{
"event": "PreToolUse",
"tool_name": "Bash",
"tool_input": {
"command": "ssh root@prod.karlkratz.com \"nft list ruleset 2>&1 | grep 'addr-set-\\|f2b-'\" 2>&1",
"timeout": 15000,
"description": "Search for any rule referencing f2b sets"
}
}
{
"tool_response": {
"stdout": "table inet f2b-table {\n\tset addr-set-apache-auth {\n\tset addr-set-apache-badbots {\n\tset addr-set-recidive {\n\tset addr-set-apache-denied {\n\tset addr-set-postfix-aggressive {\n\tset addr-set-postfix-ddos {\n\tset addr-set-apache-php-probe {\n\tset addr-set-apache-ssl-probe {\n\tset addr-set-apache-path-traversal {\n\tset addr-set-apache-rewrite-inject {\n\tset addr-set-apache-dirlist {\n\tset addr-set-karlkratz-bot {\n\tset addr-set-nginx-bad-request {\n\tset addr-set-nginx-scan {\n\tset addr-set-postfix-sasl {\n\tset addr-set-apache-scan {\n\tchain f2b-chain {\n\t\tmeta l4proto tcp ip saddr @addr-set-apache-auth reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-apache-badbots reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-recidive reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-apache-denied reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-postfix-aggressive reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-postfix-ddos reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-apache-php-probe reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-apache-ssl-probe reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-apache-path-traversal reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-apache-rewrite-inject reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-apache-dirlist reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-karlkratz-bot reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-nginx-bad-request reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-nginx-scan reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-postfix-sasl reject with icmp port-unreachable\n\t\ttcp dport 22 ip saddr @addr-set-postfix-sasl reject with icmp port-unreachable\n\t\ttcp dport 22 ip saddr @addr-set-apache-scan reject with icmp port-unreachable\n\t\tmeta l4proto tcp ip saddr @addr-set-apache-scan reject with icmp port-unreachable",
"stderr": "",
"interrupted": false,
"isImage": false,
"noOutputExpected": false
}
}