diff options
| author | sebres <serg.brester@sebres.de> | 2017-04-24 20:17:57 +0200 |
|---|---|---|
| committer | sebres <serg.brester@sebres.de> | 2017-04-24 21:17:55 +0200 |
| commit | 99344d28c8fe258de7fb72810ad5646ab62dbbc7 (patch) | |
| tree | 81f83575add8623031fe0b3c257f1911129a6da1 /config/action.d/xarf-login-attack.conf | |
| parent | 507034c5be77c7894e2eee8afc2ce4ea84002674 (diff) | |
| download | fail2ban-99344d28c8fe258de7fb72810ad5646ab62dbbc7.tar.gz | |
Introduces new tags with hostname:
- `<fq-hostname>` - fully-qualified name of host (the same as `$(hostname -f)`)
- `<sh-hostname>` - short hostname (the same as `$(uname -n)`)
Execution of `uname -n` replaced in all mail actions with most interesting fully-qualified `<fq-hostname>`.
Diffstat (limited to 'config/action.d/xarf-login-attack.conf')
| -rw-r--r-- | config/action.d/xarf-login-attack.conf | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf index 5274cdaf..9d441aa3 100644 --- a/config/action.d/xarf-login-attack.conf +++ b/config/action.d/xarf-login-attack.conf @@ -46,7 +46,7 @@ actionban = oifs=${IFS}; IFS=.;SEP_IP=( <ip> ); set -- ${SEP_IP}; ADDRESSES=$(di FROM=<sender> SERVICE=<service> FAILURES=<failures> - REPORTID=<time>@`uname -n` + REPORTID=<time>@<fq-hostname> TLP=<tlp> PORT=<port> DATE=`LC_ALL=C date --date=@<time> +"%%a, %%d %%h %%Y %%T %%z"` @@ -119,7 +119,7 @@ logpath = /dev/null # Option: sender # Notes.: This is the sender that is included in the XARF report -sender = fail2ban@`uname -n` +sender = fail2ban@<fq-hostname> # Option: port # Notes.: This is the port number that received the login-attack |