From 83f7fe4b8402bab171d110703a1b1115efbc9b28 Mon Sep 17 00:00:00 2001 From: Lukasz Kasprzak Date: Tue, 14 Apr 2026 22:32:43 +0200 Subject: cleaned up many scrits and deleted some that were of no use; renamed a lot --- .../fail2ban/etc-fail2ban/action.d/nftables.conf | 203 --------------------- 1 file changed, 203 deletions(-) delete mode 100644 straper/db/public/fail2ban/etc-fail2ban/action.d/nftables.conf (limited to 'straper/db/public/fail2ban/etc-fail2ban/action.d/nftables.conf') diff --git a/straper/db/public/fail2ban/etc-fail2ban/action.d/nftables.conf b/straper/db/public/fail2ban/etc-fail2ban/action.d/nftables.conf deleted file mode 100644 index 3d44fae..0000000 --- a/straper/db/public/fail2ban/etc-fail2ban/action.d/nftables.conf +++ /dev/null @@ -1,203 +0,0 @@ -# Fail2Ban configuration file -# -# Author: Daniel Black -# Author: Cyril Jaquier -# Modified: Yaroslav O. Halchenko -# made active on all ports from original iptables.conf -# Modified: Alexander Belykh -# adapted for nftables -# -# This is a included configuration file and includes the definitions for the nftables -# used in all nftables based actions by default. -# -# The user can override the defaults in nftables-common.local -# Example: redirect flow to honeypot -# -# [Init] -# table_family = ip -# chain_type = nat -# chain_hook = prerouting -# chain_priority = -50 -# blocktype = counter redirect to 2222 - -[INCLUDES] - -after = nftables-common.local - -[Definition] - -# Option: type -# Notes.: type of the action. -# Values: [ multiport | allports ] Default: multiport -# -type = multiport - -rule_match-custom = -rule_match-allports = meta l4proto \{ \} -rule_match-multiport = $proto dport \{ $(echo '' | sed s/:/-/g) \} -match = > - -# Option: rule_stat -# Notes.: statement for nftables filter rule. -# leaving it empty will block all (include udp and icmp) -# Values: nftables statement -# -rule_stat = %(match)s saddr @ - -# optional iterator over protocol's: -_nft_for_proto-custom-iter = -_nft_for_proto-custom-done = -_nft_for_proto-allports-iter = -_nft_for_proto-allports-done = -_nft_for_proto-multiport-iter = for proto in $(echo '' | sed 's/,/ /g'); do -_nft_for_proto-multiport-done = done - -_nft_list = -a list chain -_nft_get_handle_id = grep -oP '@\s+.*\s+\Khandle\s+(\d+)$' - -_nft_add_set = add set
\{ type \; flags interval\; \} - <_nft_for_proto--iter> - add rule
%(rule_stat)s - <_nft_for_proto--done> -_nft_del_set = { %(_nft_list)s | %(_nft_get_handle_id)s; } | while read -r hdl; do - delete rule
$hdl; done - delete set
- -# Option: _nft_shutdown_table -# Notes.: command executed after the stop in order to delete table (it checks that no sets are available): -# Values: CMD -# -_nft_shutdown_table = { list table
| grep -qP '^\s+set\s+'; } || { - delete table
- } - -# Option: actionstart -# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). -# Values: CMD -# -actionstart = add table
- -- add chain
\{ type hook priority \; \} - %(_nft_add_set)s - -# Option: actionflush -# Notes.: command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action); -# uses `nft flush set ...` and as fallback (e. g. unsupported) recreates the set (with references) -# Values: CMD -# -actionflush = { flush set
2> /dev/null; } || { - %(_nft_del_set)s - %(_nft_add_set)s - } - -# Option: actionstop -# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) -# Values: CMD -# -actionstop = %(_nft_del_set)s - <_nft_shutdown_table> - -# Option: actioncheck -# Notes.: command executed once before each actionban command -# Values: CMD -# -actioncheck = list chain
| grep -q '@[ \t]' - -# Option: actionban -# Notes.: command executed when banning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionban = add element
\{ \} - -# Option: actionunban -# Notes.: command executed when unbanning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionunban = delete element
\{ \} - -[Init] - -# Option: table -# Notes.: main table to store chain and sets (automatically created on demand) -# Values: STRING Default: f2b-table -table = f2b-table - -# Option: table_family -# Notes.: address family to work in -# Values: [ip | ip6 | inet] Default: inet -table_family = inet - -# Option: chain -# Notes.: main chain to store rules -# Values: STRING Default: f2b-chain -chain = f2b-chain - -# Option: chain_type -# Notes.: refers to the kind of chain to be created -# Values: [filter | route | nat] Default: filter -# -chain_type = filter - -# Option: chain_hook -# Notes.: refers to the kind of chain to be created -# Values: [ prerouting | input | forward | output | postrouting ] Default: input -# -chain_hook = input - -# Option: chain_priority -# Notes.: priority in the chain. -# Values: NUMBER Default: -1 -# -chain_priority = -1 - -# Option: addr_type -# Notes.: address type to work with -# Values: [ipv4_addr | ipv6_addr] Default: ipv4_addr -# -addr_type = ipv4_addr - -# Default name of the filtering set -# -name = default - -# Option: port -# Notes.: specifies port to monitor -# Values: [ NUM | STRING ] Default: -# -port = ssh - -# Option: protocol -# Notes.: internally used by config reader for interpolations. -# Values: [ tcp | udp ] Default: tcp -# -protocol = tcp - -# Option: blocktype -# Note: This is what the action does with rules. This can be any jump target -# as per the nftables man page (section 8). Common values are drop, -# reject, reject with icmpx type host-unreachable, redirect to 2222 -# Values: STRING -blocktype = reject - -# Option: nftables -# Notes.: Actual command to be executed, including common to all calls options -# Values: STRING -nftables = nft - -# Option: addr_set -# Notes.: The name of the nft set used to store banned addresses -# Values: STRING -addr_set = addr-set- - -# Option: addr_family -# Notes.: The family of the banned addresses -# Values: [ ip | ip6 ] -addr_family = ip - -[Init?family=inet6] -addr_family = ip6 -addr_type = ipv6_addr -addr_set = addr6-set- -- cgit v1.3