FM / action.d

/etc/fail2ban/action.d

Name	Size	Mode	Actions
abuseipdb.conf	3748	0644	edit dl rm
apf.conf	587	0644	edit dl rm
badips.conf	629	0644	edit dl rm
badips.py	11536	0644	edit dl rm
blocklist_de.conf	2715	0644	edit dl rm
bsd-ipfw.conf	3226	0644	edit dl rm
cloudflare.conf	2970	0644	edit dl rm
complain.conf	4757	0644	edit dl rm
dshield.conf	7668	0644	edit dl rm
dummy.conf	1717	0644	edit dl rm
firewallcmd-allports.conf	1501	0644	edit dl rm
firewallcmd-common.conf	2649	0644	edit dl rm
firewallcmd-ipset.conf	2719	0644	edit dl rm
firewallcmd-multiport.conf	1322	0644	edit dl rm
firewallcmd-new.conf	1950	0644	edit dl rm
firewallcmd-rich-logging.conf	1021	0644	edit dl rm
firewallcmd-rich-rules.conf	1801	0644	edit dl rm
helpers-common.conf	592	0644	edit dl rm
hostsdeny.conf	1657	0644	edit dl rm
ipfilter.conf	1573	0644	edit dl rm
ipfw.conf	1505	0644	edit dl rm
iptables-allports.conf	1514	0644	edit dl rm
iptables-common.conf	2738	0644	edit dl rm
iptables-ipset-proto4.conf	2088	0644	edit dl rm
iptables-ipset-proto6-allports.conf	2742	0644	edit dl rm
iptables-ipset-proto6.conf	2785	0644	edit dl rm
iptables-multiport-log.conf	2170	0644	edit dl rm
iptables-multiport.conf	1508	0644	edit dl rm
iptables-new.conf	1585	0644	edit dl rm
iptables-xt_recent-echo.conf	2672	0644	edit dl rm
iptables.conf	1427	0644	edit dl rm
mail-buffered.conf	2431	0644	edit dl rm
mail-whois-common.conf	1051	0644	edit dl rm
mail-whois-lines.conf	2443	0644	edit dl rm
mail-whois.conf	1842	0644	edit dl rm
mail.conf	1709	0644	edit dl rm
mynetwatchman.conf	5321	0644	edit dl rm
netscaler.conf	1493	0644	edit dl rm
nftables-allports.conf	383	0644	edit dl rm
nftables-multiport.conf	384	0644	edit dl rm
nftables.conf	6318	0644	edit dl rm
nginx-block-map.conf	3746	0644	edit dl rm
npf.conf	1524	0644	edit dl rm
nsupdate.conf	3234	0644	edit dl rm
osx-afctl.conf	497	0644	edit dl rm
osx-ipfw.conf	2302	0644	edit dl rm
pf.conf	3750	0644	edit dl rm
route.conf	1023	0644	edit dl rm
sendmail-buffered.conf	2806	0644	edit dl rm
sendmail-common.conf	1938	0644	edit dl rm
sendmail-geoip-lines.conf	1761	0644	edit dl rm
sendmail-whois-ipjailmatches.conf	1055	0644	edit dl rm
sendmail-whois-ipmatches.conf	1036	0644	edit dl rm
sendmail-whois-lines.conf	1299	0644	edit dl rm
sendmail-whois-matches.conf	1000	0644	edit dl rm
sendmail-whois.conf	950	0644	edit dl rm
sendmail.conf	829	0644	edit dl rm
shorewall-ipset-proto6.conf	3521	0644	edit dl rm
shorewall.conf	2156	0644	edit dl rm
smtp.py	6277	0644	edit dl rm
symbiosis-blacklist-allports.conf	1418	0644	edit dl rm
ufw.conf	1045	0644	edit dl rm
xarf-login-attack.conf	6443	0644	edit dl rm

Edit: /etc/fail2ban/action.d/dshield.conf (7668B)

# Fail2Ban configuration file
#
# Author: Russell Odom <russ@gloomytrousers.co.uk>
# Submits attack reports to DShield (http://www.dshield.org/)
#
# You MUST configure at least:
# <port> (the port that's being attacked - use number not name).
#
# You SHOULD also provide:
# <myip> (your public IP address, if it's not the address of eth0)
# <userid> (your DShield userID, if you have one - recommended, but reports will
# be used anonymously if not)
# <protocol> (the protocol in use - defaults to tcp)
#
# Best practice is to provide <port> and <protocol> in jail.conf like this:
# action = dshield[port=1234,protocol=tcp]
#
# ...and create "dshield.local" with contents something like this:
# [Init]
# myip = 10.0.0.1
# userid = 12345
#
# Other useful configuration values are <mailargs> (you can use for specifying
# a different sender address for the report e-mails, which should match what is
# configured at DShield), and <lines>/<minreportinterval>/<maxbufferage> (to
# configure how often the buffer is flushed).
#

[Definition]

# bypass ban/unban for restored tickets
norestored = 1

# Option:  actionstart
# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
# Values:  CMD
#
actionstart =

# Option:  actionstop
# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
# Values:  CMD
#
actionstop = if [ -f <tmpfile>.buffer ]; then
                 cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/$[+-]..$$..$/\1:\2/'` Fail2Ban" <mailargs> <dest>
                 date +%%s > <tmpfile>.lastsent
             fi
             rm -f <tmpfile>.buffer <tmpfile>.first

