Mercurial > repos > other > Puppet

annotate common/fail2ban/ibb-repeat-offender-ssh.conf @ 276:165ad12ea8ca

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Remove Perl LZMA module because it's in beta We don't get LZMA files by email anyway, so not scanning them shouldn't be a problem
author IBBoard <dev@ibboard.co.uk>
date Sun, 26 Jan 2020 12:06:43 +0000
parents f70831cc2864
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
195
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1 # IBB-Repeat-Offender-SSH configuration file
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
2 #
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
3 # Author: Tom Hendrikx, minor modifications by Amir Caspi
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
4 # See http://whyscream.net/wiki/index.php/Fail2ban_monitoring_Fail2ban
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
5 # Renamed and adjusted by IBBoard for consistency
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
6 #
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
7
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
8 [Definition]
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
9
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
10 # Option: failregex
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
11 # Notes.: regex to match the password failures messages in the logfile. The
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
12 # host must be matched by a group named "host". The tag "<HOST>" can
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
13 # be used for standard IP/hostname matching and is only an alias for
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
14 # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
15 # Values: TEXT
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
16 #
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
17 failregex = NOTICE\s+\[ssh-[^\]]+\]\s+Ban\s+<HOST>
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
18
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
19 # Option: ignoreregex
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
20 # Notes.: regex to ignore. If this regex matches, the line is ignored.
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
21 # Values: TEXT
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
22 #
f70831cc2864 Separate out SSH repeats from web/email repeats
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
23 #ignoreregex =