mirror of
https://github.com/clearlinux/tallow.git
synced 2026-09-02 03:31:30 +00:00
42 lines
1.7 KiB
Groff
42 lines
1.7 KiB
Groff
.TH tallow 1 "31 October 2012" ".1" "Tallow"
|
|
.SH NAME
|
|
Tallow \- Reduce log clutter due to ssh login attempts.
|
|
.SH SYNOPSIS
|
|
/usr/sbin/tallow
|
|
.SH DESCRIPTION
|
|
\fBtallow\fR is a daemon that watches the systemd journal for
|
|
messages from the \fBsshd\fR service. It parses the messages
|
|
and looks for attempted random logins such as failed logins to the
|
|
root account and failed logins to invalid user accounts.
|
|
.PP
|
|
If such logins were detected, the offending IP address is stored
|
|
in a list. Items from this list are regularly purged, but if
|
|
the amount of times that a specific IP address is seen exceeds
|
|
a threshold (default 3), an iptables(1) rule is inserted in the
|
|
\fBTALLOW\fR chain in the \fBfilter\fR netfilter table. The
|
|
rule will match all packets from the IP address and \fBDROP\dR
|
|
them.
|
|
.PP
|
|
The system administrator needs to assure that all incoming packets
|
|
are routed through the \fBTALLOW\fR chain by inserting a rule
|
|
appropriately, e.g. \`iptables -I INPUT -j TALLOW\`. The \fBTALLOW\fR
|
|
chain may have to be created manually first with e.g. \`iptables -N
|
|
TALLOW\`.
|
|
.PP
|
|
Care should be taken to assure that legitimate users are not
|
|
blocked inadvertently. You may wish to list any valid IP address
|
|
with the whitelist option in tallow.conf(5). Multiple addresses
|
|
can be whitelisted.
|
|
|
|
.SH OPTIONS
|
|
The \fBtallow\fR daemon itself has no runtime configuration. All
|
|
configuration is done through the tallow.conf(5) config file.
|
|
.SH SEE ALSO
|
|
systemd-journald(1), iptables(1), tallow.conf(5)
|
|
.SH BUGS
|
|
\fBtallow\fR is \fBNOT A SECURITY SOLUTION\fR, nor does it protect
|
|
against random password logins. A attacker may still be able to
|
|
logon to your systems if you allow password logins.
|
|
.SH AUTHOR
|
|
Auke Kok <auke-jan.h.kok@intel.com>
|