Comments (8)
We have done something similar; set up an RBL of exceptions, and then have the lua script check against this list to deactivate some of the rules - a bit like a whitelist. Unfortunately, there is no way to process this list before the blacklist takes effect, so if a mailbox gets onto the blacklist, then it cant log in from anywhere, even a whitelisted IP.
It would be good to be able to either have a whitelist (configurable to be processed either before or after the blacklist), or else have some way to make certain checks before the blacklist is processed.
from weakforced.
from weakforced.
I can't speak as to Steve's needs, but for us, it was (to rephrase my original post), to segment the IPs and usernames reported to wforce into three groups, having these classes of service when thresholds are exceeded:
. whitelisted - no detrimental policy applied to these
. subscriber - tarpit applied to these
. other - tarpit N times, then blacklist for T time applied to these
from weakforced.
We were considering implementing the class-of-service aspect by doing an LDAP lookup to determine a class, then simply switching rules off and on (or adjusting thresholds) in the lua code. Alternatively an RBL lookup on the IP could provide the CoS. I've not seen the 'standardised policy' so can't comment on that.
With regard to the whitelist/blacklist aspect, although I can see @neilcook 's point, I would like to have both so as to follow the more unix-y principle of giving users several ways of achieving their goals and let them choose which works best for their needs. You don't need to use all the options, but if they are there, then you run a better chance of being able to work with everyone.
from weakforced.
Steve, I'll add an issue for implementing a native whitelist
from weakforced.
We were considering implementing the class-of-service aspect by doing an LDAP lookup to
determine a class, then simply switching rules off and on (or adjusting thresholds) in the lua code.
Did you know you can use Dovecot to do this rather than do the LDAP lookup yourself from Lua? Anything that Dovecot can get from userdb as a variable can be passed to wforce.
Alternatively an RBL lookup on the IP could provide the CoS. I've not seen the 'standardised policy'
so can't comment on that.
The standardised policy is available by installing wforce-policy package if you want to take a look (it won't trash your existing config).
from weakforced.
FYI for the original request by Dave, I'm creating a new "IPGraylist". IPs on this list will never be rejected or blacklisted, only tarpitted. Tarpits will also count towards 24 hour totals.
from weakforced.
From the policy documentation:
IP graylist
The IP graylist consists of a list of IP addresses (these can be in CIDR format) that will be graylisted. Graylisted IPs will never be rejected or blacklisted, only tarpitted.
The number of seconds that graylisted IPs will be tarpitted for is configured using the "graylist_tarpit_secs" configuration field, e.g.
config.initConfig({graylist_tarpit_secs=5})
The IPs to be graylisted can be configured in one of two ways.
Firstly by passing a table containing the required IPs to the "loadGraylist()" function:
config.loadGraylist({ip_gl = { "127.0.0.1/8" }})
Secondly, they can be loaded from a file:
config.loadGraylistFromFile("graylist.lua")
The file must have the following format:
ip_gl = { "127.0.0.0/8", "192.168.0.0/16" }
If the graylist is changed while wforce is running, it can be reloaded simply by typing "config.loadGraylistFromFile(filename)" at the wforce console (or running the console as follows: wforce -c -e "config.loadGraylistFromFile(filename)".
Remember that wforce will change working directory to that of the specified configuration file, so filenames can be relative to that point.
from weakforced.
Related Issues (20)
- Support HTTPS in the REST API HOT 1
- Unexplained long delay on report() function call [BUG?] HOT 11
- TLS Client Authentication Configuration HOT 1
- parseTCPReplication error after restart of a SyncHost [BUG] HOT 9
- [BUG] linking fails with undefined symbol 'pthread_rwlock_unlock' HOT 12
- [BUG] GeoIP2 is not build without legacy GeoIP lib HOT 9
- [BUG] setACL() doesn't replaces current networks list HOT 11
- [BUG] wforce logs errors about failing to create folders ./uploads/tmp/XX HOT 2
- [BUG] SyncDone by sibling seems to fail sometimes HOT 14
- [FEATURE] expiring old SSDB keys HOT 1
- [BUG] incorrect HTTP response (404) on ACL fail in wforce 2.6.1 (should be 401) HOT 2
- [FEATURE] Weakforced missing ebuilds for gentoo HOT 4
- [FEATURE] add postfix check_policy_service support HOT 3
- [BUG] -ltermcap fails on gentoo HOT 4
- [BUG] wforce daemon stuck in 'warmup' state HOT 5
- [FEATURE] Official RPM for RHEL8 family built against Lua5.1, but should be built against Lua 5.3 HOT 3
- [FEATURE] Split regression so it runs jobs in parallel HOT 1
- [BUG] GEOIP2 not working in Docker image version 2.10 HOT 3
- [FEATURE] Change time to logging stats directive HOT 3
- [BUG] License conflicts HOT 10
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from weakforced.