Fail2ban Vuurmuur - Revision history

Snifer at 03:25, 28 February 2017

2017-02-28T03:25:56Z

Snifer at 18:24, 26 May 2009

2009-05-26T18:24:23Z

Snifer at 18:22, 26 May 2009

2009-05-26T18:22:38Z

Snifer at 18:21, 26 May 2009

2009-05-26T18:21:42Z

Snifer: New page: Fail2ban + Vuurmuur

apt-get install fail2ban nano /etc/fail2ban/action.d/vuurmuur.conf

# Fail2Ban configuration file # #  [Definition]  # Option:  actionban # Notes.:  com...

2009-05-26T18:21:03Z

New page: Fail2ban + Vuurmuur <pre>apt-get install fail2ban nano /etc/fail2ban/action.d/vuurmuur.conf </pre><pre># Fail2Ban configuration file # # [Definition] # Option: actionban # Notes.: com...

New page

Fail2ban + Vuurmuur
<pre>apt-get install fail2ban
nano /etc/fail2ban/action.d/vuurmuur.conf
</pre><pre># Fail2Ban configuration file
#
#

[Definition]

# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <failures> number of failures
# <time> unix timestamp of the ban time
# Values: CMD
#
actionban = vuurmuur_script --block <ip> --apply

# Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <failures> number of failures
# <time> unix timestamp of the ban time
# Values: CMD
#
actionunban = vuurmuur_script --unblock <ip> --apply
</pre>
The parameter –apply makes the rule active and reloads vuurmuurs configuration. Open /etc/fail2ban/jail.conf in your favorite editor and search the option banaction and change it as follows:
<pre>nano /etc/fail2ban/jail.conf
banaction = vuurmuur
</pre>
[http://wiki.goatpr0n.de/blog/2009/03/07.vuurmuur.and.fail2ban source]

@@ Line 3: / Line 3: @@
 nano /etc/fail2ban/action.d/vuurmuur.conf</pre>
 <pre>
-#Fail2Ban configuration file
+# Author: Nick Shobe
+#
+#
+# Create a zone in vuurmuur called fail2ban... this script will add the "<name>" network and all the hosts... you can use a custom rule in vuurmuur to block ports by network
-[Definition]
+# You can make multiple rules that block specific ports if you don't want to globally block an ip... Do this like any customized rules.
+actionstart = vuurmuur_script --create --network <name>.fail2ban
-#Option:  actionban
+       vuurmuur_script --modify --network <name>.fail2ban --variable ACTIVE --set Yes
-#Notes.:  command executed when banning an IP. Take care that the
+       vuurmuur_script --modify --network <name>.fail2ban --variable NETWORK --set 0.0.0.0
 #          command is executed with Fail2Ban user rights.
-#Tags:    <ip>  IP address
+# Tags:    <ip>  IP address
 #          <failures>  number of failures
 #          <time>  unix timestamp of the ban time
-#Values:  CMD
+# Values:  CMD
+#
-actionban = vuurmuur_script --block <ip> --apply
+actionban =     vuurmuur_script --create --host `echo <ip> | tr '.' "-"`.<name>.fail2ban
+       vuurmuur_script --modify --host `echo <ip> | tr '.' "-"`.<name>.fail2ban --variable IPADDRESS --set <ip>
-#Option:  actionunban
+       vuurmuur_script --modify --host `echo <ip> | tr '.' "-"`.<name>.fail2ban --variable ACTIVE --set Yes
-#Notes.:  command executed when unbanning an IP. Take care that the
+       append=''
 #          command is executed with Fail2Ban user rights.
-#Tags:    <ip>  IP address
+# Tags:    <ip>  IP address
 #          <failures>  number of failures
 #          <time>  unix timestamp of the ban time
-#Values:  CMD
+# Values:  CMD
+#
-actionunban = vuurmuur_script --unblock <ip> --apply
+name = block
-</pre>
-The parameter –apply makes the rule active and reloads vuurmuurs configuration. Open /etc/fail2ban/jail.conf in your favorite editor and search the option banaction and change it as follows:
+group = blockedhosts
 </pre>
 [http://wiki.goatpr0n.de/blog/2009/03/07.vuurmuur.and.fail2ban source]

@@ Line 2: / Line 2: @@
 <pre>apt-get install fail2ban
 nano /etc/fail2ban/action.d/vuurmuur.conf</pre>
-# Fail2Ban configuration file<br>#<br>#
+<pre>
 [Definition]
-# Option: actionban<br># Notes.: command executed when banning an IP. Take care that the<br># command is executed with Fail2Ban user rights.<br># Tags: &lt;ip&gt; IP address<br># &lt;failures&gt; number of failures<br># &lt;time&gt; unix timestamp of the ban time<br># Values: CMD<br>#<br>actionban = vuurmuur_script --block &lt;ip&gt; --apply
+#Option:  actionban
+#Notes.:  command executed when banning an IP. Take care that the
-# Option: actionunban<br># Notes.: command executed when unbanning an IP. Take care that the<br># command is executed with Fail2Ban user rights.<br># Tags: &lt;ip&gt; IP address<br># &lt;failures&gt; number of failures<br># &lt;time&gt; unix timestamp of the ban time<br># Values: CMD<br>#<br>actionunban = vuurmuur_script --unblock &lt;ip&gt; --apply<br>
+#          command is executed with Fail2Ban user rights.
+#Tags:    <ip>  IP address
+#          <failures>  number of failures
 The parameter –apply makes the rule active and reloads vuurmuurs configuration. Open /etc/fail2ban/jail.conf in your favorite editor and search the option banaction and change it as follows:
 <pre>nano /etc/fail2ban/jail.conf