prehistoric-systems/fail2ban
1
0
Fork 0
mirror of https://github.com/fail2ban/fail2ban.git synced 2026-03-11 08:55:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

config/: Add support for filtering out detected port scans via scanlogd.

Browse source
This commit is contained in:
Mike Gabriel 2021-02-25 20:13:18 +01:00
parent 884cbbd6e1
commit f15ed35619
2 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
config/filter.d/scanlogd.conf Normal file
View file

@ -0,0 +1,17 @@
# Fail2Ban filter for port scans detected by scanlogd
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf
[Definition]
_daemon = scanlogd
failregex = ^%(__prefix_line)s<HOST>\ to\ [\.:0-9a-f]+\ ports\ [\ \.,0-9]+,\ f.......,\ TOS\ [0-9]+,\ TTL\ [0-9]+\ \@[0-9]{1,2}:[0-9]{2}:[0-9]{2}$
ignoreregex =
# Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

3
config/jail.conf
View file

@ -965,3 +965,6 @@ logpath = %(apache_error_log)s
# see `filter.d/traefik-auth.conf` for details and service example.
port = http,https
logpath = /var/log/traefik/access.log
[scanlogd]
logpath = %{syslog_local0}