This repository has been archived by the owner on Feb 15, 2024. It is now read-only.
Initial prototype release #30
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
atc0005
added
documentation
atc0005
force-pushed
the
initial-prototype-release
branch
from
6463558 to
344cd23
Compare
Features of the initial prototype release:
- Highly configurable (with more configuration choices to be exposed
in the future)
- Supports configuration settings from multiple sources
- command-line flags
- environment variables
- configuration file
- reasonable default settings
- Ignore individual usernames (i.e., prevent disabling listed accounts)
- Ignore individual IP Addresses (i.e., prevent disabling associated
account)
- User configurable logging settings
- levels, format and output
- Microsoft Teams notifications
- generated for multiple events
- alert received
- disabled user
- ignored user
- ignored IP Address
- error occurred
- configurable retries
- configurable notifications delay in order to respect remote API
limits
- Logging
- Payload receipt from monitoring system
- Action taken due to payload
- username ignored
- due to username inclusion in ignore file for usernames
- due to IP Address inclusion in ignore file for IP Addresses
- username disabled
- contrib files/content provided to allow for spinning up a demo
environment in order to provide a hands-on sense of what this
project can do
- fail2ban
- postfix
- docker
- Maildev container
- brick
- rsyslog
- systemd
- sample JSON payloads for use with curl or other http/API clients
- demo environment doc
- slides from group presentation/demo
Worth noting:
- Go modules (vs classic GOPATH setup)
- GitHub Actions Workflows which apply linting and build checks
- Makefile for general use cases (including local linting)
- Note: See README first if building on Windows
refs:
- GH-26
- GH-21
- GH-16
- GH-15
- GH-13
- GH-12
- GH-11
- GH-7
- GH-6
- GH-4
- GH-1
atc0005
force-pushed
the
initial-prototype-release
branch
from
344cd23 to
f102d0e
Compare
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Features
Features of the initial prototype release:
Highly configurable (with more configuration choices to be exposed
in the future)
Supports configuration settings from multiple sources
Ignore individual usernames (i.e., prevent disabling listed accounts)
Ignore individual IP Addresses (i.e., prevent disabling associated
account)
User configurable logging settings
Microsoft Teams notifications
limits
Logging
contrib files/content provided to allow for spinning up a demo
environment in order to provide a hands-on sense of what this
project can do
Worth noting
References
see also Research using "ezproxy kill" subcommand in place of fail2ban for terminating active sessions #31 (ongoing)
fixes Splunk Webhook request format #1
fixes Feature: Add support for Microsoft Teams notifications #4
fixes Document test Splunk alert recipe #6
fixes Protect output file updates from potential concurrent access #7
fixes Add leveled logging support #11
fixes Add systemd unit file example #12
fixes How can we programatically terminate a session? #13
fixes Add support for ignoring a list of user accounts #15
fixes Add support for ignoring a list of IP Addresses #16
fixes Create demo script(s) for setting up a test environment #21
fixes Synchronize help text between README, struct tags and struct doc comments #26