Mercurial > repos > other > Puppet
changeset 43:5b9ba754d2ff
Update the "repeat offender" rule so that a) it works, and b) "already banned"* also counts as repeat
* i.e. quick bombardments that get multiple hits in the rules before Fail2Ban had a chance to process them
| author | IBBoard <dev@ibboard.co.uk> |
|---|---|
| date | Sat, 11 Apr 2015 08:21:12 +0000 |
| parents | 29d330d2056a |
| children | 546dfa011f58 |
| files | common/fail2ban/ibb-repeat-offender.conf |
| diffstat | 1 files changed, 2 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/common/fail2ban/ibb-repeat-offender.conf Sun Mar 22 18:26:06 2015 +0000 +++ b/common/fail2ban/ibb-repeat-offender.conf Sat Apr 11 08:21:12 2015 +0000 @@ -16,7 +16,8 @@ # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Values: TEXT # -failregex = fail2ban.actions:\s+WARNING\s+\[(?:.*)\]\s+Ban\s+<HOST> +failregex = WARNING\s+\[(?:.*)\]\s+Ban\s+<HOST> + INFO\s+\[(?:.*)\]\s+<HOST> already banned # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored.