From 785fb9698bb823dfeb87d0c6dba4625390085f50 Mon Sep 17 00:00:00 2001
From: Mr Chen <midoks@163.com>
Date: Fri, 18 Oct 2024 22:32:11 +0800
Subject: [PATCH] update

---
 plugins/fail2ban/tpl/fail2ban.d/default.conf | 25 +++++++++++++++++++-
 plugins/fail2ban/tpl/jail.d/sshd.conf        | 11 +++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 plugins/fail2ban/tpl/jail.d/sshd.conf

diff --git a/plugins/fail2ban/tpl/fail2ban.d/default.conf b/plugins/fail2ban/tpl/fail2ban.d/default.conf
index 8c8eecbc8..378ff9dff 100644
--- a/plugins/fail2ban/tpl/fail2ban.d/default.conf
+++ b/plugins/fail2ban/tpl/fail2ban.d/default.conf
@@ -1,2 +1,25 @@
 [DEFAULT]
-allowipv6 = auto
\ No newline at end of file
+allowipv6 = auto
+
+action_ = %(banaction)s[port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+
+action_mw = %(action_)s
+            %(mta)s-whois[sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]
+
+action_mwl = %(action_)s
+             %(mta)s-whois-lines[sender="%(sender)s", dest="%(destemail)s", logpath="%(logpath)s", chain="%(chain)s"]
+
+action_xarf = %(action_)s
+             xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath="%(logpath)s", port="%(port)s"]
+
+action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
+                %(mta)s-whois-lines[sender="%(sender)s", dest="%(destemail)s", logpath="%(logpath)s", chain="%(chain)s"]
+
+action_blocklist_de  = blocklist_de[email="%(sender)s", service="%(__name__)s", apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"]
+
+action_badips = badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"]
+action_badips_report = badips[category="%(__name__)s", agent="%(fail2ban_agent)s"]
+
+action_abuseipdb = abuseipdb
+
+action = %(action_)s
\ No newline at end of file
diff --git a/plugins/fail2ban/tpl/jail.d/sshd.conf b/plugins/fail2ban/tpl/jail.d/sshd.conf
new file mode 100644
index 000000000..f3e3b9fd9
--- /dev/null
+++ b/plugins/fail2ban/tpl/jail.d/sshd.conf
@@ -0,0 +1,11 @@
+#sshd-START
+[sshd]
+enabled = true
+filter = sshd
+port = 2022,no
+maxretry = 5
+findtime = 300
+bantime = 86400
+action = %(action_mwl)s
+logpath = /var/log/auth.log
+#sshd-END
\ No newline at end of file