NAME

mf2b.conf - micro fail2ban configuration file format

DESCRIPTION

The configuration file for mf2b specifies which log files are to be watched for new entries and how to react on them. It defines how interesting entries look like, how many of them have to occur in what period of time and what commands are to be executed upon reaching the configured limit and when free "slots" become available.

OPTIONS

ban command

What to execute upon reaching the threshold. In command , subpatterns may be accessed using $1 to $n.

limit n

The threshold value, i.e. how many matching log entries must occur before action is taken. The parameter n is a positive number.

match expression

This defines how an interesting line in the given log file must look like to be accounted for. Note that subpatterns (i.e., parts of the expression enclosed in braces) must match in order for the log entry to be assumed as ´equal´.

timeout n

The timeout of log matching log entries in seconds, i.e. how old a log entry may become in order to still be accounted to limit.

unban command

What to execute when the threshold is underrun, i.e. when the number of matching log entries that occured in the last timeout seconds becomes lower than limit. In command , subpatterns may be accessed using $1 to $n.

{ ... }

The curly braces denote a confined set of configuration options for (a set of) log files. They have to be preceeded by one or more log files.

EXAMPLES

# default options
limit 3
timeout 60
ban "iptables -A f2b -s $1 -j DROP"
unban "iptables -D f2b -s $1 -j DROP"
# check for login failures via SSH
/var/log/auth.log /var/log/messages {
match "sshd.*: Invalid user .* from \(.+\)"
}
# check for "security scanners" checking vulnerable URLs
/var/log/lighttpd/access.log {
match "::ffff:\(.+\) .* \"GET /w00tw00t\.at\..*"
# this overrides the defaults from above
limit 1
timeout 3600
}

FILES

/etc/mf2b.conf

BUGS

When expanding the variables in the commands from ban/ unban options, common shell escapes are being escaped. This serves as rudimental protection against injection attacks, though one should not rely upon them. So in order to e.g. match an IPV4 address, using something like ´\(\([[:digit:]]\{1,3\}\.\)\{3\}[[:digit:]]\{1,3\}\)´ is far more secure than a simple ´\(.*\)´. Additionally, mf2b is probably best run as unpriviledged user with limited execute permissions.

AUTHOR

Phil Sutter <phil AT nwl DOT cc>

SEE ALSO

mf2b(8) regex(7)