# nono : say "no no" to intruders

This is a tool to parse logs and ban ip when they have inappropriate
behaviour.

First, you need to setup pf and create a table of banned ip : 

```/etc/pf.conf
table <bot> persist
block in quick on egress from <bot> to any
```

If you don't want to run nono as root (it's probably better), create a dedicated user:

```
# useradd -s /sbin/nologin -m -d /var/empty _nono
```

Then, setup doas so _nono don't need to enter its password : 

```/etc/doas.conf
permit nopass _nono cmd /sbin/pfctl
```

Once ready, you can pass any logs to nono:

```
nono /var/log/authlog /var/log/maillog
```

## Options

Set options with flags "-v var=something".
Available options are:

  * TRIES=5 : Maximum attemps an IP can do.
  * BANCMD="doas -u _nono pfctl -T add -t bot" : command to ban an IP. Set to "echo" to just see what happens.
  * KILLSTATE="doas -u _nono pfctl -k " : command to kill all states with an ip
  * IGNORE=/etc/nono.ignore : file containing ignored IP, one per line.

## Expire

You may want to set a cron task to release IP after some time : 

```
pfctl -t bot -T expire "$(( 60 * 60 * 24 * $EXPIRE_DAYS ))"
```

## Trivia

Previous attempt to build such tool was named vilan : https://framagit.org/prx/vilain
Original idea by solene : https://dataswamp.org/~solene/2023-06-22-opensmtpd-block-attempts.html

