103 lines
1.6 KiB
Text
103 lines
1.6 KiB
Text
#
|
|
# /etc/security/shield.conf
|
|
#
|
|
|
|
#
|
|
# log debugging info to syslog
|
|
#
|
|
debug off
|
|
|
|
#
|
|
# block all-users blocks only unknown users
|
|
# block all-users blocks everyone
|
|
#
|
|
block all-users
|
|
|
|
#
|
|
# is it OK for the remote host to have no DNS entry?
|
|
#
|
|
allow_missing_dns yes
|
|
|
|
#
|
|
# is it OK for the remote host to have no reverse DNS entry?
|
|
#
|
|
allow_missing_reverse yes
|
|
|
|
#
|
|
# allow these hosts or networks by name
|
|
#
|
|
allow localhost
|
|
# allow .localdomain
|
|
|
|
#bastion
|
|
allow 10.5.126.11
|
|
allow 10.5.126.12
|
|
allow 192.168.0.1
|
|
#lockbox
|
|
allow 10.5.126.23
|
|
# don't block lockbox's remote addr, either
|
|
allow 209.132.181.6
|
|
|
|
#noc1
|
|
allow noc1.phx2.fedoraproject.org
|
|
allow 10.5.126.41
|
|
allow 192.168.1.10
|
|
allow 209.132.181.35
|
|
|
|
# RDU NAT
|
|
allow 66.187.233.202
|
|
allow 66.187.233.206
|
|
# RH NAT
|
|
allow 66.187.230.200
|
|
# PHX2 NAT
|
|
allow 209.132.181.102
|
|
# tlv RHT NAT
|
|
allow 66.187.237.10
|
|
# brno RHT NAT
|
|
allow 209.132.186.34
|
|
# IUD RHT NAT
|
|
allow 66.187.233.203
|
|
|
|
#
|
|
# never lock out this network
|
|
# You should list all your local networks here to make sure no local user can
|
|
# lock you out from the inside
|
|
#
|
|
allow 127.0.0.1/255.0.0.0
|
|
|
|
# this syntax is also supported:
|
|
#allow 127.0.0.1/8
|
|
|
|
|
|
#
|
|
# location of the database file
|
|
#
|
|
db /var/lib/pam_shield/db
|
|
|
|
#
|
|
# external command that is run when a site should be blocked/unblocked
|
|
#
|
|
trigger_cmd /usr/sbin/shield-trigger
|
|
|
|
#
|
|
# number of connections per interval from one site that triggers us
|
|
#
|
|
max_conns 15
|
|
|
|
#
|
|
# the interval and retention period may be specified in seconds, or
|
|
# with a postfix:
|
|
#
|
|
# 1s seconds 1w weeks
|
|
# 1m minutes 1M months (30 days)
|
|
# 1h hours 1y years
|
|
# 1d days
|
|
#
|
|
interval 5m
|
|
|
|
#
|
|
# period until the entry expires from the database again
|
|
#
|
|
retention 5d
|
|
|
|
# EOB
|