This is a much more reliable method to extract the IP address
from the log entries, and allows us to consolidate 2 matches into
a single operation.
Once matched, we extract the IP substring and pass it to `find()`
as usual. We can add more regexes later if that is useful.
This reverts commit dc8f37e41f.
This message can print on a normal and legitimate user when they
disconnect, and therefore would be a false positive. We should
100% never get close to blocking legitimate users, ever.
We can't just delete an entry only when it is blocked, this
would forever leave all entries lingering in the list until
they hit the limit, and it would likely consume lots of memory.
Instead, we'll prune only based on timestamp values. This removes
old entries automatically regularly, but leaves new hits that
haven't hit the expiry time. If IPs get blocked, they're not
removed, but the expiry time will remove them. This will
assure that hosts that try in large intervals actually get
blocked again right away.
Create `tallow` and `tallow6` ipsets, hook up to iptables
and create a single rule in the INPUT chain of the filter
table.
The ipsets created have `expire` timeouts set by default
which removes the need to do pruning, so we can erase entries
immediately from our LL when blocking.
This is a far more robust way of tailing the journal that seems
to work on 2 different journal versions. It's a bit more involved
and journal slowness may cause it to take several seconds to iterate
through the journal after a rotate or after startup, but it's far
more reliable than the old method.
I've also pushed all the output to stderr which makes the blocked/
unblocked messages end up in the journal itself.
Adds a signal handler to gracefully shut down in case of exit
signal, while doubling as a way to quickly dump the current
state table.
A journal tailing error workaround thanks to ssh-blocker.
Auke Kok