fail2ban/fail2ban — pull request #38 by stefdude (2012-03-02 19:10:51+00:00)
Title: "reban" action + dshield-matches implementation

After banning, I still like to log attempts (via a iptables/shorewall droplog target).
I want to do something more with IPs that insist in connecting (DROP on all ports, make the ban last longer, ...)

The first patch adds "actionreban": an optional action to perform when an IP triggers the criteria while already being banned.
Secondly, it updates "matches" and the "timestamp" of the ban. This avoids a BAN-UNBAN-BAN-UNBAN cycles if the bantime is shorter than the "attack time".

Secondly, as I defined a (custom) filter to read the iptables-logging in the kernel logs, and the DShield service supports this native iptables-format, I use the 'matches' to report to DShield.