From f15ed356198728c18470794ce6d88fb786571dc4 Mon Sep 17 00:00:00 2001
From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date: Thu, 25 Feb 2021 20:13:18 +0100
Subject: [PATCH] config/: Add support for filtering out detected port scans
 via scanlogd.

---
 config/filter.d/scanlogd.conf | 17 +++++++++++++++++
 config/jail.conf              |  3 +++
 2 files changed, 20 insertions(+)
 create mode 100644 config/filter.d/scanlogd.conf

diff --git a/config/filter.d/scanlogd.conf b/config/filter.d/scanlogd.conf
new file mode 100644
index 00000000..65ad63f6
--- /dev/null
+++ b/config/filter.d/scanlogd.conf
@@ -0,0 +1,17 @@
+# Fail2Ban filter for port scans detected by scanlogd
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+[Definition]
+
+_daemon = scanlogd
+
+failregex =  ^%(__prefix_line)s<HOST>\ to\ [\.:0-9a-f]+\ ports\ [\ \.,0-9]+,\ f.......,\ TOS\ [0-9]+,\ TTL\ [0-9]+\ \@[0-9]{1,2}:[0-9]{2}:[0-9]{2}$
+
+ignoreregex =
+
+# Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
diff --git a/config/jail.conf b/config/jail.conf
index 28f259a0..d6d8af67 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -965,3 +965,6 @@ logpath = %(apache_error_log)s
 # see `filter.d/traefik-auth.conf` for details and service example.
 port    = http,https
 logpath = /var/log/traefik/access.log
+
+[scanlogd]
+logpath = %{syslog_local0}