Fail2ban

yum --enablerepo=smecontribs install smeserver-fail2ban

yum --enablerepo=smecontribs install smeserver-fail2ban

db configuration setprop masq status enabled
expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf

db configuration setprop masq status enabled
signal-event post-upgrade; signal-event reboot

# config show sshd

# config setprop sshd AutoBlock disabled
# signal-event remoteaccess-update

# config show fail2ban 
fail2ban=service
   Mail=enabled
   status=enabled

signal-event fail2ban-conf

config setprop fail2ban IgnoreIP 12.15.22.4,17.20.0.0/16
signal-event fail2ban-conf

db configuration setprop httpd-e-smith Fail2Ban disabled
signal-event fail2ban-conf

[root@sme8 ~]# fail2ban-client status 
Status
|- Number of jail:	10
`- Jail list:		http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive

[root@sme8 ~]# fail2ban-client status ssh

nano /root/checklist_ban
#!/bin/bash
#lancer le script en sudo 
JAILS=$(fail2ban-client status | grep " Jail list:" | sed 's/`- Jail list://g' | sed 's/,//g')
for j in $JAILS
do
echo "$j $(fail2ban-client status $j | grep " Currently banned:" | sed 's/   |- Currently banned:\t//g')"
done

chmod 700 /root/checklist_ban

/root/checklist_ban

fail2ban-client status qpsmtpd

Status for the jail: qpsmtpd
|- filter
|  |- File list:	/var/log/qpsmtpd/current /var/log/sqpsmtpd/current 
|  |- Currently failed:	5
|  `- Total failed:	119
`- action
   |- Currently banned:	1
   |  `- IP list:	93.17.128.20 
   `- Total banned:	1

fail2ban-client status

fail2ban-client set qpsmtpd unbanip 93.17.128.20 

fail2ban-client set JAIL unbanip MYIP

/etc/e-smith/templates-custom/etc/fail2ban/jail.conf

mkdir -p  /etc/e-smith/templates-custom/etc/fail2ban/jail.conf

expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf

[DEFAULT]
ignoreip = 127.0.0.0/8 192.168.XXX.XXX 192.168.XXX.0/24
bantime  = 1800
findtime  = 900
maxretry = 3
usedns = yes
backend = auto

[ssh]
enabled  = true
filter   = sshd
logpath  = /var/log/sshd/current
action   = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="SSH",dest=root]

[ssh-ddos]
enabled  = true
filter   = sshd-ddos
logpath  = /var/log/sshd/current
action   = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="SSH",dest=root]

[qpsmtpd]
enabled  = true
filter   = qpsmtpd
logpath  = /var/log/*qpsmtpd/current
maxretry = 9
action   = smeserver-iptables[port="25,465",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Qpsmtpd",dest=root]

[http-overflows]
enabled  = true
filter   = apache-overflows
logpath  = /var/log/httpd/error_log
action   = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Apache (overflows)",dest=root]

[http-noscript]
enabled  = true
filter   = apache-noscript
logpath  = /var/log/httpd/error_log
action   = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Apache (noscript)",dest=root]

[http-scan]
enabled  = true
filter   = apache-scan
logpath  = /var/log/httpd/error_log
action   = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Apache (scan)",dest=root]

[http-auth]
enabled  = true
filter   = apache-auth
logpath  = /var/log/httpd/error_log
action   = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Apache (auth)",dest=root]

[pam-generic]
enabled  = true
filter   = pam-generic
logpath  = /var/log/secure
maxretry = 6
action   = smeserver-iptables[bantime=1800]
          smeserver-sendmail[name="PAM generic",dest=root]

[recidive]
enabled  = true
filter   = recidive
logpath  = /var/log/fail2ban/daemon.log
bantime  = 604800
findtime = 86400
maxretry = 5
backend  = polling
action   = smeserver-iptables[bantime=604800]
          smeserver-sendmail[name="Recidive",dest=root]

wget https://bugs.koozali.org/attachment.cgi?id=6229 -O /etc/fail2ban/filters.d/apache-badbots.local

yum remove smeserver-fail2ban fail2ban

fail2ban-regex [LOG] [REGEX]

fail2ban-regex /var/log/qpsmtpd/current /etc/fail2ban/filter.d/qpsmtpd.conf

^\s*\d+\s*logging::logterse plugin \(deny\): ` <HOST>\s*.*90\d.*msg denied before queued$

^\s*\d+\s*logging::logterse plugin \(deny\): \` <HOST>\s*.*90\d.*msg denied before queued$

mkdir /root/bin
nano -w /root/bin/IP_list.sh

#!/bin/sh
# Set CLI vars to something we can read
TYPE=$1
LOG=$2

# Set main grep string
SEARCH="Ban ((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])"

# Add the search term
SEARCH="\[$TYPE]\ $SEARCH"

# Now search the log
grep -oE "\[$TYPE\] Ban ((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])" $LOG

chmod 755 /root/bin/IP_list.sh

IP_list.sh [service] [log]

