← Back
Editing: nsupdate.conf
# Fail2Ban configuration file # # Author: Andrew St. Jean # # Use nsupdate to perform dynamic DNS updates on a BIND zone file. # One may want to do this to update a local RBL with banned IP addresses. # # Options # # domain DNS domain that will appear in nsupdate add and delete # commands. # # ttl The time to live (TTL) in seconds of the TXT resource # record. # # rdata Data portion of the TXT resource record. # # nsupdatecmd Full path to the nsupdate command. # # keyfile Full path to TSIG key file used for authentication between # nsupdate and BIND. # # Create an nsupdate.local to set at least the <domain> and <keyfile> # options as they don't have default values. # # The ban and unban commands assume nsupdate will authenticate to the BIND # server using a TSIG key. The full path to the key file must be specified # in the <keyfile> parameter. Use this command to generate your TSIG key. # # dnssec-keygen -a HMAC-MD5 -b 256 -n HOST <key_name> # # Replace <key_name> with some meaningful name. # # This command will generate two files. Specify the .private file in the # <keyfile> option. Note that the .key file must also be present in the same # directory for nsupdate to use the key. # # Don't forget to add the key and appropriate allow-update or update-policy # option to your named.conf file. # [Definition] # Option: actionstart # Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = # Option: actionstop # Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = # Option: actioncheck # Notes.: command executed once before each actionban command # Values: CMD # actioncheck = # Option: actionban # Notes.: command executed when banning an IP. Take care that the # command is executed with Fail2Ban user rights. # Tags: See jail.conf(5) man page # Values: CMD # actionban = echo <ip> | awk -F. '{print "prereq nxrrset "$4"."$3"."$2"."$1".<domain> TXT"; print "update add "$4"."$3"."$2"."$1".<domain> <ttl> IN TXT \"<rdata>\""; print "send"}' | <nsupdatecmd> -k <keyfile> # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the # command is executed with Fail2Ban user rights. # Tags: See jail.conf(5) man page # Values: CMD # actionunban = echo <ip> | awk -F. '{print "update delete "$4"."$3"."$2"."$1".<domain>"; print "send"}' | <nsupdatecmd> -k <keyfile> [Init] # Option: domain # Notes.: DNS domain that nsupdate will update. # Values: STRING # domain = # Option: ttl # Notes.: time to live (TTL) in seconds of TXT resource record # added by nsupdate. # Values: NUM # ttl = 60 # Option: rdata # Notes.: data portion of the TXT resource record added by nsupdate. # Values: STRING # rdata = Your IP has been banned # Option: nsupdatecmd # Notes.: specifies the full path to the nsupdate program that dynamically # updates BIND zone files. # Values: CMD # nsupdatecmd = /usr/bin/nsupdate # Option: keyfile # Notes.: specifies the full path to the file containing the # TSIG key for communicating with BIND. # Values: STRING # keyfile =
Save File
Cancel