2

I'm using a map configuration to block IP addresses with nginx + fail2ban

The sample configuration genrator code in fail2ban repo looks like this :

...
_echo_blck_row = printf '\%%s 1;\n' "<fid>"
actionban = %(_echo_blck_row)s >> '%(blck_lst_file)s'; %(blck_lst_reload)s
...

Note the leading backslash in \%%s 1;\n. It creates a file with IP addresses that have a leading backslash before each IP address i.e. it dumps a file like this

\127.0.0.1    1;

instead of simply

127.0.0.1    1;

Both the configurations are correct. What's the purpose of the backslash at the start of the IP address in this file ?

user
  • 17,781
  • 20
  • 98
  • 124

1 Answers1

1

From the manual page:

If a source value matches one of the names of special parameters described below, it should be prefixed with the “\” symbol.

So it's unnecessary (but harmless) for values such as 127.0.0.1, but it defends against using hostnames such as default, hostnames, volatile or include, which are considered "special parameters" within the map block.

Richard Smith
  • 45,711
  • 6
  • 82
  • 81