NAME
kur - Firewall ban manager worker for Ereshkigal.
SYNOPSIS
kur --name=<name> --backend=<backend> [--ports=<ports>] [--protocols=<protocols>] [--prefix=<prefix>] [--option <key>=<value>] [--interfaces=<interfaces>] [--self-heal <0/1>] [--ban-time=<seconds>] [--checkpoint=<seconds>] [--enable-cidr <0/1>] [--cidr-silent-drop <0/1>] [--cache=<cache dir>] [--run=<run dir>] [-f|--foreground]
kur -v|--version
kur -h|--help
DESCRIPTION
Runs a single Net::Firewall::BlockerHelper instance via Ereshkigal::Kur, serving it up on a unix socket speaking the newline delimited JSON protocol of POE::Component::Server::JSONUnix.
The socket and PID file go under $run_dir/kur/, named for the instance... <name>.sock and <name>.pid.
Normally spawned and supervised by ereshkigal, but usable standalone.
FLAGS
-v|--version
Show version info.
-h|--help
Show help info.
--name=<name>
The name to use for this instance. Must match /^[a-zA-Z0-9\-]+$/.
This must be specified.
--backend=<backend>
The Net::Firewall::BlockerHelper backend to use.
This must be specified.
--ports=<ports>
A comma separated list of ports to block. Each must be a positive integer or a name resolvable via getservbyname.
If not specified, all are blocked.
--protocols=<protocols>
A comma separated list of protocols to block. Each is checked against /etc/protocols via the function getprotobyname.
If not specified, all are blocked.
--prefix=<prefix>
The prefix to use. Must match /^[a-zA-Z0-9]+$/.
Default is kur.
--option <key>=<value>
A backend specific option. May be specified multiple times.
--interfaces=<interfaces>
A comma separated list of interfaces, handed to the backend as the interfaces option as an array. Wanted by backends taking an array of interfaces there, such as xdp.
--self-heal <0/1>
If the firewall setup should be verified and re-inited if needed before each ban or unban.
Default is 1.
--ban-time <seconds>
How long bans should last in seconds. 0 means bans never time out. May be overridden per ban request.
Default is 600.
--checkpoint <seconds>
Seconds between periodic rewrites of the ban state CSV under the cache dir. 0 disables the periodic rewrite... ban/unban, stop, and on demand checkpoints still happen.
Default is 60.
--enable-cidr <0/1>
Whether CIDR banning is enabled. Even when set, CIDR commands only work if the backend supports CIDR bans.
Default is 0.
--cidr-silent-drop <0/1>
When set, CIDR commands are silently dropped rather than erroring when CIDR banning is not available for this instance.
Default is 0.
--run=<run dir>
The base dir for run files.
Default is /var/run/ereshkigal
--cache=<cache dir>
The base dir for cache files.
Default is /var/cache/ereshkigal
-f|--foreground
Do not daemonize. This is used by ereshkigal when spawning kur instances so they can be supervised.