blacklistd analogue

[Vincent]

Hello,

I've build a python3 deamon which look for specific patterns in any log file. For each of those patterns you assign a weight. Once the max weight is reached in a period of time the associated IP is added to a pf table for a certain amount of time (1 day typically but can be changed).
You must know python regex to tune it to your specific needs. But samples can guide you.


Details here
https://www.vincentdelft.be/post/post_20170517


Vincent

Does there exist an OpenBSD analogue for FreeBSD's blacklistd daemon?
For the sake of completeness: blacklistd is a daemon that, using pf
anchors, blocks connections from abusive hosts to parctiular services
(e.g. sshd) until they start behaving themselves again.
I find it very useful for timming down log files.
Regards,
Jean-Pierre

[Pierre Emeriaud]

Le jeu. 25 mars 2021 à 19:45, Kapetanakis Giannis

How about a distributed setup?
Has anyone thought of a way getting IPs from various servers (say linux
& fail2ban) to the central OpenBSD (pf) firewall?

I send all my logs to a centralised syslog which runs fail2ban, and
instead of using pf here, fail2ban injects bgp routes of "attackers"
to my network.

Then either an openbsd border firewall adds those prefixes to a pf
table to drop the traffic from, or on a linux out-of-as host this
installs a null route. With urpf enabled traffic gets dropped at
ingress.

This setup could scale a lot, bgp was made for distributing prefixes.