Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| howto:fail2ban [2020/07/02 22:59] – add rules for hack / spam logs ragnarok | howto:fail2ban [2023/07/25 15:36] (current) – [Use Fail2Ban on GNU/Linux to block botnet's attacks] nick young | ||
|---|---|---|---|
| Line 25: | Line 25: | ||
| maxretry = 3 | maxretry = 3 | ||
| findtime = 21600 | findtime = 21600 | ||
| + | bantime = 21600 | ||
| + | |||
| + | [sbbs-ddos] | ||
| + | enabled | ||
| + | filter | ||
| + | action | ||
| + | logpath | ||
| + | maxretry = 8 | ||
| + | findtime = 600 | ||
| bantime = 21600 | bantime = 21600 | ||
| Line 65: | Line 74: | ||
| failregex = Bad password from: < | failregex = Bad password from: < | ||
| Throttling suspicious connection from: < | Throttling suspicious connection from: < | ||
| + | ignoreregex = | ||
| + | </ | ||
| + | |||
| + | Filter for ddos (/ | ||
| + | < | ||
| + | [INCLUDES] | ||
| + | before = common.conf | ||
| + | |||
| + | [Definition] | ||
| + | failregex = !Maximum concurrent connections without login (.*) reached from host: < | ||
| ignoreregex = | ignoreregex = | ||
| </ | </ | ||
| Line 86: | Line 105: | ||
| failregex = .* !TEMPORARY BAN of .* < | failregex = .* !TEMPORARY BAN of .* < | ||
| SMTP BLACKLISTED SERVER on .* \(.*\)\: .* \[< | SMTP BLACKLISTED SERVER on .* \(.*\)\: .* \[< | ||
| + | ^.*\[< | ||
| ignoreregex = | ignoreregex = | ||
| </ | </ | ||
| Line 105: | Line 125: | ||
| Status | Status | ||
| |- Number of jail: 7 | |- Number of jail: 7 | ||
| - | `- Jail list: | + | `- Jail list: |
| </ | </ | ||
| Line 135: | Line 155: | ||
| RETURN | RETURN | ||
| + | Chain fail2ban-SBBS-ddos (1 references) | ||
| + | target | ||
| + | REJECT | ||
| + | RETURN | ||
| </ | </ | ||
| - | |||
| ===== See Also ===== | ===== See Also ===== | ||
| * [[: | * [[: | ||
