115 lines
3.2 KiB
Plaintext
115 lines
3.2 KiB
Plaintext
|
# Fail2Ban configuration file
|
||
|
|
#
|
||
|
|
# Author: Andrew St. Jean
|
||
|
|
#
|
||
|
|
# Use nsupdate to perform dynamic DNS updates on a BIND zone file.
|
||
|
|
# One may want to do this to update a local RBL with banned IP addresses.
|
||
|
|
#
|
||
|
|
# Options
|
||
|
|
#
|
||
|
|
# domain DNS domain that will appear in nsupdate add and delete
|
||
|
|
# commands.
|
||
|
|
#
|
||
|
|
# ttl The time to live (TTL) in seconds of the TXT resource
|
||
|
|
# record.
|
||
|
|
#
|
||
|
|
# rdata Data portion of the TXT resource record.
|
||
|
|
#
|
||
|
|
# nsupdatecmd Full path to the nsupdate command.
|
||
|
|
#
|
||
|
|
# keyfile Full path to TSIG key file used for authentication between
|
||
|
|
# nsupdate and BIND.
|
||
|
|
#
|
||
|
|
# Create an nsupdate.local to set at least the <domain> and <keyfile>
|
||
|
|
# options as they don't have default values.
|
||
|
|
#
|
||
|
|
# The ban and unban commands assume nsupdate will authenticate to the BIND
|
||
|
|
# server using a TSIG key. The full path to the key file must be specified
|
||
|
|
# in the <keyfile> parameter. Use this command to generate your TSIG key.
|
||
|
|
#
|
||
|
|
# dnssec-keygen -a HMAC-MD5 -b 256 -n HOST <key_name>
|
||
|
|
#
|
||
|
|
# Replace <key_name> with some meaningful name.
|
||
|
|
#
|
||
|
|
# This command will generate two files. Specify the .private file in the
|
||
|
|
# <keyfile> option. Note that the .key file must also be present in the same
|
||
|
|
# directory for nsupdate to use the key.
|
||
|
|
#
|
||
|
|
# Don't forget to add the key and appropriate allow-update or update-policy
|
||
|
|
# option to your named.conf file.
|
||
|
|
#
|
||
|
|
|
||
|
|
[Definition]
|
||
|
|
|
||
|
|
# Option: actionstart
|
||
|
|
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
|
||
|
|
# Values: CMD
|
||
|
|
#
|
||
|
|
actionstart =
|
||
|
|
|
||
|
|
|
||
|
|
# Option: actionstop
|
||
|
|
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
||
|
|
# Values: CMD
|
||
|
|
#
|
||
|
|
actionstop =
|
||
|
|
|
||
|
|
|
||
|
|
# Option: actioncheck
|
||
|
|
# Notes.: command executed once before each actionban command
|
||
|
|
# Values: CMD
|
||
|
|
#
|
||
|
|
actioncheck =
|
||
|
|
|
||
|
|
# Option: actionban
|
||
|
|
# Notes.: command executed when banning an IP. Take care that the
|
||
|
|
# command is executed with Fail2Ban user rights.
|
||
|
|
# Tags: See jail.conf(5) man page
|
||
|
|
# Values: CMD
|
||
|
|
#
|
||
|
|
actionban = echo <ip> | awk -F. '{print "prereq nxrrset "$4"."$3"."$2"."$1".<domain> TXT"; print "update add "$4"."$3"."$2"."$1".<domain> <ttl> IN TXT \"<rdata>\""; print "send"}' | <nsupdatecmd> -k <keyfile>
|
||
|
|
|
||
|
|
# Option: actionunban
|
||
|
|
# Notes.: command executed when unbanning an IP. Take care that the
|
||
|
|
# command is executed with Fail2Ban user rights.
|
||
|
|
# Tags: See jail.conf(5) man page
|
||
|
|
# Values: CMD
|
||
|
|
#
|
||
|
|
actionunban = echo <ip> | awk -F. '{print "update delete "$4"."$3"."$2"."$1".<domain>"; print "send"}' | <nsupdatecmd> -k <keyfile>
|
||
|
|
|
||
|
|
[Init]
|
||
|
|
|
||
|
|
# Option: domain
|
||
|
|
# Notes.: DNS domain that nsupdate will update.
|
||
|
|
# Values: STRING
|
||
|
|
#
|
||
|
|
domain =
|
||
|
|
|
||
|
|
# Option: ttl
|
||
|
|
# Notes.: time to live (TTL) in seconds of TXT resource record
|
||
|
|
# added by nsupdate.
|
||
|
|
# Values: NUM
|
||
|
|
#
|
||
|
|
ttl = 60
|
||
|
|
|
||
|
|
# Option: rdata
|
||
|
|
# Notes.: data portion of the TXT resource record added by nsupdate.
|
||
|
|
# Values: STRING
|
||
|
|
#
|
||
|
|
rdata = Your IP has been banned
|
||
|
|
|
||
|
|
# Option: nsupdatecmd
|
||
|
|
# Notes.: specifies the full path to the nsupdate program that dynamically
|
||
|
|
# updates BIND zone files.
|
||
|
|
# Values: CMD
|
||
|
|
#
|
||
|
|
nsupdatecmd = /usr/bin/nsupdate
|
||
|
|
|
||
|
|
# Option: keyfile
|
||
|
|
# Notes.: specifies the full path to the file containing the
|
||
|
|
# TSIG key for communicating with BIND.
|
||
|
|
# Values: STRING
|
||
|
|
#
|
||
|
|
keyfile =
|
||
|
|
|