https://github.com/lichess-org/leroyjenkins
Follow ban logs to manage ipsets
https://github.com/lichess-org/leroyjenkins
ipset
Last synced: 7 months ago
JSON representation
Follow ban logs to manage ipsets
- Host: GitHub
- URL: https://github.com/lichess-org/leroyjenkins
- Owner: lichess-org
- License: gpl-3.0
- Created: 2023-09-03T20:40:41.000Z (almost 3 years ago)
- Default Branch: main
- Last Pushed: 2024-06-09T15:46:43.000Z (about 2 years ago)
- Last Synced: 2025-03-31T06:11:25.415Z (over 1 year ago)
- Topics: ipset
- Language: Rust
- Homepage:
- Size: 155 KB
- Stars: 14
- Watchers: 7
- Forks: 4
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Leroy Jenkins
Used when someone needs [to be decisive](https://www.youtube.com/watch?v=mLyOj_QD4a4) amongst [too much planning and inaction](https://www.youtube.com/watch?v=km5FAAQLUT8)
## Usage
*leroyjenkins* reads data from stdin, and assumes each line is an IP address. Use in combination with standard unix tools like `tail -F`. When an IP address shows up too often before its cache times out, it will be added to the nftables set with the specified timeout.
```sh
tail -F /tmp/ips.log | RUST_LOG=info ./target/release/leroyjenkins --bl-period=1m --bl-threshold=100 --ban-base-time=100s --ban-ttl=1d --table=leroy --ipv6-set=leroy6 --ipv4-set=leroy4
```
> [!WARNING]
> *leroyjenkins* itself does nothing to your firewall rules. Use nftables rules similar to the ones below.
> [!NOTE]
> Must be run with enough privileges to actually modify nftables sets. Otherwise fails with a generic:
> `Error: Os { code: 71, kind: Uncategorized, message: "Protocol error" }`
## Building
```sh
cargo +nightly build --release
```
You need to install the nightly toolchain with `rustup`:
```sh
rustup toolchain install nightly
```
## Setup
Before running, create the nftables table and sets, leroy expects these to exist:
```sh
#!/usr/sbin/nft -f
table inet leroy {
# Define our sets
set leroy4 {
type ipv4_addr;
timeout 60s;
size 65536;
flags timeout;
}
set leroy6 {
type ipv6_addr;
timeout 60s;
size 65536;
flags timeout;
}
chain input {
# accept everybody by default in this chain, with a really
# high priority so that we can reject them as early as
# possible in the Netfilter system
type filter hook input priority -900; policy accept;
# but if you match, you're out
ip saddr @leroy4 counter name leroyed reject with tcp reset
ip6 saddr @leroy6 counter name leroyed reject with tcp reset
}
chain output {
# accept everybody by default in this chain, with a really
# high priority so that we can reject them as early as
# possible in the Netfilter system
type filter hook output priority -900; policy accept;
# but if you match, you're out
ip daddr @leroy4 reject with tcp reset
ip6 daddr @leroy6 reject with tcp reset
}
}
```
## Examples
Because it reads from stdin and this is Unix, you can pipe stuff into it. Use `tail -F`, use `awk`, use `grep` or `rg` or `ag`.
### Dig some lines out of some application log and use them to ban
```sh
tail -F /var/log/app/app.ratelimit.log | ag 'naughty.behaviour' | stdbuf --output=L awk '{print $NF}' | leroyjenkins $LEROY_ARGS
```
### Ban random IPs!
Because it's Unix, use `bash` and `shuf` to ban a random IP every second for an hour with:
```sh
while sleep 1; do echo `shuf -i1-256 -n1`.`shuf -i1-256 -n1`.`shuf -i1-256 -n1`.`shuf -i1-256 -n1`; done | RUST_LOG=info ./target/release/leroyjenkins --bl-period=10s --bl-threshold=0 --ban-base-time=100s --ban-ttl=1h --table leroy --ipv6-set=leroy6 --ipv4-set=leroy4
```