diff --git a/README.md b/README.md index 39e9912..855545c 100644 --- a/README.md +++ b/README.md @@ -11,15 +11,14 @@ * Use the following for configuring uwsgi in rc.conf - sudo sysrc uwsgi\_enable="YES" - sudo sysrc uwsgi\_profiles="jail2ban\_pf" - sudo sysrc uwsgi\_jail2ban\_pf\_flags="-L -M --uid \_jail2ban --python-path /opt/jail2ban-pf --wsgi-file /opt/jail2ban-pf/wsgi.py --stats 127.0.0.1:9191 --socket 127.0.0.1:3031 --chdir /var/empty --callable app --manage-script-name" + sudo sysrc uwsgi\_enable="YES" + sudo sysrc uwsgi\_profiles="jail2ban\_pf" + sudo sysrc uwsgi\_jail2ban\_pf\_flags="-L -M --uid \_jail2ban --python-path /opt/jail2ban-pf --wsgi-file /opt/jail2ban-pf/wsgi.py --stats 127.0.0.1:9191 --socket 127.0.0.1:3031 --chdir /var/empty --callable app --manage-script-name" * Configure /instance/config.py - SECRET\_KEY = os.urandom(32).hex() - AUTHFILE = '/usr/local/etc/jail2ban-pf-users.txt' - + SECRET\_KEY = os.urandom(32).hex() + AUTHFILE = '/usr/local/etc/jail2ban-pf-users.txt' * Configure a nginx upstream and vhost @@ -46,35 +45,35 @@ _Of course you can listen on ipv4/ipv6 but you want to protect these addresses f * Place anchors in pf for jail2ban to use - anchor "f2b/*" - anchor f2b-jail { - anchor "jail1_fqdn" to { , , } - anchor "jail2_fqdn" to { , , } - anchor "jail3_fqdn" to { , , } - } + anchor "f2b/*" + anchor f2b-jail { + anchor "jail1_fqdn" to { , , } + anchor "jail2_fqdn" to { , , } + anchor "jail3_fqdn" to { , , } + } Having seperate anchors per jail makes it possible to have fine grained blocking: Something that is harmful to jail2 might be perfectly legit for jail2. Fail2ban will (re)create the per anchor rules on startup, and populate the designated address tables with offenders, e.g.: - sudo pfctl -a f2b-jail/jail1\_fqdn -T show -t f2b-recidive - 192.0.2.66 - 2001:db8:abad:cafe:0bad:f00d + sudo pfctl -a f2b-jail/jail1\_fqdn -T show -t f2b-recidive + 192.0.2.66 + 2001:db8:abad:cafe:0bad:f00d And the rules referencing these tables - sudo pfctl -a 'f2b-jail/jail1\_fqdn' -s rules - block drop quick proto tcp from to any port = pop3 - block drop quick proto tcp from to any port = pop3s - block drop quick proto tcp from to any port = imap - block drop quick proto tcp from to any port = imaps - block drop quick proto tcp from to any port = submission - block drop quick proto tcp from to any port = smtps - block drop quick proto tcp from to any port = sieve - block drop quick proto tcp from to any port = submission - block drop quick proto tcp from to any port = smtps - block drop quick proto tcp from to any port = smtp - block drop quick proto tcp from to any port = ssh - block drop quick proto tcp from to any - + sudo pfctl -a 'f2b-jail/jail1\_fqdn' -s rules + block drop quick proto tcp from to any port = pop3 + block drop quick proto tcp from to any port = pop3s + block drop quick proto tcp from to any port = imap + block drop quick proto tcp from to any port = imaps + block drop quick proto tcp from to any port = submission + block drop quick proto tcp from to any port = smtps + block drop quick proto tcp from to any port = sieve + block drop quick proto tcp from to any port = submission + block drop quick proto tcp from to any port = smtps + block drop quick proto tcp from to any port = smtp + block drop quick proto tcp from to any port = ssh + block drop quick proto tcp from to any +