first commit

2024-09-24 14:03:00 +02:00
commit c989d5e1ac
11 changed files with 558 additions and 0 deletions
@@ -0,0 +1,17 @@
+# Fail2Ban configuration file
+#
+# Author: Nicolargo
+#
+[Definition]
+ 
+# Option: failregex
+# Filter Ban in the fail2ban.log
+ 
+failregex = .*\ Ban\ <HOST>
+ 
+# Option: ignoreregex
+# Notes.: regex to ignore. If this regex matches, the line is ignored.
+# Values: TEXT
+#
+ignoreregex =
+
@@ -0,0 +1,16 @@
+# Fail2Ban configuration file
+#
+# Author: Nicolargo
+#
+[Definition]
+
+# Option: failregex
+# Filter multi-ban in the fail2ban.log
+
+failregex = .*\[multi-ban\]\ Ban\ <HOST>
+
+# Option: ignoreregex
+# Notes.: regex to ignore. If this regex matches, the line is ignored.
+# Values: TEXT
+#
+ignoreregex =
@@ -0,0 +1,26 @@
+[INCLUDES]
+[Definition]
+#stop portscanning
+#
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Notes: Looks for attempts on ports not open in your firewall. Expects the
+# iptables logging utility to be used. Add the following to your iptables
+# config, as the last item before you DROP or REJECT:
+# -A <chain_name> -j LOG --log-prefix "[IPTABLES DROP] : " --log-level 5 --log-ip-options --log-tcp-options --log-tcp-sequence
+# This will place a notice in /var/log/messages about any attempt on a port that isn't open.
+#
+#Sep  7 03:28:39 orion kernel: [IPTABLES DROP] : IN=eth0 OUT= MAC=e8:40:f2:ec:d7:6d:6c:9c:ed:ba:ec:40:08:00
+#SRC=171.34.9.13 DST=142.4.213.118 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=51120 DF PROTO=TCP SPT=1682 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0
+#
+failregex = .* \[IPTABLES DROP\] .* SRC=<HOST> DST=<F-DST>\S+</F-DST> .* SPT=<F-SPT>\S+</F-SPT> DPT=<F-DPT>\d+</F-DPT> .*
+
+# Option: ignoreregex
+# Notes.: regex to ignore. If this regex matches, the line is ignored.
+# Values: TEXT
+#
+ignoreregex =
+