sjs/rack-attack
1
0
Fork 0
mirror of https://github.com/samsonjs/rack-attack.git synced 2026-04-27 15:07:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

updated and condensed fail2ban docs

Browse source
This commit is contained in:
madlep 2013-06-17 08:51:05 +10:00
parent 2819e0d7a4
commit 4fe7f2d1ba
1 changed files with 3 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
README.md
View file

@ -93,28 +93,17 @@ This pattern is inspired by [fail2ban](http://www.fail2ban.org/wiki/index.php/Ma
See the [fail2ban documentation](http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Jail_Options) for more details on See the [fail2ban documentation](http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Jail_Options) for more details on
how the parameters work. how the parameters work.
# Block requests from IP addresses that misbehave # Block requests from IP addresses that misbehave.
# Allow up to 3 bad requests within 10 minutes, then ban the IP for 5 minutes if exceeded
Rack::Attack.blacklist('fail2ban pentesters') do |req| Rack::Attack.blacklist('fail2ban pentesters') do |req|
# `filter` returns truthy value if request fails, or if it's from a previously banned IP # `filter` returns truthy value if request fails, or if it's from a previously banned IP
# this causes `blacklist` to block the request # this causes `blacklist` to block the request
Rack::Attack::Fail2Ban.filter("pentest", # namespace for cache key Rack::Attack::Fail2Ban.filter(req.ip, :maxretry => 3, :findtime => 10.minutes, :bantime => 5.minutes) do
req.ip, # count matching requests based on IP
:maxretry => 3, # allow up to 3 bad requests...
:findtime => 10.minutes, # to occur within 10 minutes...
:bantime => 5.minutes) do # and ban the IP address for 5 minutes if exceeded
# if block is truthy, the count for the IP is incremented # if block is truthy, the count for the IP is incremented
CGI.unescape(req.query_string) =~ %r{/etc/passwd} CGI.unescape(req.query_string) =~ %r{/etc/passwd}
end end
end end
Rack::Attack.blacklist('pentest') do |request|
Rack::Attack::Fail2Ban.filter('pentest', request.ip, bantime: 10.minutes, findtime: 10.minutes, maxretry: 3) do
RACK_ATTACK_DIE_PEN_TESTER_TESTS.any?{|test| test.(request)}
end
end
### Throttles ### Throttles
# Throttle requests to 5 requests per second per ip # Throttle requests to 5 requests per second per ip