On 17/Apr/10 19:58, Jan Engelhardt wrote:
On Saturday 2010-04-17 18:01, Alessandro Vesely wrote:
fail2ban has the ability - if I read its own short description right - to already use various blocking methods, including not only /etc/hosts.deny but also iptables.
I don't think it uses netfilter, though. I've read it has to restart a daemon in order to unlist an IP --not sure it's still so for the current version.
Better know than think.
The bit I had read is "You currently have to restart the daemon to
unban." in http://www.fail2ban.org/wiki/index.php/Features#0.9.0
However, reading slightly more carefully, that's about _manually_
unbanning an IP (e.g. a misconfigured client that locked out the whole
office behind its NAT.)
N.B.: If what http://en.wikipedia.org/wiki/Fail2ban says is not correct, by all means you should correct it.
Besides, if it is accurate, it uses iptables, not directly Netfilter.
Correct. Browsing action.d/iptables.conf one finds
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <failures> number of failures
# <time> unix timestamp of the ban time
# Values: CMD
#
actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
# Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <failures> number of failures
# <time> unix timestamp of the ban time
# Values: CMD
#
actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
I think the daemon just executes those commands, after replacing the
tags. I don't know whether fail2ban uses some other storage to
remember frequently banned IPs.
How would you compare iptables and netfilter? I mean fail2ban actions
versus looking up a b-tree file, in terms of rough memory consumption
and responsiveness expectations? For the max number of entries, I
reckon b-trees can allow to map the entire IPv4 address space within
1Tb of mass storage. But what might be the difference with usual volumes?
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
