| 4 |
- |
1 |
# Fail2Ban configuration file
|
|
|
2 |
#
|
|
|
3 |
# Author: Michael Gebetsroither
|
|
|
4 |
#
|
|
|
5 |
# This is for blocking whole hosts through blackhole routes.
|
|
|
6 |
#
|
|
|
7 |
# PRO:
|
|
|
8 |
# - Works on all kernel versions and as no compatibility problems (back to debian lenny and WAY further).
|
|
|
9 |
# - It's FAST for very large numbers of blocked ips.
|
|
|
10 |
# - It's FAST because it Blocks traffic before it enters common iptables chains used for filtering.
|
|
|
11 |
# - It's per host, ideal as action against ssh password bruteforcing to block further attack attempts.
|
|
|
12 |
# - No additional software required beside iproute/iproute2
|
|
|
13 |
#
|
|
|
14 |
# CON:
|
|
|
15 |
# - Blocking is per IP and NOT per service, but ideal as action against ssh password bruteforcing hosts
|
|
|
16 |
|
|
|
17 |
[Definition]
|
|
|
18 |
actionban = ip route add <blocktype> <ip>
|
|
|
19 |
actionunban = ip route del <blocktype> <ip>
|
|
|
20 |
|
|
|
21 |
[Init]
|
|
|
22 |
|
|
|
23 |
# Option: blocktype
|
|
|
24 |
# Note: Type can be blackhole, unreachable and prohibit. Unreachable and prohibit correspond to the ICMP reject messages.
|
|
|
25 |
# Values: STRING
|
|
|
26 |
blocktype = unreachable
|