5 files changed, 87 insertions, 0 deletions
diff --git a/share/fail2ban/filter.d/hybbx-circuit.conf b/share/fail2ban/filter.d/hybbx-circuit.conf
new file mode 100644
index 0000000..901e8a2
--- /dev/null
+++ b/share/fail2ban/filter.d/hybbx-circuit.conf
@@ -0,0 +1,10 @@
+# HyBBX HBX circuit link authentication failures (security.log).
+# Matches failed LINK_AUTH on [circuit] port (default 7323).
+
+[INCLUDES]
+before = common.conf
+
+[Definition]
+_daemon = hybbx
+failregex = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} link_auth_fail ip=<HOST> .*transport=circuit
+ignoreregex =
diff --git a/share/fail2ban/filter.d/hybbx-ssh.conf b/share/fail2ban/filter.d/hybbx-ssh.conf
new file mode 100644
index 0000000..407be52
--- /dev/null
+++ b/share/fail2ban/filter.d/hybbx-ssh.conf
@@ -0,0 +1,11 @@
+# HyBBX SSH transport login brute-force (security.log).
+# Enable when [transport.ssh] is running and logs login_fail
+# with transport=ssh to security.log.
+
+[INCLUDES]
+before = common.conf
+
+[Definition]
+_daemon = hybbx
+failregex = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} login_fail ip=<HOST> user=.* transport=ssh
+ignoreregex =
diff --git a/share/fail2ban/filter.d/hybbx-telnet.conf b/share/fail2ban/filter.d/hybbx-telnet.conf
new file mode 100644
index 0000000..f6dfa53
--- /dev/null
+++ b/share/fail2ban/filter.d/hybbx-telnet.conf
@@ -0,0 +1,10 @@
+# HyBBX telnet login brute-force (security.log).
+# Install: copy to /etc/fail2ban/filter.d/ and enable hybbx-telnet in jail.d.
+
+[INCLUDES]
+before = common.conf
+
+[Definition]
+_daemon = hybbx
+failregex = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} login_fail ip=<HOST> user=.* transport=telnet
+ignoreregex =
diff --git a/share/fail2ban/filter.d/hybbx-websocket.conf b/share/fail2ban/filter.d/hybbx-websocket.conf
new file mode 100644
index 0000000..2166ee7
--- /dev/null
+++ b/share/fail2ban/filter.d/hybbx-websocket.conf
@@ -0,0 +1,11 @@
+# HyBBX WebSocket transport login brute-force (security.log).
+# Enable when [transport.websocket] is running and logs login_fail
+# with transport=websocket to security.log.
+
+[INCLUDES]
+before = common.conf
+
+[Definition]
+_daemon = hybbx
+failregex = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} login_fail ip=<HOST> user=.* transport=websocket
+ignoreregex =
diff --git a/share/fail2ban/jail.d/hybbx.local.example b/share/fail2ban/jail.d/hybbx.local.example
new file mode 100644
index 0000000..3d91296
--- /dev/null
+++ b/share/fail2ban/jail.d/hybbx.local.example
@@ -0,0 +1,45 @@
+# Example fail2ban jails for HyBBX security.log
+#
+# HyBBX v2.0.0+ includes built-in [security] bans — these filters are optional
+# for site-wide iptables/nftables integration alongside the daemon.
+#
+# 1. Copy filter.d/*.conf to /etc/fail2ban/filter.d/
+# 2. Copy this file to /etc/fail2ban/jail.d/hybbx.local
+# 3. Set logpath to your HyBBX logs directory ([log] dir in hybbx.ini)
+# 4. sudo fail2ban-client reload
+
+[hybbx-telnet]
+enabled = true
+filter = hybbx-telnet
+port = 2323
+logpath = /usr/local/hybbx/logs/security.log
+maxretry = 5
+findtime = 600
+bantime = 600
+
+[hybbx-circuit]
+enabled = true
+filter = hybbx-circuit
+port = 7323
+logpath = /usr/local/hybbx/logs/security.log
+maxretry = 5
+findtime = 600
+bantime = 600
+
+[hybbx-ssh]
+enabled = false
+filter = hybbx-ssh
+port = 3232
+logpath = /usr/local/hybbx/logs/security.log
+maxretry = 5
+findtime = 600
+bantime = 600
+
+[hybbx-websocket]
+enabled = false
+filter = hybbx-websocket
+port = 4591
+logpath = /usr/local/hybbx/logs/security.log
+maxretry = 5
+findtime = 600
+bantime = 600