Introduction
Shieldlist watches the logs of your servers, recognises attacks in them — password guessing, scans, probes, floods — and bans the addresses behind them at the firewall. It is built for fleets: one place to see everything, one place to decide, and machines that keep defending themselves when that place is unreachable.
Two programs
The controller runs on one machine of yours. It holds the rules, the exemptions and the declaration of every server; it serves the console; it receives what every machine decided and shares bans across the fleet; it reports to abuse databases if you ask it to.
The agent runs on every protected server. It reads the logs, counts, decides and writes the bans into nftables — locally, in RAM, with no database or service beside it. Enrolled to the controller, it receives its configuration from it and sends back what it did. Standalone, it does the same job from local files.
A rule is a file you can read
A parser recognises one kind of log line. A rule counts what parsers find and fires when a threshold is crossed inside a window — 3/5m: three hits in five minutes. A policy says how long the ban lasts and how it climbs on repeat. A pack is a directory of these, given to servers by name. None of it is code: a rule cannot run anything on a machine, which is why rules can travel — from this site to your controller, from your controller to your servers.
The order
- Install the controller and open the console.
- Enrol the first server: the console tells you how.
- Give it rules and packs, watch in detect-only, then arm.
A single machine can skip the controller entirely: see the standalone agent.