vyos-1x.git/data/templates/ssh/sshguard_whitelist.j2, branch feature/T9082-codeql-cppVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=feature%2FT9082-codeql-cpp2023-12-31T22:49:48+00:00T5474: establish common file name pattern for XML conf mode commands2023-12-31T22:49:48+00:00Christian Breunigchristian@breunig.cc2023-12-30T22:25:20+00:00urn:sha1:4ef110fd2c501b718344c72d495ad7e16d2bd465
We will use _ as CLI level divider. The XML definition filename and also
the Python helper should match the CLI node.
Example:
set interfaces ethernet -> interfaces_ethernet.xml.in
set interfaces bond -> interfaces_bond.xml.in
set service dhcp-server -> service_dhcp-server-xml.in
sshguard: T4408: rename whitelist-address -> allow-from2022-05-13T16:43:09+00:00Christian Poessingerchristian@poessinger.com2022-05-13T16:43:07+00:00urn:sha1:37a08888d103556326ecd13e4738301ac901c861
We do not only allow individual host addresses but also prefixes.
sshguard: T4408: Add service ssh dynamic-protection2022-05-12T17:27:38+00:00Viacheslav Hletenkov.gletenko@vyos.io2022-05-10T15:14:19+00:00urn:sha1:2e81f9e057f598a9a9e5c2d617e3d0818005d850
Sshguard protects hosts from brute-force attacks
Can inspect logs and block "bad" addresses by threshold
Auto-generate rules for nftables
When service stopped all generated rules are deleted
nft "type filter hook input priority filter - 10"
set service ssh dynamic-protection
set service ssh dynamic-protection block-time 120
set service ssh dynamic-protection detect-time 1800
set service ssh dynamic-protection threshold 30
set service ssh dynamic-protection whitelist-address 192.0.2.1