Shieldlist

shieldlist-panel Free

Brute force against this console's sign-in or its API — refused logins and bad tokens from one address

Category
panel
Threshold
5/10m, 15/1h
Ban policy
web
Parsers
shieldlist-refused

Why it is written this way

Somebody guessing at the console or the API: five refusals in ten
minutes, or fifteen in an hour, and the address is banned on the machine
that runs the controller. The agent there reads the controller's log:
log_inputs: [{path: /var/log/shieldlist/controller.log, category: shieldlist}]

The rule file View raw

# Somebody guessing at the console or the API: five refusals in ten
# minutes, or fifteen in an hour, and the address is banned on the machine
# that runs the controller. The agent there reads the controller's log:
#   log_inputs: [{path: /var/log/shieldlist/controller.log, category: shieldlist}]
rule: shieldlist-panel
description: "Brute force against this console's sign-in or its API — refused logins and bad tokens from one address"
about:
  purpose: >-
    Ban whoever is guessing at the console's sign-in or at the API.
  blocks: >-
    Five refusals in ten minutes, or fifteen in an hour.
  applies_to: >-
    The machine that runs the controller.
  requires:
    - >-
      The controller's own log, declared as `log: shieldlist` — /var/log/shieldlist/controller.log.
  beware:
    - >-
      Your own address is as bannable as anyone's, and the console is what you would use to lift the ban. Exempt the addresses you administer from before you arm this.
category: panel
parsers: shieldlist-refused
threshold: [5/10m, 15/1h]
ban: web