Subversion Repositories ALCASAR

Rev

Rev 1270 | Go to most recent revision | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 1270 Rev 1388
Line 1... Line 1...
1 
FAIL_CONF="/etc/fail2ban/fail2ban.conf"
 1 
FAIL_CONF="/etc/fail2ban/fail2ban.conf"
2 
JAIL_CONF="/etc/fail2ban/jail.conf"
 2 
JAIL_CONF="/etc/fail2ban/jail.conf"
3 
DIR_FILTER="/etc/fail2ban/filter.d/"
 3 
DIR_FILTER="/etc/fail2ban/filter.d/"
4 
ACTION_ALLPORTS="/etc/fail2ban/action.d/iptables-allports.conf"
 4 
ACTION_ALLPORTS="/etc/fail2ban/action.d/iptables-allports.conf"
5 
 
 5 
 
6 
if(test -f $FAIL_CONF)
 - 
 
7 
then
 - 
 
8 
	mv $FAIL_CONF $FAIL_CONF.old
 - 
 
9 
fi
 - 
 
10 
 
 - 
 
11 
if(test -f $JAIL_CONF)
 - 
 
12 
then
 - 
 
13 
	mv $JAIL_CONF $JAIL_CONF.old
 - 
 
14 
fi
 - 
 
15 
 
 - 
 
16 
#########################################################
 6 
#########################################################
17 
## Mise à jour du fichier de configuration de fail2ban ##
 7 
## Mise à jour du fichier de configuration de fail2ban ##
18 
#########################################################
 8 
#########################################################
- 
 
 9 
if(test -f $FAIL_CONF)
- 
 
 10 
then
- 
 
 11 
	mv $FAIL_CONF $FAIL_CONF.default
19 
 
 12 
fi
20 
cat << EOF > $FAIL_CONF
 13 
cat << EOF > $FAIL_CONF
21 
 
 14 
 
22 
[Definition]
 15 
[Definition]
23 
 
 16 
 
24 
# Option:  loglevel
 17 
# Option:  loglevel
Line 48... Line 41...
48 
EOF
 41 
EOF
49 
 
 42 
 
50 
#########################################################
 43 
#########################################################
51 
## Mise à jour de la configuration de jail de fail2ban ##
 44 
## Mise à jour de la configuration de jail de fail2ban ##
52 
#########################################################
 45 
#########################################################
- 
 
 46 
if(test -f $JAIL_CONF)
- 
 
 47 
then
- 
 
 48 
	mv $JAIL_CONF $JAIL_CONF.default
53 
 
 49 
fi
54 
cat << EOF > $JAIL_CONF
 50 
cat << EOF > $JAIL_CONF
55 
 
 51 
 
56 
# Fail2Ban configuration file
 52 
# Fail2Ban configuration file
57 
#
 53 
#
58 
# Author: Cyril Jaquier
 54 
# Author: Cyril Jaquier
59 
#
 - 
 
60 
# $Revision$
 55 
# Adapted by ALCASAR team
61 
#
 56 
 
62 
 
 57 
 
63 
# The DEFAULT allows a global definition of the options. They can be overridden
 58 
# The DEFAULT allows a global definition of the options. They can be overridden
64 
# in each jail afterwards.
 59 
# in each jail afterwards.
65 
 
 60 
 
66 
[DEFAULT]
 61 
[DEFAULT]
Line 71... Line 66...
71 
ignoreip = 127.0.0.1/8
 66 
ignoreip = 127.0.0.1/8
72 
 
 67 
 
73 
# "bantime" is the number of seconds that a host is banned.
 68 
# "bantime" is the number of seconds that a host is banned.
74 
bantime  = 300
 69 
bantime  = 300
75 
 
 70 
 
76 
# A host is banned if it has generated "maxretry" during the last "findtime"
 71 
# A host is banned if it has generated "maxretry" during the last "findtime" seconds.
77 
# seconds.
 - 
 
