Rules and packs

A server runs the controller tree's root plus the packs its declaration names. Assign packs in the console (Servers → the server → Rules) or in its file:

packs: [openssh, web]

The controller validates the whole tree and every machine's assembly (shieldlist-controller -t), then a reload pushes the change to the servers concerned.

Where packs come from#

• The library on this site. Free packs can be read here, downloaded, and dropped into the controller tree under packs/<name>/. Premium packs need an account and arrive through the controller.
• Your own. A pack is a directory of small YAML files; write one from the console (Rules → New pack…) or copy a working machine's /etc/shieldlist language. Agent → Writing rules is the reference.

A controller fetches the packs its account allows and pushes them, with their updates, to every server that should have them. This is the only way rules reach servers automatically; without a controller, rules reach a machine by hand.

Reading a rule#

rule: ssh
description: SSH brute force — wrong passwords, connections dropped in authentication
category: ssh
parsers: [ssh-auth-fail, ssh-preauth-abort, ssh-auth-abandoned]
threshold: [3/5m, 10/6h]
ban: ssh
report: ssh-brute-force

Which log lines count (parsers), how many in how long (threshold — here two windows, the loud attacker and the patient one), which ban ladder (ban: ssh names a policy: 6h → 24h → 7d, climbing on return), what a report says if reporting is on. A server's level scales every threshold it runs: instant, strict, standard, lenient.

Exemptions#

Your own addresses, your monitoring, your customers' offices: exemptions remove the sanction, never the observation — an exempt address still shows in the console, marked as such. They live at the root of the controller tree (every server) or per server, and can be published from a URL your own tools maintain. Controller → Configuration has the keys.