diff --git a/docs/honeypot.md b/docs/honeypot.md index 42e10c8e..0ba59c4b 100644 --- a/docs/honeypot.md +++ b/docs/honeypot.md @@ -35,7 +35,7 @@ From this regex, we retrieve the host if the response matches code 418 which is ### Setup the Jail Then we need to create the jail in: -`/etc/fail2/ban/jail.d/honeypot.conf` +`/etc/fail2ban/jail.d/honeypot.conf` If you are using apache then the following will work: ```ini @@ -59,4 +59,4 @@ maxretry = 1 `maxretry` is set to 1 because we do not need to second guess those errors. Fail2ban is also used to ban ssh attempts after multiple failures, in such case a higher number of retry is need. As we interact with a honeypot, any behaviour touching it is therefore malicious, there are no false positive in our case -and we do not give the benefit of the doubt. \ No newline at end of file +and we do not give the benefit of the doubt.