{"action":"created","issue":{"url":"https://api.github.com/repos/stamparm/maltrail/issues/30","repository_url":"https://api.github.com/repos/stamparm/maltrail","labels_url":"https://api.github.com/repos/stamparm/maltrail/issues/30/labels{/name}","comments_url":"https://api.github.com/repos/stamparm/maltrail/issues/30/comments","events_url":"https://api.github.com/repos/stamparm/maltrail/issues/30/events","html_url":"https://github.com/stamparm/maltrail/issues/30","id":123284631,"number":30,"title":"Feature Request : autobans/manual bans","user":{"login":"Boldairdev","id":4577713,"avatar_url":"https://avatars.githubusercontent.com/u/4577713?v=3","gravatar_id":"","url":"https://api.github.com/users/Boldairdev","html_url":"https://github.com/Boldairdev","followers_url":"https://api.github.com/users/Boldairdev/followers","following_url":"https://api.github.com/users/Boldairdev/following{/other_user}","gists_url":"https://api.github.com/users/Boldairdev/gists{/gist_id}","starred_url":"https://api.github.com/users/Boldairdev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Boldairdev/subscriptions","organizations_url":"https://api.github.com/users/Boldairdev/orgs","repos_url":"https://api.github.com/users/Boldairdev/repos","events_url":"https://api.github.com/users/Boldairdev/events{/privacy}","received_events_url":"https://api.github.com/users/Boldairdev/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-12-21T14:03:29Z","updated_at":"2016-03-19T07:44:18Z","closed_at":null,"body":"I love the software well done, easy to use, but so far it's a passive tool.\r\nAdding a button that would launch :\r\niptables -I INPUT -s xxx.xxx.xxx.xxx -j DROP (xxx beeing the offender IP) on each offender line.\r\nCould even add it as an autobanning feature, with maybe a treshold like fail2ban,\r\nThat would certainly make my day :)\r\n(could even make it an option to autoban the known mass scanners at first start)\r\n\r\n(I'm not forgiving, my jail2ban jails ban the 1st time a week, in case of recidive a year, but fail2ban is not that easy to configure, especially for new jails, this, with banning features, could really be a better solution)\r\n"},"comment":{"url":"https://api.github.com/repos/stamparm/maltrail/issues/comments/198658632","html_url":"https://github.com/stamparm/maltrail/issues/30#issuecomment-198658632","issue_url":"https://api.github.com/repos/stamparm/maltrail/issues/30","id":198658632,"user":{"login":"krull","id":353822,"avatar_url":"https://avatars.githubusercontent.com/u/353822?v=3","gravatar_id":"","url":"https://api.github.com/users/krull","html_url":"https://github.com/krull","followers_url":"https://api.github.com/users/krull/followers","following_url":"https://api.github.com/users/krull/following{/other_user}","gists_url":"https://api.github.com/users/krull/gists{/gist_id}","starred_url":"https://api.github.com/users/krull/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/krull/subscriptions","organizations_url":"https://api.github.com/users/krull/orgs","repos_url":"https://api.github.com/users/krull/repos","events_url":"https://api.github.com/users/krull/events{/privacy}","received_events_url":"https://api.github.com/users/krull/received_events","type":"User","site_admin":false},"created_at":"2016-03-19T07:44:18Z","updated_at":"2016-03-19T07:44:18Z","body":"Hi all. This looks great. We can then have csf or any other iptables script daemon monitor said file for changes to include in the ruleset\n\n\nSent from Samsung Mobile\n\n-------- Original message --------\nFrom: Miroslav Stampar <notifications@github.com> \nDate:26/01/2016  18:01  (GMT+02:00) \nTo: stamparm/maltrail <maltrail@noreply.github.com> \nCc: Brendan Jocson <krull.mcroth@gmail.com> \nSubject: Re: [maltrail] Feature Request : autobans/manual bans (#30) \n\n@all auto generating feed of today's \"known attackers\"/\"bad reputation\" IPs that appeared more than N times in a short time-period (e.g. more than once in a 1 second period). This should be pretty \"safe\" to implement (and block)\n\n<maltrail_server_ip>:8338/bad.txt would enlist all those \"bad\" IPs line-break separated, like in case of https://www.badips.com/get/list/any/2?age=7d\n\nThen, you can do the automatic banning from any point outside by just doing the curl in some time periods, e.g.:\n\nfor i in $(curl https://www.badips.com/get/list/any/2?age=7d); do echo $i; done 2>/dev/null\n\ndoes this sound good?\n\n—\nReply to this email directly or view it on GitHub.\n\n"}}