From f742ed0e4bc3182f36f348345bce2858b6db4369 Mon Sep 17 00:00:00 2001 From: Steven Hiscocks Date: Thu, 5 Dec 2013 18:06:53 +0000 Subject: [PATCH] DOC: when to use blocklist.de reporting Taken from commit 1846056606d24abe4e7d3f2e1cf56407c65b9008 --- config/action.d/blocklist_de.conf | 10 ++++++++++ config/jail.conf | 5 ++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/config/action.d/blocklist_de.conf b/config/action.d/blocklist_de.conf index d11b175b..468f3fc9 100644 --- a/config/action.d/blocklist_de.conf +++ b/config/action.d/blocklist_de.conf @@ -17,6 +17,16 @@ # infected PCs/servers to ensure that the responsible provider can inform # the customer about the infection and disable them # +# IMPORTANT: +# +# Reporting an IP of abuse is a serious complaint. Make sure that it is +# serious. Fail2ban developers and network owners recommend you only use this +# action for: +# * The recidive where the IP has been banned multiple times +# * Where maxretry has been set quite high, beyond the normal user typing +# password incorrectly. +# * For filters that have a low likelyhood of receiving human errors +# [Definition] diff --git a/config/jail.conf b/config/jail.conf index cbcfb758..3b8220e5 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -533,6 +533,9 @@ action = iptables[name=SELINUX-SSH, port=ssh, protocol=tcp] logpath = /var/log/audit/audit.log maxretry = 5 +# See the IMPORTANT note in action.d/blocklist_de.conf for when to +# use this action +# # Report block via blocklist.de fail2ban reporting service API # See action.d/blocklist_de.conf for more information [ssh-blocklist] @@ -543,4 +546,4 @@ action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois[name=SSH, dest=you@example.com, sender=fail2ban@example.com, sendername="Fail2Ban"] blocklist_de[email="fail2ban@example.com", apikey="xxxxxx", service=%(filter)s] logpath = /var/log/sshd.log -maxretry = 5 +maxretry = 20