Port 79 mostly attracts HTTP/SIP probes, TLS handshakes, and username
guessers -- none of which resolve to a plan file. Treat any request that
fails to read a plan as an "offense" and timestamp it against the source
IP.
Add BanTracker (ban.hpp/ban.cpp): a per-IP rolling-window offender list.
When an IP has more than 3 offenses still inside a 24h window, its
connections are dropped without being read or answered; timestamps older
than the window are pruned so a blocked IP frees itself automatically.
State is in-memory (single io_context thread, no locking); the clock is
injected for testability. A periodic sweeper keeps the map bounded.
Legitimate lookups that hit a real plan never count, which also
frustrates username enumeration. Unit tests in test_ban.cpp.
Stdout works in both contexts: docker logs captures it directly,
and on FreeBSD daemon(8) / the Bastille jail rc script can
redirect or pipe it to syslog as needed. Going through syslog
from inside the daemon required openlog/closelog and a libc
dependency that broke portability with no real benefit.
The Alpine/musl runtime can't exec our glibc-linked binary —
'exec /usr/local/bin/finger: no such file or directory'. The
recent syslog change pulls in fortify-source _chk symbols and
fcntl64 that musl doesn't provide even with gcompat. Matching
the runtime base to the builder (ubuntu:24.04) makes the image
reliably runnable; ship netcat-openbsd for the healthcheck.
The Alpine runtime stage uses BusyBox nc, which has no -z flag, and
'localhost' resolves to ::1 while finger only binds 0.0.0.0:79. Both
combined caused every healthcheck to fail (35k+ failing streak on
mammut). Use '-w 1 127.0.0.1 79 < /dev/null' instead.
pmb