Most cdn and update sources are from US servers⊠I had tried that and my server became slow as hell.
2 Likes
Hey,
I took the time to do it today, no worries⊠installation, config⊠everything went well.
(No blocking for the United States and Malaysia).
Now Iâm waiting to see what itâs going to give.
As for updates, I think Iâd do them manually, I prefer.
Thanks for this script
1 Like
Hello,
Je viens dâessayer et ça marche bien! Merci pour ce travail.
Pour bloquer les attaques, il pourrait ĂȘtre envisageable de se servir des API pour https://www.abuseipdb.com/ pour bloquer directement les IP identifiĂ©es comme malintentionnĂ©es.
1 Like
Since I canât block the US, can I at least block those two manually? :
Amazon Technologies Inc :
The IP 3.130.168.2 has just been banned by Fail2Ban after
3 attempts against postfix.
OrgName: Amazon Technologies Inc.
OrgId: AT-88-Z
Address: 410 Terry Ave N.
City: Seattle
StateProv: WA
PostalCode: 98109
Country: US
RegDate: 2011-12-08
Updated: 2024-01-24
iptables -A INPUT -m iprange --src-range 18.32.0.0-18.255.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 3.128.0.0-3.255.255.255 -j DROP
iptables -A INPUT -m iprange --src-range 3.0.0.0-3.127.255.255 -j DROP
Google LLC :
The IP 162.216.149.200 has just been banned by Fail2Ban after
3 attempts against postfix.
NetRange: 162.216.148.0 - 162.216.151.255
CIDR: 162.216.148.0/22
NetName: GOOGLE-CLOUD
NetHandle: NET-162-216-148-0-1
Parent: NET162 (NET-162-0-0-0-0)
NetType: Direct Allocation
OriginAS:
Organization: Google LLC (GOOGL-2)
RegDate: 2013-07-02
Updated: 2015-09-21
iptables -A INPUT -m iprange --src-range 162.216.148.0-162.216.151.255 -j DROP
iptables -A INPUT -s 162.216.148.0/22 -j DROP
This is good, your fail2ban is working.
I used this script because I had a massive attack from different IPs, trying the same username, from the same countries. It looked like a disseminated bot, that was evading fail2ban blocking.
1 Like
Have you ever tried crowdsec? Iâve been using it on my yunohost since few months and iâm impressed by its efficiency. It analyses the behaviour of attacks, so perharps it can blocks this type of massive attack.
My server is more quieter and works much less . At the beginning, i thought it had broken down or was switched off because it didnât make any noise 
. I guess F2B do the job but Crowdsec blocks earlier with the help of the community list and can detect behaviour.
1 Like
Interesting, will have a look at it. I knew about it, but didnât try it, in fact, in terms of making a package out of it, itâs doable.
interresting how to use it with yunohost serveur ?
Interesting, but you need to create a CrowdSec Console account?
As-tu installé et testé ?
Yeah, I did the right thing to make it work, and I donât have to complain about my configuration 
And the script (block countries yunohost) is really very effective, it blocks the countries Iâve added 
, and as far as updates are concerned, itâs done correctly, without any problems.
Thanks again for this script 
Yep, I am just consider trying it⊠itâs nice a script, thanks
1 Like
Itâs not a requirement, but with it you contribute to the community list and you can add 3 mores lists for free, so i do it.
Ok!
I just found this info: Crowdsec plutĂŽt que Fail2Ban - #4 by CrowdSec
i followed some tutorials on the net, but they are often incompletes to not forget something. I read a little the docs and the commands manual to complete them. I add collections for the apps i use (nexcloud, navidrome,etcâŠ) - I take notes (incomplete perhaps? but i understand how it work if something is missing) , i can share them with you if you want in M.P. because itâs more of a draft than a real document to make a post on the forum.
itâs really simple when you understand how it works.
It can replace Fail2ban but you can leave them both at the beginning, or more if you want (mine didnât ban anything since crowdsec has been installed, only recidive list had some IP after few days because i had put a long bantime.
1 Like
Yes, Iâll take a look.
Thank you
Itâs an old topic, beware, crowdsec was young at this moment, commands are not always the same today. in 2020 - 2022 iâm thinking it was too young to deployed it on a yunohost server in prod, now itâs more mature and i donât have problems and it blocks all the Ip that F2B blocks (see my answer to @Issa ) and much more preventively.
1 Like
I saw on their site âmanual installationâ: Manual installation
It can give an idea for Yunohost.
I always use the native debian packages but i do an exception. I donât advise you to use the debian repository package, it is too old, but the official crowdsec repository to stay with a recent version.
1 Like
Ok, thank you 