Skip to content
Snippets Groups Projects
Commit 7613351a authored by Rahul Thakur's avatar Rahul Thakur
Browse files

fail2ban: add datepattern and conf for sshd

* add the jail.local config to enable fail2ban on ssh to prevent
  brute force attack
* add datepattern for fail2ban to be able to function with syslog-ng
  generated /var/log/messages
parent 5e7006f2
No related branches found
No related tags found
1 merge request!70fail2ban: add datepattern and conf for sshd
...@@ -73,6 +73,7 @@ define Py3Package/fail2ban/install ...@@ -73,6 +73,7 @@ define Py3Package/fail2ban/install
$(INSTALL_DIR) $(1)/etc/fail2ban/ $(INSTALL_DIR) $(1)/etc/fail2ban/
$(CP) $(PKG_BUILD_DIR)/config/* $(1)/etc/fail2ban/ $(CP) $(PKG_BUILD_DIR)/config/* $(1)/etc/fail2ban/
$(INSTALL_DATA) ./files/jail.local $(1)/etc/fail2ban/
$(INSTALL_DIR) $(1)/etc/fail2ban/fail2ban.d $(INSTALL_DIR) $(1)/etc/fail2ban/fail2ban.d
$(INSTALL_DATA) ./files/db.conf $(1)/etc/fail2ban/fail2ban.d/db.conf $(INSTALL_DATA) ./files/db.conf $(1)/etc/fail2ban/fail2ban.d/db.conf
......
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/messages
maxretry = 3
findtime = 10
bantime = 120
ignoreip = 127.0.0.1
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -36,6 +36,8 @@
[Definition]
+datepattern = ^%%b %%d %%H:%%M:%%S
+
prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID>%(__pref)s<F-CONTENT>.+</F-CONTENT>$
cmnfailre = ^[aA]uthentication (?:failure|error|failed) for <F-USER>.*</F-USER> from <HOST>( via \S+)?%(__suff)s$
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment