Added fail2ban filters, fx package naming, ver up
This commit is contained in:
@@ -0,0 +1,25 @@
|
||||
# Fail2Ban filter for bforce bf-log.tcpip log file
|
||||
# Detecting unauthorized access
|
||||
# Typically logged in /var/log/bforce/bf-debug
|
||||
|
||||
# Apr 10 17:34:20 [944134] TCP/IP connect from 72.138.46.4 on port 5590
|
||||
# Apr 10 17:34:21 [944134] Session ended up, rc=21, inetd=1
|
||||
# Apr 10 17:34:21 [944134] session rc = 21 ("Cannot handshake with remote")
|
||||
# Apr 10 17:34:21 [944135] Answering TCPIP call...
|
||||
# Apr 10 17:34:21 [944135] TCP/IP connect from 72.138.46.4 on port 7714
|
||||
# Apr 10 17:34:21 [944135] Session ended up, rc=21, inetd=1
|
||||
# Apr 10 17:34:21 [944135] session rc = 21 ("Cannot handshake with remote")
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
before = common.conf
|
||||
|
||||
[Init]
|
||||
maxlines = 5
|
||||
|
||||
[Definition]
|
||||
prefregex = \[<F-MLFID>\d+</F-MLFID>\] TCP/IP connect from <HOST> on port \d+$
|
||||
failregex = session rc \= 21
|
||||
ignoreregex =
|
||||
@@ -0,0 +1,8 @@
|
||||
[bforce]
|
||||
enabled = true
|
||||
port = 24554,60179
|
||||
filter = bforce
|
||||
logpath = /opt/fidonms/logs/bf-log.tcpip
|
||||
maxretry = 5
|
||||
findtime = 60
|
||||
bantime = 600
|
||||
Reference in New Issue
Block a user