Fine tuning#7
Merged
jsrobinson3 merged 7 commits intomainfrom Feb 27, 2026
Merged
Conversation
- mod_evasive now independently enabled/disabled via `waf evasive enable/disable` with standard (high threshold) and strict profiles - Add DOSSystemCommand structured logging for Loki ingestion - Add Grafana insight dashboard for mod_evasive block events - Add `mtls allowlist show/add/remove` commands to manage all IPs in the mTLS RequireAny block (NodePing-managed IPs are protected) - Update docs and README with mod_evasive profiles and commands Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Previously, existing IPs found in one .htaccess (e.g. NDP) were only merged into that file. SiPbx and LiCf would get just 127.0.0.1. Now collect_existing_ips() gathers IPs from all targets + cache upfront so every file gets the same full set. Also adds future annotations to mtls_commands for Python 3.8/3.9 compat.
Replace single-line click.prompt with a loop that reads one IP per line until a blank line. Pasting multiple IPs on separate lines now works instead of spilling into subsequent confirm prompts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nssec waf evasive enable/disable/statuswith standard and strict profiles, RFC 1918 whitelisting, structured logging for Loki/Grafana ingestion, anda pre-built Grafana insight dashboard (
modEvasive.json)nssec mtls allowlist show/add/removeto manage IPs in the mTLS RequireAny block;nssec mtls nodeping fetchto sync NodePing monitoring IPsnssec waf restrict init/show/add/remove/reapplyto automate IP allowlists on sensitive NetSapiens paths (SiPbx Admin UI, ns-api, NDP, LiCf Recording) per theNS "Securing Your System" guide. IP cache at
/etc/nssec/restrict-ips.jsonsurvives NS package upgradesfrom __future__ import annotations), mod_evasive decoupled from WAF mode so it can be toggled independentlyNew CLI commands
nssec waf evasive enable [--profile standard|strict]nssec waf evasive disablenssec waf evasive statusnssec waf restrict init [--ip IP]nssec waf restrict shownssec waf restrict add IPnssec waf restrict remove IPnssec waf restrict reapplynssec mtls allowlist shownssec mtls allowlist add IPnssec mtls allowlist remove IPnssec mtls nodeping fetchTest plan
nssec waf restrict initon Core, NDP, and Combo serversnssec waf restrict reapplyafter simulated NS upgradenssec waf evasive enable --profile standardand verify thresholds in confignssec mtls allowlist add/removeon NDP server