diff options
| author | sebres <serg.brester@sebres.de> | 2020-09-03 16:41:23 +0200 |
|---|---|---|
| committer | sebres <serg.brester@sebres.de> | 2020-09-03 16:41:23 +0200 |
| commit | a038fd5dfe8cb0714472833604735b83462a217d (patch) | |
| tree | c1bf84dbbfdf5e304aef63e3da83eada236a35b8 /config/action.d/firewallcmd-rich-logging.conf | |
| parent | ed20d457b21d298cf8a8569ab2eb09546e8065c4 (diff) | |
| download | fail2ban-a038fd5dfe8cb0714472833604735b83462a217d.tar.gz | |
`action.d/firewallcmd-*.conf` (multiport only): fixed port range selector, replacing `:` with `-`;
small optimizations on `firewallcmd-rich-rules.conf` and `firewallcmd-rich-logging.conf` simplifying both and provide a dependency (rich-logging is a derivative of rich-rules);
closes gh-2821
Diffstat (limited to 'config/action.d/firewallcmd-rich-logging.conf')
| -rw-r--r-- | config/action.d/firewallcmd-rich-logging.conf | 30 |
1 files changed, 4 insertions, 26 deletions
diff --git a/config/action.d/firewallcmd-rich-logging.conf b/config/action.d/firewallcmd-rich-logging.conf index badfee83..21e45087 100644 --- a/config/action.d/firewallcmd-rich-logging.conf +++ b/config/action.d/firewallcmd-rich-logging.conf @@ -1,6 +1,6 @@ # Fail2Ban configuration file # -# Author: Donald Yandt +# Authors: Donald Yandt, Sergey G. Brester # # Because of the rich rule commands requires firewalld-0.3.1+ # This action uses firewalld rich-rules which gives you a cleaner iptables since it stores rules according to zones and not @@ -10,36 +10,15 @@ # # If you use the --permanent rule you get a xml file in /etc/firewalld/zones/<zone>.xml that can be shared and parsed easliy # -# Example commands to view rules: -# firewall-cmd [--zone=<zone>] --list-rich-rules -# firewall-cmd [--zone=<zone>] --list-all -# firewall-cmd [--zone=zone] --query-rich-rule='rule' +# This is an derivative of firewallcmd-rich-rules.conf, see there for details and other parameters. [INCLUDES] -before = firewallcmd-common.conf +before = firewallcmd-rich-rules.conf [Definition] -actionstart = - -actionstop = - -actioncheck = - -# you can also use zones and/or service names. -# -# zone example: -# firewall-cmd --zone=<zone> --add-rich-rule="rule family='<family>' source address='<ip>' port port='<port>' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <rich-blocktype>" -# -# service name example: -# firewall-cmd --zone=<zone> --add-rich-rule="rule family='<family>' source address='<ip>' service name='<service>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <rich-blocktype>" -# -# Because rich rules can only handle single or a range of ports we must split ports and execute the command for each port. Ports can be single and ranges separated by a comma or space for an example: http, https, 22-60, 18 smtp - -actionban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule="rule family='<family>' source address='<ip>' port port='$p' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <rich-blocktype>"; done - -actionunban = ports="<port>"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --remove-rich-rule="rule family='<family>' source address='<ip>' port port='$p' protocol='<protocol>' log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <rich-blocktype>"; done +rich-suffix = log prefix='f2b-<name>' level='<level>' limit value='<rate>/m' <rich-blocktype> [Init] @@ -48,4 +27,3 @@ level = info # log rate per minute rate = 1 - |