<div dir="ltr">Good contribution Peter.<br><br>Thanks for sharing.<br><br>73 Kin<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">El vie., 22 may. 2020 a las 9:34, Peter via Dxspider-support (<<a href="mailto:dxspider-support@tobit.co.uk">dxspider-support@tobit.co.uk</a>>) escribió:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi<br>
<br>
I got fail2ban working and blocks IP's via IPtabels or UFW on a debian <br>
linux system.<br>
I make 2 rules to block unwanted behaivor.<br>
<br>
First rule blocks multi conenction to the cluster and use the same call. <br>
This is the result of a bumped off followed by a reconnect.<br>
<br>
Make in jail.d a file named: dxc-bumped.conf with:<br>
[dxc-bumped]<br>
enabled = true<br>
logpath = /spider/local_data/log/2020/05.dat<br>
bantime = 300<br>
maxretry = 1<br>
<br>
One note! check the logpath for the log file and change this every month :-)<br>
<br>
Make in filter.d a file named: dxc-bumped.conf with:<br>
[INCLUDES]<br>
before = common.conf<br>
[Definition]<br>
failregex = bumped off by <HOST>, disconnected$<br>
ignore regex =<br>
<br>
(re)start fail2ban and any reconnection will be lockout for 5 minutes <br>
(300 seconds)<br>
<br>
For a lock out call rules, make 2 new conf files per above with a <br>
differend name and use as failregex:<br>
failregex = on <HOST> is locked out, disconnected$<br>
<br>
Results:<br>
<br>
root@pi4cc:/etc/fail2ban# fail2ban-client status dxc-locked<br>
Status for the jail: dxc-locked<br>
|- Filter<br>
| |- Currently failed: 0<br>
| |- Total failed: 25<br>
| `- File list: /spider/local_data/log/2020/05.dat<br>
`- Actions<br>
|- Currently banned: 2<br>
|- Total banned: 25<br>
`- Banned IP list: 70.61.22.78 78.13.227.246<br>
<br>
root@pi4cc:/etc/fail2ban# fail2ban-client status dxc-bumped<br>
Status for the jail: dxc-bumped<br>
|- Filter<br>
| |- Currently failed: 0<br>
| |- Total failed: 23<br>
| `- File list: /spider/local_data/log/2020/05.dat<br>
`- Actions<br>
|- Currently banned: 1<br>
|- Total banned: 23<br>
`- Banned IP list: 77.250.209.142<br>
<br>
Peter<br>
PC2A<br>
<br>
_______________________________________________<br>
Dxspider-support mailing list<br>
<a href="mailto:Dxspider-support@tobit.co.uk" target="_blank">Dxspider-support@tobit.co.uk</a><br>
<a href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" rel="noreferrer" target="_blank">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a><br>
</blockquote></div>