I look forward to trying that feature when it gets rolled out in package
managers.
In the mean time, the "recidive" jail is set up to try to satisfy this
need before that feature existed. It is a jail which watches fail2ban's
own logfile, and bans IPs that have been repeatedly banned. E.g. I
typically have a 1-hour ban for something, and then the recidive
watches and any IP that has gotten banned more than 3 times in a day
(or whatever) then gets banned for 1 week.
A true exponential bantime modifier like what is apparently in the
dev build is certainly better than recidive, but recidive is available
right now and works "well enough".
Thanks,
Mark
On Thu, Mar 22, 2018 at 03:45:57PM +0100, Roy Sigurd Karlsbakk via
Fail2ban-users wrote:
> Well, I can do it manually, but I prefer packages. Perhaps the debian/
> dir and its contents should be in master instead of separate branches?
> It's not much, really??
> Vennlig hilsen
> roy
> --
> Roy Sigurd Karlsbakk
> (+47) 98013356
> http://blogg.karlsbakk.net/
> GPG Public key: http://karlsbakk.net/roysigurdkarlsbakk.pubkey.txt
> --
> Hi?? g????a skaltu ? stein h??ggva, hi?? illa ? snj?? rita.
> __________________________________________________________________
>
> From: "Tony Collins" <t...@evilplan.org.uk>
> To: "Fail2ban Users" <fail2ban-users@lists.sourceforge.net>
> Sent: Sunday, 18 March, 2018 22:15:32
> Subject: Re: [Fail2ban-users] Incremental ban time?
>
> Hi -sorry I've got no idea at all. I now take my versions directly from
> the github repository and install it manually. That's definitely
> something I can help with if you want to do it that way.
> On Sat, 17 Mar 2018 at 18:50, Roy Sigurd Karlsbakk
> <[1]r...@karlsbakk.net> wrote:
>
> Looks good! Any idea how to easily create a debian package out of that?
> Vennlig hilsen
> roy
> --
> Roy Sigurd Karlsbakk
> (+47) 98013356
> [2]http://blogg.karlsbakk.net/
> GPG Public key: [3]http://karlsbakk.net/roysigurdkarlsbakk.pubkey.txt
> --
> Hi?? g????a skaltu ? stein h??ggva, hi?? illa ? snj?? rita.
> __________________________________________________________________
>
> From: "Tony Collins" <[4]t...@evilplan.org.uk>
> To: "Fail2ban Users" <[5]fail2ban-users@lists.sourceforge.net>
> Sent: Saturday, 17 March, 2018 18:02:18
> Subject: Re: [Fail2ban-users] Incremental ban time?
>
> That's a built-in feature of the 0.11 development build and it works
> fantastically! It's really flexible and configurable.
> On Sat, 17 Mar 2018 at 17:00, Roy Sigurd Karlsbakk via Fail2ban-users
> <[6]fail2ban-users@lists.sourceforge.net> wrote:
>
> hi all
> I've been looking at my logs, and quite often, the IP addresses
> blocked are blocked again and again, so what about a feature like
> "Block <n> minutes, then remove block, and if an attempt is made to
> login from the same address within <m> minutes and a new failure
> happens, block <n*2> minutes, and then n*4 etc. I don't know the
> code too well, so I don't feel like just attempting to fix this
> myself (and I don't know python very well either).
> Vennlig hilsen
> roy
> --
> Roy Sigurd Karlsbakk
> (+47) 98013356
> [7]http://blogg.karlsbakk.net/
> GPG Public key:
> [8]http://karlsbakk.net/roysigurdkarlsbakk.pubkey.txt
> --
> Hi?? g????a skaltu ? stein h??ggva, hi?? illa ? snj?? rita.
> --------------------------------------------------------------------
> ----------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! [9]http://sdm.link/slashdot
> _______________________________________________
> Fail2ban-users mailing list
> [10]Fail2ban-users@lists.sourceforge.net
> [11]https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>
> --
>
> -- Tony Collins
>
> --------------------------------------------------------------------
> ----------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! [12]http://sdm.link/slashdot
> _______________________________________________
> Fail2ban-users mailing list
> [13]Fail2ban-users@lists.sourceforge.net
> [14]https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>
> --
>
> -- Tony Collins
>
> --------------------------------------------------------------------
> ----------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Fail2ban-users mailing list
> Fail2ban-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>
> References
>
> 1. mailto:r...@karlsbakk.net
> 2. http://blogg.karlsbakk.net/
> 3. http://karlsbakk.net/roysigurdkarlsbakk.pubkey.txt
> 4. mailto:t...@evilplan.org.uk
> 5. mailto:fail2ban-users@lists.sourceforge.net
> 6. mailto:fail2ban-users@lists.sourceforge.net
> 7. http://blogg.karlsbakk.net/
> 8. http://karlsbakk.net/roysigurdkarlsbakk.pubkey.txt
> 9. http://sdm.link/slashdot
> 10. mailto:Fail2ban-users@lists.sourceforge.net
> 11. https://lists.sourceforge.net/lists/listinfo/fail2ban-users
> 12. http://sdm.link/slashdot
> 13. mailto:Fail2ban-users@lists.sourceforge.net
> 14. https://lists.sourceforge.net/lists/listinfo/fail2ban-users
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Fail2ban-users mailing list
> Fail2ban-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
--
Mark Costlow | Southwest Cyberport | Fax: +1-505-232-7975
che...@swcp.com | Web: www.swcp.com | Voice: +1-505-232-7992
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
