Difference between revisions of "User talk:Lostcontrol"
(New section: Ban time) |
|||
| Line 1: | Line 1: | ||
| + | LostControl, | ||
| + | |||
| + | First let me thank you for fail2ban. It seems great! | ||
| + | |||
| + | I have two suggestions: | ||
| + | |||
| + | 1) Make a "contrib" place for uses to publish their own filters/actions. I've started writing one and would be happy to put it someplace for others to use, but where should I put it? I'd like to see some "contrib" place for unsupported user contributed add-ons. | ||
| + | 2) Some way to tell the program to start banning from the top of the log files. Every time log rotate comes in, all bans are dropped. I'm going to give it a try on this... | ||
| + | |||
| + | John Harris / Dir of IT for ECE @ Virginia Tech / 8 Dec 2008 | ||
| + | |||
| + | ---- | ||
| + | |||
Thanks for fail2ban which I just installed from Mandriva. I made some changes on your Wiki site. | Thanks for fail2ban which I just installed from Mandriva. I made some changes on your Wiki site. | ||
* Your Wiki has been recently open but already (mildly) spammed because of anonymous access. Could fail2ban been used in order to temporarily ban the IP adress of the spammers? It would be great? | * Your Wiki has been recently open but already (mildly) spammed because of anonymous access. Could fail2ban been used in order to temporarily ban the IP adress of the spammers? It would be great? | ||
Revision as of 17:03, 6 December 2008
LostControl,
First let me thank you for fail2ban. It seems great!
I have two suggestions:
1) Make a "contrib" place for uses to publish their own filters/actions. I've started writing one and would be happy to put it someplace for others to use, but where should I put it? I'd like to see some "contrib" place for unsupported user contributed add-ons. 2) Some way to tell the program to start banning from the top of the log files. Every time log rotate comes in, all bans are dropped. I'm going to give it a try on this...
John Harris / Dir of IT for ECE @ Virginia Tech / 8 Dec 2008
Thanks for fail2ban which I just installed from Mandriva. I made some changes on your Wiki site.
- Your Wiki has been recently open but already (mildly) spammed because of anonymous access. Could fail2ban been used in order to temporarily ban the IP adress of the spammers? It would be great?
- Your MediaWiki software version is 1.6.7 (http://fail2ban.sourceforge.net/wiki/index.php?title=Special:Version), it doesn't enable alerts from the Watchlist by email. Shouldn't you upgrade to 1.8.2 or higher. Recent versions have new tables to prevent more from spammers.
--NBrouard 02:13, 9 January 2007 (PST)
Thank you for your contribution.
- Mmmhh... Great idea :) The problem is how to detect a spammer? Reading access_log? This website is hosted by Sourceforge. I'm not sure if I can access Apache logs.
- I really would like to upgrade to 1.8. However, the PHP version on the Sourceforge servers are still 4.x. So I have to stick to 1.6, the latest version that is working with PHP 4 :(
--Lostcontrol 14:42, 9 January 2007 (PST)
Ban time
Is there is something planned about enforcing ban time ? I will take my own server for example, I've got of ssh bruteforce on it, actually from the same IP, it get banned each time, but each time for the same amout of time. It will be great to have a way to enforce ban time, ie, the first time, only 10min, the second time, 30min, the third, 1hour, and for example, the 6th time the IP get a definitive ban.
I think it should be a great thing - Godzil --86.202.142.176 13:51, 9 March 2008 (CET)
