables-allports
  729. bantime = 604800 ; 1 week
  730. findtime = 86400 ; 1 day
  731. maxretry = 5
  732.  
  733.  
  734. # Generic filter for PAM. Has to be used with action which bans all
  735. # ports such as iptables-allports, shorewall
  736.  
  737. [pam-generic]
  738. # pam-generic filter can be customized to monitor specific subset of 'tty's
  739. banaction = iptables-allports
  740. logpath = %(syslog_authpriv)s
  741.  
  742.  
  743. [xinetd-fail]
  744.  
  745. banaction = iptables-multiport-log
  746. logpath = %(syslog_daemon)s
  747. maxretry = 2
  748.  
  749.  
  750. # stunnel - need to set port for this
  751. [stunnel]
  752.  
  753. logpath = /var/log/stunnel4/stunnel.log
  754.  
  755.  
  756. [ejabberd-auth]
  757.  
  758. port = 5222
  759. logpath = /var/log/ejabberd/ejabberd.log
  760.  
  761.  
  762. [counter-strike]
  763.  
  764. logpath = /opt/cstrike/logs/L[0-9]*.log
  765. # Firewall: http://www.cstrike-planet.com/faq/6
  766. tcpport = 27030,27031,27032,27033,27034,27035,27036,27037,27038,27039
  767. udpport = 1200,27000,27001,27002,27003,27004,27005,27006,27007,27008,27009,27010,27011,27012,27013,27014,27015
  768. action = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
  769. %(banaction)s[name=%(__name__)s-udp, port="%(udpport)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
  770.  
  771. # consider low maxretry and a long bantime
  772. # nobody except your own Nagios server should ever probe nrpe
  773. [nagios]
  774.  
  775. enabled = false
  776. logpath = %(syslog_daemon)s ; nrpe.cfg may define a different log_facility
  777. maxretry = 1
  778.  
  779.  
  780. [oracleims]
  781. # see "oracleims" filter file for configuration requirement for Oracle IMS v6 and above
  782. enabled = false
  783. logpath = /opt/sun/comms/messaging64/log/mail.log_current
  784. maxretry = 6
  785. banaction = iptables-allports
  786.  
  787. [directadmin]
  788. enabled = false
  789. logpath = /var/log/directadmin/login.log
  790. port = 2222
  791.  
  792. [portsentry]
  793. enabled = false
  794. logpath = /var/lib/portsentry/portsentry.history
  795. maxretry = 1
  796.  
  797. [pass2allow-ftp]
  798. # this pass2allow example allows FTP traffic after successful HTTP authentication
  799. port = ftp,ftp-data,ftps,ftps-data
  800. # knocking_url variable must be overridden to some secret value in filter.d/apache-pass.local
  801. filter = apache-pass
  802. # access log of the website with HTTP auth
  803. logpath = %(apache_access_log)s
  804. blocktype = RETURN
  805. returntype = DROP
  806. bantime = 3600
  807. maxretry = 1
  808. findtime = 1
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!