Damien/infra-scripts
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(proxy): exclure les 401 git-over-HTTPS du jail traefik #23

Closed
Damien wants to merge 2 commits from fix/proxy-jail-git-401 into main
pull from: fix/proxy-jail-git-401
merge into: :main
Conversation 2 Commits 2 Files Changed 1
+7 -1
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/install.sh
+7 -1
View File
@@ -158,7 +158,13 @@ main() {
# Two patterns cover both possible field orderings in the JSON. # Two patterns cover both possible field orderings in the JSON.
failregex = ^.*"ClientHost":"<HOST>".*"DownstreamStatus":(401|403|429|5[0-9]{2}) failregex = ^.*"ClientHost":"<HOST>".*"DownstreamStatus":(401|403|429|5[0-9]{2})
^.*"DownstreamStatus":(401|403|429|5[0-9]{2}).*"ClientHost":"<HOST>" ^.*"DownstreamStatus":(401|403|429|5[0-9]{2}).*"ClientHost":"<HOST>"
ignoreregex = # Git smart-HTTP always does an unauthenticated request first, gets a 401
# WWW-Authenticate challenge, then retries with credentials. That first 401
# is protocol, not abuse — without this exclusion a handful of git
# clone/fetch/push in a few minutes bans the client on a private repo.
# Same two-orderings caveat as failregex above.
ignoreregex = ^.*"RequestPath":"[^"]*/(info/refs|git-upload-pack|git-receive-pack)[^"]*".*"DownstreamStatus":401
^.*"DownstreamStatus":401.*"RequestPath":"[^"]*/(info/refs|git-upload-pack|git-receive-pack)[^"]*"
EOF EOF
sudo tee /etc/fail2ban/jail.d/traefik.conf > /dev/null << 'EOF' sudo tee /etc/fail2ban/jail.d/traefik.conf > /dev/null << 'EOF'