Files
tallow/tallow.1
T

42 lines
1.7 KiB
Groff

.TH tallow 1 "31 October 2012" ".1" "Tallow"
.SH NAME
Tallow \- Reduce log clutter due to ssh login attempts.
.SH SYNOPSIS
/usr/sbin/tallow
.SH DESCRIPTION
\fBtallow\fR is a daemon that watches the systemd journal for
messages from the \fBsshd\fR service. It parses the messages
and looks for attempted random logins such as failed logins to the
root account and failed logins to invalid user accounts.
.PP
If such logins were detected, the offending IP address is stored
in a list. Items from this list are regularly purged, but if
the amount of times that a specific IP address is seen exceeds
a threshold (default 3), an iptables(1) rule is inserted in the
\fBTALLOW\fR chain in the \fBfilter\fR netfilter table. The
rule will match all packets from the IP address and \fBDROP\dR
them.
.PP
The system administrator needs to assure that all incoming packets
are routed through the \fBTALLOW\fR chain by inserting a rule
appropriately, e.g. \`iptables -I INPUT -j TALLOW\`. The \fBTALLOW\fR
chain may have to be created manually first with e.g. \`iptables -N
TALLOW\`.
.PP
Care should be taken to assure that legitimate users are not
blocked inadvertently. You may wish to list any valid IP address
with the whitelist option in tallow.conf(5). Multiple addresses
can be whitelisted.
.SH OPTIONS
The \fBtallow\fR daemon itself has no runtime configuration. All
configuration is done through the tallow.conf(5) config file.
.SH SEE ALSO
systemd-journald(1), iptables(1), tallow.conf(5)
.SH BUGS
\fBtallow\fR is \fBNOT A SECURITY SOLUTION\fR, nor does it protect
against random password logins. A attacker may still be able to
logon to your systems if you allow password logins.
.SH AUTHOR
Auke Kok <auke-jan.h.kok@intel.com>