78 
# Un client est banni dans le cas ou il genere "maxretry" pendant le temps
 72 
# Un client est banni s'il génere "maxretry" requêtes pendant "findtime" (en secondes)
79 
# findtime en seconds
 - 
 
80 
# Ici 5 requetes remplissant les filtres en 60 secondes
 73 
# Pour ALCASAR : 5 requetes pour chaque filtres en 60 secondes
81 
 
 - 
 
82 
findtime  = 60
 74 
findtime  = 60
83 
 
 75 
 
84 
# "maxretry" is the number of failures before a host get banned.
 76 
# "maxretry" is the number of failures before a host get banned.
85 
maxretry = 5
 77 
maxretry = 5
86 
 
 78 
 
Line 92... Line 84...
92 
#          is not installed, Fail2ban will use polling.
 84 
#          is not installed, Fail2ban will use polling.
93 
# polling: uses a polling algorithm which does not require external libraries.
 85 
# polling: uses a polling algorithm which does not require external libraries.
94 
# auto:    will choose Gamin if available and polling otherwise.
 86 
# auto:    will choose Gamin if available and polling otherwise.
95 
backend = auto
 87 
backend = auto
96 
 
 88 
 
97 
 
 - 
 
98 
# This jail corresponds to the standard configuration in Fail2ban 0.6.
 - 
 
99 
# The mail-whois action send a notification e-mail with a whois request
 - 
 
100 
# in the body.
 - 
 
101 
 
 - 
 
102 
 
 - 
 
103 
# Bannissement si Mod_evasive bannie un @IP après 2 interdit par Apache alors BAN sur tous les ports
 89 
# Bannissement sur tous les ports après 2 refus d'Apache (tentative d'accès sur des pages inexistentes)
104 
 
 - 
 
105 
[mod-evasive]
 90 
[alcasar_mod-evasive]
106 
 
 91 
 
107 
enabled = true
 92 
enabled = true
108 
#enabled = false
 93 
#enabled = false
109 
filter = mod-evasive
 94 
filter = mod-evasive
110 
action = iptables-allports[name=mod-evasive]
 95 
action = iptables-allports[name=alcasar_mod-evasive]
111 
logpath = /var/log/httpd/error_log
 96 
logpath = /var/log/httpd/error_log
112 
maxretry = 2
 97 
maxretry = 2
113 
 
 98 
 
114 
# Bannissement pour SSH-Brute-Force
 99 
# Bannissement sur tout les ports après 3 refus de SSH (tentative d'accès par brute-force)
115 
 
 - 
 
116 
[ssh-iptables]
 100 
[ssh-iptables]
117 
 
 101 
 
118 
enabled = true
 102 
enabled = true
119 
#enabled  = false
 103 
#enabled  = false
120 
filter   = sshd
 104 
filter   = sshd
121 
action   = iptables-allports[name=SSH]
 105 
action   = iptables-allports[name=SSH]
122 
logpath  = /var/log/auth.log
 106 
logpath  = /var/log/auth.log
123 
maxretry = 3
 107 
maxretry = 3
124 
 
 108 
 
125 
# Bannissement si 5 échec de connexion sur alcasar/acc
 109 
# Bannissement sur tous les ports après 5 échecs de connexion sur le centre de contrôle (ACC)
126 
 
 - 
 
127 
[htdigest]
 110 
[alcasar_htdigest]
128 
 
 111 
 
129 
enabled = true
 112 
enabled = true
130 
#enabled = false
 113 
#enabled = false
131 
filter = htdigest
 114 
filter = htdigest
132 
action = iptables-allports[name=htdigest]
 115 
action = iptables-allports[name=alcasar_htdigest]
133 
logpath = /var/log/httpd/ssl_error_log
 116 
logpath = /var/log/httpd/ssl_error_log
134 
maxretry = 5
 117 
maxretry = 5
135 
 
 118 
 
136 
# Bannissement si 5 echec de connexion sur intercept.php (reason=reject)
 119 
# Bannissement sur tout les ports après 5 echecs de connexion pour un usager
137 
 
 - 
 
138 
[intercept]
 120 
[alcasar_intercept]
139 
 
 121 
 
140 
enabled = true
 122 
enabled = true
141 
#enabled = false
 123 
#enabled = false
142 
filter = intercept
 124 
filter = intercept
143 
action = iptables-allports[name=intercept]
 125 
action = iptables-allports[name=alcasar_intercept]
144 
logpath = /var/log/httpd/ssl_request_log
 126 
logpath = /var/log/httpd/ssl_request_log
145 
maxretry = 5
 127 
maxretry = 5
146 
 
 128 
 
147 
# Bannissement si 5 tentatives de changement de mot de passe en moins de 1 min
 129 
# Bannissement sur tout les port après 5 échecs de changement de mot de passe
148 
# 5 POST pour changer le mot de passe que le POST soit ok ou non.
 130 
# 5 POST pour changer le mot de passe que le POST soit ok ou non.
149 
 
 - 
 
150 
[mot_de_passe]
 131 
[alcasar_change-password]
151 
 
 132 
 
152 
enabled = true
 133 
enabled = true
153 
#enabled = false
 134 
#enabled = false
154 
filter = mot_de_passe
 135 
filter = mot_de_passe
155 
action = iptables-allports[name=Mot_de_Passe]
 136 
action = iptables-allports[name=alcasar_change-password]
156 
logpath = /var/log/httpd/ssl_request_log
 137 
logpath = /var/log/httpd/ssl_request_log
157 
maxretry = 5
 138 
maxretry = 5
158 
 
 - 
 
159 
 
 - 
 
160 
[proftpd-iptables]
 - 
 
161 
 
 - 
 
162 
enabled  = false
 - 
 
163 
filter   = proftpd
 - 
 
164 
action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
 - 
 
165 
           sendmail-whois[name=ProFTPD, dest=you@example.com]
 - 
 
166 
logpath  = /var/log/proftpd/proftpd.log
 - 
 
167 
maxretry = 6
 - 
 
168 
 
 - 
 
169 
# This jail forces the backend to "polling".
 - 
 
170 
 
 - 
 
171 
[sasl-iptables]
 - 
 
172 
 
 - 
 
173 
enabled  = false
 - 
 
174 
filter   = sasl
 - 
 
175 
backend  = polling
 - 
 
176 
action   = iptables[name=sasl, port=smtp, protocol=tcp]
 - 
 
177 
           sendmail-whois[name=sasl, dest=you@example.com]
 - 
 
178 
logpath  = /var/log/mail.log
 - 
 
179 
 
 - 
 
180 
# Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
 - 
 
181 
# used to avoid banning the user "myuser".
 - 
 
182 
 
 - 
 
183 
[ssh-tcpwrapper]
 - 
 
184 
 
 - 
 
185 
enabled     = false
 - 
 
186 
filter      = sshd
 - 
 
187 
action      = hostsdeny
 - 
 
188 
              sendmail-whois[name=SSH, dest=you@example.com]
 - 
 
189 
ignoreregex = for myuser from
 - 
 
190 
logpath     = /var/log/auth.log
 - 
 
191 
 
 - 
 
192 
# This jail demonstrates the use of wildcards in "logpath".
 - 
 
193 
# Moreover, it is possible to give other files on a new line.
 - 
 
194 
 
 - 
 
195 
[apache-tcpwrapper]
 - 
 
196 
 
 - 
 
197 
enabled  = false
 - 
 
198 
filter	 = apache-auth
 - 
 
199 
action   = hostsdeny
 - 
 
200 
logpath  = /var/log/apache*/*error.log
 - 
 
201 
           /home/www/myhomepage/error.log
 - 
 
202 
maxretry = 6
 - 
 
203 
 
 - 
 
204 
# The hosts.deny path can be defined with the "file" argument if it is
 - 
 
205 
# not in /etc.
 - 
 
206 
 
 - 
 
207 
[postfix-tcpwrapper]
 - 
 
208 
 
 - 
 
209 
enabled  = false
 - 
 
210 
filter   = postfix
 - 
 
211 
action   = hostsdeny[file=/not/a/standard/path/hosts.deny]
 - 
 
212 
           sendmail[name=Postfix, dest=you@example.com]
 - 
 
213 
logpath  = /var/log/postfix.log
 - 
 
214 
bantime  = 300
 - 
 
215 
 
 - 
 
216 
# Do not ban anybody. Just report information about the remote host.
 - 
 
217 
# A notification is sent at most every 600 seconds (bantime).
 - 
 
218 
 
 - 
 
219 
[vsftpd-notification]
 - 
 
220 
 
 - 
 
221 
enabled  = false
 - 
 
222 
filter   = vsftpd
 - 
 
223 
action   = sendmail-whois[name=VSFTPD, dest=you@example.com]
 - 
 
224 
logpath  = /var/log/vsftpd.log
 - 
 
225 
maxretry = 5
 - 
 
226 
bantime  = 1800
 - 
 
227 
 
 - 
 
228 
# Same as above but with banning the IP address.
 - 
 
229 
 
 - 
 
230 
[vsftpd-iptables]
 - 
 
231 
 
 - 
 
232 
enabled  = false
 - 
 
233 
filter   = vsftpd
 - 
 
234 
action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
 - 
 
235 
           sendmail-whois[name=VSFTPD, dest=you@example.com]
 - 
 
236 
logpath  = /var/log/vsftpd.log
 - 
 
237 
maxretry = 5
 - 
 
238 
bantime  = 1800
 - 
 
239 
 
 - 
 
240 
# Ban hosts which agent identifies spammer robots crawling the web
 - 
 
241 
# for email addresses. The mail outputs are buffered.
 - 
 
242 
 
 - 
 
243 
[apache-badbots]
 - 
 
244 
 
 - 
 
245 
enabled  = false
 - 
 
246 
filter   = apache-badbots
 - 
 
247 
action   = iptables-multiport[name=BadBots, port="http,https"]
 - 
 
248 
           sendmail-buffered[name=BadBots, lines=5, dest=you@example.com]
 - 
 
249 
logpath  = /var/www/*/logs/access_log
 - 
 
250 
bantime  = 172800
 - 
 
251 
maxretry = 1
 - 
 
252 
 
 - 
 
253 
# Use shorewall instead of iptables.
 - 
 
254 
 
 - 
 
255 
[apache-shorewall]
 - 
 
256 
 
 - 
 
257 
enabled  = false
 - 
 
258 
filter   = apache-noscript
 - 
 
259 
action   = shorewall
 - 
 
260 
           sendmail[name=Postfix, dest=you@example.com]
 - 
 
261 
logpath  = /var/log/apache2/error_log
 - 
 
262 
 
 - 
 
263 
# Ban attackers that try to use PHP's URL-fopen() functionality
 - 
 
264 
# through GET/POST variables. - Experimental, with more than a year
 - 
 
265 
# of usage in production environments.
 - 
 
266 
 
 - 
 
267 
[php-url-fopen]
 - 
 
268 
 
 - 
 
269 
enabled = false
 - 
 
270 
port    = http,https
 - 
 
271 
filter  = php-url-fopen
 - 
 
272 
logpath = /var/www/*/logs/access_log
 - 
 
273 
maxretry = 1
 - 
 
274 
 
 - 
 
275 
# A simple PHP-fastcgi jail which works with lighttpd.
 - 
 
276 
# If you run a lighttpd server, then you probably will
 - 
 
277 
# find these kinds of messages in your error_log:
 - 
 
278 
# ALERT – tried to register forbidden variable ‘GLOBALS’
 - 
 
279 
# through GET variables (attacker '1.2.3.4', file '/var/www/default/htdocs/index.php')
 - 
 
280 
# This jail would block the IP 1.2.3.4.
 - 
 
281 
 
 - 
 
282 
[lighttpd-fastcgi]
 - 
 
283 
 
 - 
 
284 
enabled = false
 - 
 
285 
port    = http,https
 - 
 
286 
filter  = lighttpd-fastcgi
 - 
 
287 
# adapt the following two items as needed
 - 
 
288 
logpath = /var/log/lighttpd/error.log
 - 
 
289 
maxretry = 2
 - 
 
290 
 
 - 
 
291 
# This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
 - 
 
292 
# option is overridden in this jail. Moreover, the action "mail-whois" defines
 - 
 
293 
# the variable "name" which contains a comma using "". The characters '' are
 - 
 
294 
# valid too.
 - 
 
295 
 
 - 
 
296 
[ssh-ipfw]
 - 
 
297 
 
 - 
 
298 
enabled  = false
 - 
 
299 
filter   = sshd
 - 
 
300 
action   = ipfw[localhost=192.168.0.1]
 - 
 
301 
           sendmail-whois[name="SSH,IPFW", dest=you@example.com]
 - 
 
302 
logpath  = /var/log/auth.log
 - 
 
303 
ignoreip = 168.192.0.1
 - 
 
304 
 
 - 
 
305 
# These jails block attacks against named (bind9). By default, logging is off
 - 
 
306 
# with bind9 installation. You will need something like this:
 - 
 
307 
#
 - 
 
308 
# logging {
 - 
 
309 
#     channel security_file {
 - 
 
310 
#         file "/var/log/named/security.log" versions 3 size 30m;
 - 
 
311 
#         severity dynamic;
 - 
 
312 
#         print-time yes;
 - 
 
313 
#     };
 - 
 
314 
#     category security {
 - 
 
315 
#         security_file;
 - 
 
316 
#     };
 - 
 
317 
# };
 - 
 
318 
#
 - 
 
319 
# in your named.conf to provide proper logging.
 - 
 
320 
# This jail blocks UDP traffic for DNS requests.
 - 
 
321 
 
 - 
 
322 
# !!! WARNING !!!
 - 
 
323 
#   Since UDP is connection-less protocol, spoofing of IP and imitation
 - 
 
324 
#   of illegal actions is way too simple.  Thus enabling of this filter
 - 
 
325 
#   might provide an easy way for implementing a DoS against a chosen
 - 
 
326 
#   victim. See
 - 
 
327 
#    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
 - 
 
328 
#   Please DO NOT USE this jail unless you know what you are doing.
 - 
 
329 
#
 - 
 
330 
# [named-refused-udp]
 - 
 
331 
#
 - 
 
332 
# enabled  = false
 - 
 
333 
# filter   = named-refused
 - 
 
334 
# action   = iptables-multiport[name=Named, port="domain,953", protocol=udp]
 - 
 
335 
#            sendmail-whois[name=Named, dest=you@example.com]
 - 
 
336 
# logpath  = /var/log/named/security.log
 - 
 
337 
# ignoreip = 168.192.0.1
 - 
 
338 
 
 - 
 
339 
# This jail blocks TCP traffic for DNS requests.
 - 
 
340 
 
 - 
 
341 
[named-refused-tcp]
 - 
 
342 
 
 - 
 
343 
enabled  = false
 - 
 
344 
filter   = named-refused
 - 
 
345 
action   = iptables-multiport[name=Named, port="domain,953", protocol=tcp]
 - 
 
346 
           sendmail-whois[name=Named, dest=you@example.com]
 - 
 
347 
logpath  = /var/log/named/security.log
 - 
 
348 
ignoreip = 168.192.0.1
 - 
 
349 
 
 - 
 
350 
EOF
 139 
EOF
351 
 
 140 
 
352 
###########################################
 141 
##################################################
353 
## Mise en place des filters spécifiques ##
 142 
## Mise en place des filtres spécifiques	##
354 
## - Mod_evasive.conf                    ##
 143 
## - Mod_evasive.conf				##
355 
## - htdigest.conf                       ##
 144 
## - htdigest.conf                      	##
356 
## -
145 
## - intercept.conf				##
357 
## -
146 
## - mot de passe				##
358 
###########################################
 147 
##################################################
359 
 
