Re: can we design a modified fail2ban ?

[Alessandro Vesely <vesely@tana.it>]

On 17/Apr/10 19:58, Jan Engelhardt wrote:
> On Saturday 2010-04-17 18:01, Alessandro Vesely wrote:
>>>  fail2ban has the ability - if I read its own short description right - to already use various blocking methods, including not only /etc/hosts.deny but also iptables.
>>
>>  I don't think it uses netfilter, though. I've read it has to restart a daemon in order to unlist an IP --not sure it's still so for the current version.
>
> Better know than think.

The bit I had read is "You currently have to restart the daemon to 
unban." in http://www.fail2ban.org/wiki/index.php/Features#0.9.0

However, reading slightly more carefully, that's about _manually_ 
unbanning an IP (e.g. a misconfigured client that locked out the whole 
office behind its NAT.)

> N.B.: If what http://en.wikipedia.org/wiki/Fail2ban says is not correct, by all means you should correct it.
>
> Besides, if it is accurate, it uses iptables, not directly Netfilter.

Correct. Browsing action.d/iptables.conf one finds

  # Option:  actionban
  # Notes.:  command executed when banning an IP. Take care that the
  #          command is executed with Fail2Ban user rights.
  # Tags:    <ip>  IP address
  #          <failures>  number of failures
  #          <time>  unix timestamp of the ban time
  # Values:  CMD
  #
  actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP

  # Option:  actionunban
  # Notes.:  command executed when unbanning an IP. Take care that the
  #          command is executed with Fail2Ban user rights.
  # Tags:    <ip>  IP address
  #          <failures>  number of failures
  #          <time>  unix timestamp of the ban time
  # Values:  CMD
  #
  actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP

I think the daemon just executes those commands, after replacing the 
tags. I don't know whether fail2ban uses some other storage to 
remember frequently banned IPs.

How would you compare iptables and netfilter? I mean fail2ban actions 
versus looking up a b-tree file, in terms of rough memory consumption 
and responsiveness expectations? For the max number of entries, I 
reckon b-trees can allow to map the entire IPv4 address space within 
1Tb of mass storage. But what might be the difference with usual volumes?