Fail2Ban - IP Adressen speichern (Linux)

Noch in Bearbeitung

Regeln speichern und wiederherstellen

speichern

#!/bin/bash

if [[ -z $1 ]]
then
  echo "Usage: `basename $0` <output file>";
  exit
fi

sudo nft list set ip fail2ban f2b-recidive > $1

wiederherstellen

#!/bin/bash

if [[ -z $1 ]] || ! [[ -f $1 ]]
then
  echo "Usage: `basename $0` <input file>";
  exit
fi

sudo nft flush set ip fail2ban f2b-recidive;

RECIDIVE_SET=`sed -e '/elements =/,/}/!d' $1`;

if [[ -n $RECIDIVE_SET ]]
then
  sudo nft add set ip fail2ban f2b-recidive { type ipv4_addr \; $RECIDIVE_SET \; };
fi

Links

https://manpages.debian.org/testing/nftables/nft.8.en.html

https://wiki.ubuntuusers.de/fail2ban/

Temp

table ip fail2ban {
	set f2b-sasl {
		type ipv4_addr
	}

	set f2b-recidive {
		type ipv4_addr
		elements = { 45.125.65.52, 46.38.148.22,
			     46.38.150.47, 46.38.150.72,
			     46.38.150.132, 141.98.10.192,
			     141.98.10.208, 185.143.72.16,
			     185.143.72.25, 185.143.73.58,
			     185.143.73.93, 185.143.73.148,
			     185.143.73.162, 185.143.73.175,
			     185.143.73.203, 185.143.75.81,
			     185.143.75.153, 185.234.218.83 }
	}

	chain input {
		type filter hook input priority 100; policy accept;
		meta l4proto 0-255 ip saddr @f2b-recidive drop
		tcp dport { smtp, pop3, imap2, imap3, submission, imaps, pop3s } ip saddr @f2b-sasl drop
	}
}

Links

https://arno0x0x.wordpress.com/2015/12/30/fail2ban-permanent-persistent-bans/

Zurück zu Fail2Ban