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck =

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
# See http://www.dshield.org/specs.html for more on report format/notes
#
# Note: We are currently using <time> for the timestamp because no tag is
# available to indicate the timestamp of the log message(s) which triggered the
# ban. Therefore the timestamps we are using in the report, whilst often only a
# few seconds out, are incorrect. See
# http://sourceforge.net/tracker/index.php?func=detail&aid=2017795&group_id=121032&atid=689047
#
actionban = TZONE=`date +%%z | sed 's/$[+-]..$$..$/\1:\2/'`
            DATETIME="`perl -e '@t=localtime(<time>);printf "%%4d-%%02d-%%02d %%02d:%%02d:%%02d",1900+$t[5],$t[4]+1,$t[3],$t[2],$t[1],$t[0]'` $TZONE"
	    PROTOCOL=`awk '{IGNORECASE=1;if($1=="<protocol>"){print $2;exit}}' /etc/protocols`
	    if [ -z "$PROTOCOL" ]; then PROTOCOL=<protocol>; fi
            printf %%b "$DATETIME\t<userid>\t<failures>\t<ip>\t<srcport>\t<myip>\t<port>\t$PROTOCOL\t<tcpflags>\n" >> <tmpfile>.buffer
            NOW=`date +%%s`
            if [ ! -f <tmpfile>.first ]; then
                echo <time> | cut -d. -f1 > <tmpfile>.first
            fi
            if [ ! -f <tmpfile>.lastsent ]; then
                echo 0 > <tmpfile>.lastsent
            fi
            LOGAGE=$(($NOW - `cat <tmpfile>.first`))
            LASTREPORT=$(($NOW - `cat <tmpfile>.lastsent`))
            LINES=$( wc -l <tmpfile>.buffer | awk '{ print $1 }' )
            if [ $LINES -ge <lines> && $LASTREPORT -gt <minreportinterval> ] || [ $LOGAGE -gt <maxbufferage> ]; then
                cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ $TZONE Fail2Ban" <mailargs> <dest>
                rm -f <tmpfile>.buffer <tmpfile>.first
                echo $NOW > <tmpfile>.lastsent
            fi

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionunban = if [ -f <tmpfile>.first ]; then
                  NOW=`date +%%s`
                  LOGAGE=$(($NOW - `cat <tmpfile>.first`))
                  if [ $LOGAGE -gt <maxbufferage> ]; then
                      cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/$[+-]..$$..$/\1:\2/'` Fail2Ban" <mailargs> <dest>
                      rm -f <tmpfile>.buffer <tmpfile>.first
                      echo $NOW > <tmpfile>.lastsent
                  fi
              fi

[Init]
# Option:  port
# Notes.:  The target port for the attack (numerical). MUST be provided in the
#          jail config, as it cannot be detected here.
# Values:  [ NUM ]
#
port = ???

# Option:  userid
# Notes.:  Your DShield user ID. Should be provided either in the jail config or
#          in a .local file.
#          Register at https://secure.dshield.org/register.html
# Values:  [ NUM ]
#
userid = 0

# Option:  myip
# Notes.:  The target IP for the attack (your public IP). Should be provided
#          either in the jail config or in a .local file unless your PUBLIC IP
#          is the first IP assigned to eth0
# Values:  [ an IP address ]  Default: Tries to find the IP address of eth0,
#          which in most cases will be a private IP, and therefore incorrect
#
myip = `ip -4 addr show dev eth0 | grep inet | head -n 1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`

# Option:  protocol
# Notes.:  The protocol over which the attack is happening
# Values:  [ tcp | udp | icmp | (any other protocol name from /etc/protocols) | NUM ] Default: tcp
#
protocol = tcp

# Option:  lines
# Notes.:  How many lines to buffer before making a report. Regardless of this,
#          reports are sent a minimum of <minreportinterval> apart, or if the
#          buffer contains an event over <maxbufferage> old, or on shutdown
# Values:  [ NUM ]
#
lines = 50

# Option:  minreportinterval
# Notes.:  Minimum period (in seconds) that must elapse before we submit another
#          batch of reports. DShield request a minimum of 1 hour (3600 secs)
#          between reports.
# Values:  [ NUM ]
#
minreportinterval = 3600

# Option:  maxbufferage
# Notes.:  Maximum age (in seconds) of the oldest report in the buffer before we
#          submit the batch, even if we haven't reached <lines> yet. Note that
#          this is only checked on each ban/unban, and that we always send
#          anything in the buffer on shutdown. Must be greater than
# Values:  [ NUM ]
#
maxbufferage = 21600

# Option:  srcport
# Notes.:  The source port of the attack. You're unlikely to have this info, so
#          you can leave the default
# Values:  [ NUM ]
#
srcport = ???

# Option:  tcpflags
# Notes.:  TCP flags on attack. You're unlikely to have this info, so you can
#          leave empty
# Values:  [ STRING ]
#
tcpflags =

# Option:  mailcmd
# Notes.:  Your system mail command. Is passed 2 args: subject and recipient
# Values:  CMD
#
mailcmd = mail -s

# Option:  mailargs
# Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
#          CC reports to another address:
#              -c me@example.com
#          Appear to come from a different address (the From address must match
#          the one configured at DShield - the '--' indicates arguments to be
#          passed to Sendmail):
#              -- -f me@example.com
# Values:  [ STRING ]
#
mailargs =

# Option:  dest
# Notes.:  Destination e-mail address for reports
# Values:  [ STRING ]
#
dest = reports@dshield.org

# Option:  tmpfile
# Notes.:  Base name of temporary files used for buffering
# Values:  [ STRING ]
#
tmpfile = /var/run/fail2ban/tmp-dshield

cmd: