readme

Cargo.lock

@@ -81,7 +81,7 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "blockfast"
-version = "0.1.1"
+version = "0.2.0"
 dependencies = [
  "anyhow",
  "clap",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "blockfast"
-version = "0.1.1"
+version = "0.2.0"
 authors = ["Pierre Dubouilh <pldubouilh@gmail.com>"]
 edition = "2018"
 

README.md

@@ -1,13 +1,78 @@
 # blockfast
 
-block ssh and http scanners fast
+Block internets scanners fast 🍶
 
-features:
+Features:
-  - generic SSH log parser
+  - SSH log parser
-  - generic Common Log Format parser (apache logs, caddy logs, etc...)
+  - Common Log Format parser (apache logs, etc...)
-  - sane defaults
+  - JSON log parser (caddy logs)
-  - fast ip ban with `ipset`
+  - Generic log parser
-  - libmusl static release builds, no libc dependency
+  - Sane defaults
-  - lighter alternative to fail2ban
+  - Fast ip ban with `ipset`
+  - Static release builds, no libc dependency
+  - Lighter alternative to fail2ban
 
-Todo: more granular CLI args to filter HTTP Status codes (e.g. 5 401 leads to a block, but 30 404 before a block) ?
+## example
+```txt
+$ ./blockfast -s=/var/log/auth.log -j=/caddy/logs
+1737927469 - starting with sshd parsing at "/tmp/sshdtest"
+1737927469 - starting with json parsing at "/tmp/jsontest"
+1737927469 - jail setup, allowance 5, time 21600s
+1737927477 - sshd logged offence for 9.124.36.195
+1737927478 - sshd logged offence for 9.124.36.195
+1737927479 - sshd logged offence for 9.124.36.195
+1737927479 - sshd logged offence for 9.124.36.195
+1737927480 - sshd logged offence for 9.124.36.195
+1737927480 - sshd jailtime for 9.124.36.195
+```
+
+## build
+see `Makefile`
+
+## usage
+```txt
+$ target/debug/blockfast
+Blockfast - block internets scanners fast 🍶
+Author: pierre dubouilh <pldubouilh@gmail.com>
+
+Blockfast reads logs from various sources and blocks the offending IPs using iptables and ipset.
+It supports logs from sshd, Common-Log-Format (Apache, etc..), JSON (Caddy) and a generic logs parser.
+
+Example:
+    # block invalid sshd attempts & invalid http statuses from caddy
+    ./blockfast -s=/var/log/auth.log -j=/caddy/logs
+
+    # generic log parser example with a log text to flag, and a regex to parse the offending IP.
+    ./blockfast --generic-logpath=/tmp/generictest --generic-positive='Failed password' --generic-ip='from ([0-9a-fA-F:.]+) port'
+
+Usage: blockfast [OPTIONS]
+Usage: blockfast [OPTIONS]
+
+Options:
+      --jailtime <JAILTIME>
+          jail time (seconds) [default: 21600]
+      --allowance <ALLOWANCE>
+          how many offences allowed (max 255) [default: 5]
+  -v, --verbose
+          log all offences
+  -s, --sshd-logpath <SSHD_LOGPATH>
+          path of sshd logfile
+  -c, --clf-logpath <CLF_LOGPATH>
+          path of Common-Log-Format logfile (Apache, etc..)
+  -j, --json-logpath <JSON_LOGPATH>
+          path of JSON HTTP logfile (Caddy)
+      --generic-logpath <GENERIC_LOGPATH>
+          generic parser log file path
+      --generic-ip <GENERIC_IP>
+          generic parser ip regex
+      --generic-positive <GENERIC_POSITIVE>
+          generic parser positive - if a logline contains this, it is considered bad, the rest is good
+      --generic-negative <GENERIC_NEGATIVE>
+          generic parser negative - if a logline contains this, it is considered good, the rest is bad
+      --valid-http-statuses <VALID_HTTP_STATUSES>
+          valid http statuses (for CLF and JSON logs) [default: 200 101]
+  -h, --help
+          Print help
+  -V, --version
+          Print version
+```

src/utils.rs

@@ -64,7 +64,7 @@ Example:
     # block invalid sshd attempts & invalid http statuses from caddy
     ./blockfast -s=/var/log/auth.log -j=/caddy/logs
 
-    # generic log parser example with a positive text, and a regex to parse the offending IP.
+    # generic log parser example with a log text to flag, and a regex to parse the offending IP.
     ./blockfast --generic-logpath=/tmp/generictest --generic-positive='Failed password' --generic-ip='from ([0-9a-fA-F:.]+) port'",
     verbatim_doc_comment,
 )]