 148 
 
360 
######################
 149 
######################
361 
## MOD-EVASIVE.CONF ##
 150 
## MOD-EVASIVE.CONF ##
362 
######################
 151 
######################
363 
 
 - 
 
364 
if (test -f $DIR_FILTER/mod-evasive.conf)
 - 
 
365 
then
 - 
 
366 
	mv $DIR_FILTER/mod-evasive.conf $DIR_FILTER/mod-evasive.conf.old
 - 
 
367 
fi
 - 
 
368 
 
 - 
 
369 
cat << EOF > $DIR_FILTER/mod-evasive.conf
 152 
cat << EOF > $DIR_FILTER/alcasar_mod-evasive.conf
370 
# Fail2Ban configuration file
 153 
# Fail2Ban configuration file
371 
#
 154 
#
372 
# Author: Cyril Jaquier
 155 
# Author: Cyril Jaquier
373 
#
 - 
 
374 
# $Revision$
 156 
# Adapted by ALCASAR team
375 
#
 - 
 
376 
 
 157 
 
377 
[Definition]
 158 
[Definition]
378 
 
 159 
 
379 
# Option:  failregex
 160 
# Option:  failregex
380 
# Notes.:  regex to match the password failure messages in the logfile. The
 161 
# Notes.:  regex to match the password failure messages in the logfile. The
Line 393... Line 174...
393 
EOF
 174 
EOF
394 
 
 175 
 
395 
###################
 176 
###################
396 
## HTDIGEST.CONF ##
 177 
## HTDIGEST.CONF ##
397 
###################
 178 
###################
398 
 
 - 
 
399 
if ( test -f $DIR_FILTER/htdigest.conf)
 - 
 
400 
then
 - 
 
401 
	mv $DIR_FILTER/htdigest.conf $DIR_FILTER/htdigest.conf.old
 - 
 
402 
fi
 - 
 
403 
 
 - 
 
404 
cat << EOF > $DIR_FILTER/htdigest.conf
 179 
cat << EOF > $DIR_FILTER/alcasar_htdigest.conf
405 
# Fail2Ban configuration file
 180 
# Fail2Ban configuration file
406 
#
 181 
#
407 
# Author: Cyril Jaquier
 182 
# Author: Cyril Jaquier
408 
#
 - 
 
409 
# $Revision$
 183 
# Adapted by ALCASAR team
410 
#
 - 
 
411 
 
 184 
 
412 
[Definition]
 185 
[Definition]
413 
 
 186 
 
414 
# Option:  failregex
 187 
# Option:  failregex
415 
# Notes.:  regex to match the password failure messages in the logfile. The
 188 
# Notes.:  regex to match the password failure messages in the logfile. The
Line 428... Line 201...
428 
EOF
 201 
EOF
429 
 
 202 
 
430 
####################
 203 
####################
431 
## INTERCEPT.CONF ##
 204 
## INTERCEPT.CONF ##
432 
####################
 205 
####################
433 
 
 - 
 
434 
if ( test -f $DIR_FILTER/intercept.conf)
 - 
 
435 
then
 - 
 
436 
	mv $DIR_FILTER/intercept.conf $DIR_FILTER/intercept.conf.old
 - 
 
437 
fi
 - 
 
438 
 
 - 
 
439 
cat << EOF > $DIR_FILTER/intercept.conf
 206 
cat << EOF > $DIR_FILTER/alcasar_intercept.conf
440 
 
 - 
 
441 
# Fail2Ban configuration file
 207 
# Fail2Ban configuration file
442 
#
 208 
#
443 
# Author: Cyril Jaquier
 209 
# Author: Cyril Jaquier
444 
#
 - 
 
445 
# $Revision$
 210 
# Adapted by ALCASAR team
446 
#
 - 
 
447 
 
 211 
 
448 
[Definition]
 212 
[Definition]
449 
 
 213 
 
450 
# Option:  failregex
 214 
# Option:  failregex
451 
# Notes.:  regex to match the password failure messages in the logfile. The
 215 
# Notes.:  regex to match the password failure messages in the logfile. The
Line 464... Line 228...
464 
EOF
 228 
EOF
465 
 
 229 
 
466 
#######################
 230 
#######################
467 
## MOT_DE_PASSE.CONF ##
 231 
## MOT_DE_PASSE.CONF ##
468 
#######################
 232 
#######################
469 
 
 - 
 
470 
if ( test -f $DIR_FILTER/mot_de_passe.conf )
 - 
 
471 
then
 - 
 
472 
	mv $DIR_FILTER/mot_de_passe.conf $DIR_FILTER/mot_de_passe.conf.old
 - 
 
473 
fi
 - 
 
474 
 
 - 
 
475 
cat << EOF > $DIR_FILTER/mot_de_passe.conf
 233 
cat << EOF > $DIR_FILTER/alcasar_change-password.conf
476 
 
 234 
 
477 
# Fail2Ban configuration file
 235 
# Fail2Ban configuration file
478 
#
 236 
#
479 
# Author: Cyril Jaquier
 237 
# Author: Cyril Jaquier
480 
#
 - 
 
481 
# $Revision$
 238 
# Adapted by ALCASAR team
482 
#
 - 
 
483 
 
 239 
 
484 
[Definition]
 240 
[Definition]
485 
 
 241 
 
486 
# Option:  failregex
 242 
# Option:  failregex
487 
# Notes.:  regex to match the password failure messages in the logfile. The
 243 
# Notes.:  regex to match the password failure messages in the logfile. The
Line 497... Line 253...
497 
# Values:  TEXT
 253 
# Values:  TEXT
498 
#
 254 
#
499 
ignoreregex =
255 
ignoreregex =
500 
EOF
 256 
EOF
501 
 
 257 
 
502 
 
 - 
 
503 
##############################################
 258 
##############################################
504 
## Log sur Iptables quand iptables-allports ##
 259 
##   Log sur ULOG quand iptables-allports   ##
505 
##############################################
 260 
##############################################
506 
 
 - 
 
507 
if ( test -f $ACTION_ALLPORTS )
 261 
if ( test -f $ACTION_ALLPORTS )
508 
then
 262 
then
509 
	mv $ACTION_ALLPORTS $ACTION_ALLPORTS.old
 263 
	mv $ACTION_ALLPORTS $ACTION_ALLPORTS.default
510 
fi
 264 
fi
511 
 
 - 
 
512 
cat << EOF > $ACTION_ALLPORTS
 265 
cat << EOF > $ACTION_ALLPORTS
513 
 
 - 
 
514 
# Fail2Ban configuration file
 266 
# Fail2Ban configuration file
515 
#
 267 
#
516 
# Author: Cyril Jaquier
 268 
# Author: Cyril Jaquier
517 
# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
 269 
# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
518 
# 			made active on all ports from original iptables.conf
 270 
# 			made active on all ports from original iptables.conf
519 
#
 - 
 
520 
# $Revision$
 271 
# Adapted by ALCASAR team
521 
#
 - 
 
522 
 
 272 
 
523 
[Definition]
 273 
[Definition]
524 
 
 274 
 
525 
# Option:  actionstart
 275 
# Option:  actionstart
526 
# Notes.:  command executed once at the start of Fail2Ban.
 276 
# Notes.:  command executed once at the start of Fail2Ban.
Line 583... Line 333...
583 
#          added
 333 
#          added
584 
# Values:  STRING  Default: INPUT
 334 
# Values:  STRING  Default: INPUT
585 
chain = INPUT
 335 
chain = INPUT
586 
 
 336 
 
587 
EOF
 337 
EOF
588 
 
 - 
 
589 
#Activation de l'unité
 - 
 
590 
systemctl enable fail2ban.service
 -