[arch-general] fail2ban archlinux

[u34 at net9.ga]

Maykel Franco via arch-general <arch-general at lists.archlinux.org> wrote:

> Hi, I've configured fail2ban with action, filter for my php application.
> 
> My app output log like this:
> 
> unknown user foo (192.x.x.x)
> 
> My jail conf:
> 
> [php-app-login]
> enabled = true
> port = 80
> protocol = tcp
> filter = php-app-login
> logpath = /var/www/php-app-login/var/logs/dev.log
> findtime = 3600
> bantime = 86400
> maxretry = 3
> ignoreip  = 127.0.0.1/8
> 
> My filter definition:
> 
> [Definition]
> 
> failregex = unknown user .* \(<HOST>\)
> ignoreregex =
> 
> It works well, but I like fail2ban add comment in iptables rule when add ban IP.
> 
> For example:
> 
> iptables -A INPUT -p tcp --dport 80 -m comment --comment "Ban foo" -j DROP
> 
> iptables -L -n -v
> 
> Chain INPUT (policy ACCEPT 94 packets, 23457 bytes)
>  pkts bytes target     prot opt in     out     source
> destination
>     0     0 DROP       tcp  --  *      *       0.0.0.0/0
> 0.0.0.0/0            tcp dpt:80 /* Ban foo */
> 
> I've googled and I think something needs to be changed in action but I
> can't find how to pass the user variable to that action.

Something along the following lines, though I could be wrong, or
incomplete. Create a local, customized, action.d/iptables-multiport.local
where:
1. you set up the rule with the commment?
2. if I understood you correctly, a possible alternative for the comment
   would be to have a dedicated chain. 

    [Definition]
    # Have a dedicated chain for php-app-login.
    # f2b-php-app-login is expected to exists. Possibly set up by whatever
    # sets iptables.
    actionstart =
    actionstop  = iptables -F f2b-<name> 

Again, I could be wrong, or incomplete.

--
u34