1.\" $NetBSD: blacklistd.conf.5,v 1.9 2019/11/06 20:33:30 para Exp $
2.\"
3.\" Copyright (c) 2015 The NetBSD Foundation, Inc.
4.\" All rights reserved.
5.\"
6.\" This code is derived from software contributed to The NetBSD Foundation
7.\" by Christos Zoulas.
8.\"
9.\" Redistribution and use in source and binary forms, with or without
10.\" modification, are permitted provided that the following conditions
11.\" are met:
12.\" 1. Redistributions of source code must retain the above copyright
13.\"    notice, this list of conditions and the following disclaimer.
14.\" 2. Redistributions in binary form must reproduce the above copyright
15.\"    notice, this list of conditions and the following disclaimer in the
16.\"    documentation and/or other materials provided with the distribution.
17.\"
18.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
19.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
20.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
21.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
22.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28.\" POSSIBILITY OF SUCH DAMAGE.
29.\"
30.Dd May 18, 2020
31.Dt BLACKLISTD.CONF 5
32.Os
33.Sh NAME
34.Nm blacklistd.conf
35.Nd configuration file format for blacklistd
36.Sh DESCRIPTION
37The
38.Nm
39file contains configuration entries for
40.Xr blacklistd 8
41in a fashion similar to
42.Xr inetd.conf 5 .
43Only one entry per line is permitted.
44Every entry must have all fields populated.
45Each field can be separated by a tab or a space.
46Comments are denoted by a
47.Dq #
48at the beginning of a line.
49.Pp
50There are two kinds of configuration lines,
51.Va local
52and
53.Va remote .
54By default, configuration lines are
55.Va local ,
56i.e. the address specified refers to the addresses on the local machine.
57To switch to between
58.Va local
59and
60.Va remote
61configuration lines you can specify the stanzas:
62.Dq [local]
63and
64.Dq [remote] .
65.Pp
66On
67.Va local
68and
69.Va remote
70lines
71.Dq *
72means use the default, or wildcard match.
73In addition, for
74.Va remote
75lines
76.Dq =
77means use the values from the matched
78.Va local
79configuration line.
80.Pp
81The first four fields,
82.Va location ,
83.Va type ,
84.Va proto ,
85and
86.Va owner
87are used to match the
88.Va local
89or
90.Va remote
91addresses, whereas the last 3 fields
92.Va name ,
93.Va nfail ,
94and
95.Va disable
96are used to modify the filtering action.
97.Pp
98The first field denotes the
99.Va location
100as an address, mask, and port.
101The syntax for the
102.Va location
103is:
104.Bd -literal -offset indent
105	[<address>|<interface>][/<mask>][:<port>]
106.Ed
107.Pp
108The
109.Dv address
110can be an IPv4 address in numeric format, an IPv6 address
111in numeric format and enclosed by square brackets, or an interface name.
112Mask modifiers are not allowed on interfaces because interfaces
113can have multiple addresses in different protocols where the mask has a different
114size.
115.Pp
116The
117.Dv mask
118is always numeric, but the
119.Dv port
120can be either numeric or symbolic.
121.Pp
122The second field is the socket
123.Va type :
124.Dv stream ,
125.Dv dgram ,
126or numeric.
127The third field is the
128.Va protocol :
129.Dv tcp ,
130.Dv udp ,
131.Dv tcp6 ,
132.Dv udp6 ,
133or numeric.
134The fourth field is the effective user
135.Va ( owner )
136of the daemon process reporting the event,
137either as a username or a userid.
138.Pp
139The rest of the fields control the behavior of the filter.
140.Pp
141The
142.Va name
143field, is the name of the packet filter rule to be used.
144If the
145.Va name
146starts with a
147.Dq - ,
148then the default rulename is prepended to the given name.
149If the
150.Dv name
151contains a
152.Dq / ,
153the remaining portion of the name is interpreted as the mask to be
154applied to the address specified in the rule, causing a single rule violation to
155block the entire subnet for the configured prefix.
156.Pp
157The
158.Va nfail
159field contains the number of failed attempts before access is blocked,
160defaulting to
161.Dq *
162meaning never, and the last field
163.Va disable
164specifies the amount of time since the last access that the blocking
165rule should be active, defaulting to
166.Dq *
167meaning forever.
168The default unit for
169.Va disable
170is seconds, but one can specify suffixes for different units, such as
171.Dq m
172for minutes
173.Dq h
174for hours and
175.Dq d
176for days.
177.Pp
178Matching is done first by checking the
179.Va local
180rules individually, in the order of the most specific to the least specific.
181If a match is found, then the
182.Va remote
183rules are applied.
184The
185.Va name ,
186.Va nfail ,
187and
188.Va disable
189fields can be altered by the
190.Va remote
191rule that matched.
192.Pp
193The
194.Va remote
195rules can be used for allowing specific addresses, changing the mask
196size, the rule that the packet filter uses, the number of failed attempts,
197or the block duration.
198.Sh FILES
199.Bl -tag -width /etc/blacklistd.conf -compact
200.It Pa /etc/blacklistd.conf
201Configuration file.
202.El
203.Sh EXAMPLES
204.Bd -literal -offset 8n
205# Block ssh, after 3 attempts for 6 hours on the bnx0 interface
206[local]
207# location	type	proto	owner	name	nfail	duration
208bnx0:ssh	*	*	*	*	3	6h
209[remote]
210# Never block 1.2.3.4
2111.2.3.4:ssh	*	*	*	*	*	*
212# For addresses coming from 8.8.0.0/16 block class C networks instead
213# individual hosts, but keep the rest of the blocking parameters the same.
2148.8.0.0/16:ssh	*	*	*	/24	=	=
215.Ed
216.Sh SEE ALSO
217.Xr blacklistctl 8 ,
218.Xr blacklistd 8
219.Sh HISTORY
220.Nm
221first appeared in
222.Nx 7 .
223.Fx
224support for
225.Nm
226was implemented in
227.Fx 11 .
228.Sh AUTHORS
229.An Christos Zoulas
230