files

Branch :

Show log
Commit
Author : landry
Date : 2026-06-24 06:48:50
Hash : 0a035724
Message : sysutils/reaction: major update to 2.5.1, from Lydia Sobot, Thanks ! was rewritten from go to rust, if you had a custom config in /etc/reaction.conf you might want to move it to /etc/reaction/. improvements to run the daemon as an unpriviledged user might come later.

authlog.jsonnet

local banFor(time) = {
  ban: {
    cmd: ['pfctl', '-t', 'blocked_ssh', '-T',  'add', '<ip>'],
  },
  unban: {
    after: time,
    cmd: ['pfctl', '-t', 'blocked_ssh', '-T',  'del', '<ip>'],
  },
};
{
  patterns: {
    ip: {
      type: 'ip',
    },
  },
  start: [
  ],
  stop: [
    ['pfctl', '-t', 'blocked_ssh', '-T',  'flush'],
  ],
  streams: {
    ssh: {
      cmd: [ 'tail', '-n0', '-f', '/var/log/authlog' ],
      filters: {
        failedlogin: {
          regex: [
            // Auth fail
            @'Failed password for invalid user .* from <ip>',
            // Client disconnects during authentication
            @'Disconnected from invalid user .* <ip>',
          ],
          retry: 3,
          retryperiod: '6h',
          actions: banFor('48h'),
        },
      },
    },
  },
}

IABSD.fr/ports/sysutils/reaction/files

Commit