IP_list.sh qpsmtpd /var/log/fail2ban/daemon.log

mkdir /root/bin
vim /root/bin/sfail2ban

#!/bin/bash
for SERVI in $(fail2ban-client status|grep 'Jail list'|cut -d':' -f2|sed 's/, / /g'| sed -e 's/^[ \t]*//')
do
fail2ban-client status $SERVI |grep -E 'IP list|Status for the jail'|sed 'N;s/\n/:/'|cut -d: -f2,4
done

chmod 755 /root/bin/sfail2ban

sfail2ban

# sfail2ban
ftp:	 
imap:	 
pam-generic:	 
qpsmtpd:	 
recidive:	141.98.80.15
ssh:	
ssh-ddos:	
wordpress:	

mkdir -p /root/bin
vi /root/bin/bansummary.sh

#!/bin/bash
      echo -e \
      "IP             \t"\
      "BanTime             \t"\
      "UnbanTime           \t"\
      "Jail"
      
      for ban in $(db fail2ban show |awk -F\= ' $2=="ban" {print $1}'); 
        do
          IP=$(db fail2ban getprop $ban Host)
          Bantime=$(date +"%F %T" -d @$(db fail2ban getprop $ban BanTimestamp))
          UnBanTime=$(date +"%F %T" -d @$(db fail2ban getprop $ban UnbanTimestamp))
          LastJail=$(zgrep -H "Ban $IP" $(find /var/log/fail2ban -type f -ctime -7) |tail -1 |awk '{print $6}') 
      
          printf "%-15s" "$IP"
          echo -e "\t$Bantime\t$UnBanTime\t$LastJail"
        done
      

chmod 755 /root/bin/bansummary.sh

bansummary.sh

IP             	BanTime             	UnbanTime           	Jail
      46.246.39.228  	2017-09-09 18:45:00	2017-09-10 18:45:00	[http-scan]
      124.239.180.102	2017-09-09 12:07:32	2017-09-10 12:07:32	[http-scan]
      212.237.54.93  	2017-09-09 19:27:32	2017-09-10 19:27:32	[http-scan]

ID	Product	Version	Status	Summary (12 tasks) ⇒
12453	SME Contribs	10.0	CONFIRMED	extra coma leading to empty string fails ignore ip template fragment
12402	SME Contribs	10.0	UNCONFIRMED	Using smeserver-git makes smeserver-fail2ban ban even though whitelisted.
12285	SME Contribs	10.0	UNCONFIRMED	WARNING message in daemon log after reboot about ssh
12199	SME Contribs	10.0	CONFIRMED	add externalip /internal ip to whitelist
11805	SME Contribs	10.0	CONFIRMED	NFR: use fail2ban db to list banned host
11801	SME Contribs	10.0	CONFIRMED	NFR: add a permanent/custom or manual jail
10799	SME Contribs	Futur	CONFIRMED	NFR: Fail2ban OpenVPN routed templates
10798	SME Contribs	9.2	CONFIRMED	NFR convert long mask to bit mask if entered as long mask
10786	SME Contribs	9.2	CONFIRMED	lockout without a full masq restart
10638	SME Contribs	9.2	CONFIRMED	IgnoreIP entry created with trailing slash stopping f2b from working
10422	SME Contribs	9.2	UNCONFIRMED	NFR: portscan jail
8955	SME Contribs	9.2	UNCONFIRMED	Fail2Ban error in qpsmtpd.conf regex

Fail2ban

Contents

Fail2ban for SME Server

Maintainer

Description

Requirements

Koozali SME v9/v10

Installation Koozali SME

Disable SME Feature AutoBlock SME 9 or greater

DB command

Services

Selective bans

Use Fail2ban

List all jails

List IP banned from a specific jail

Example script which list How many ip are banned from all jails

Unban an IP

Jail.conf

default jail.conf

Custom local filters

Uninstall

User contributions

Testing new regex

Show IPs banned by service

Check the fail2ban log

Check the fail2ban banned IP for all active jails

Print a summary of the fail2ban db

WordPress

Bugs

Changelog

Navigation menu

Page actions

Page actions

Personal tools

Koozali SME Server

Recent activities

Koozali resources

Koozali SME Server wiki

Tools

Search

	Skill level: Easy
	The instructions on this page can be followed by a beginner.

	Tip:
	fail2ban is not only a tool against brute force attack on ssh but it can be a tool useful against http protocol attacks or spam attacks on your server. See the jail section

	Note:
	The SME feature AutoBlock SSH should be disabled to ensure that fail2ban controls SSH traffic and not the SME build-in firewall.

	Warning:
	Failing to run either of these command will completely lock network access next time iptables rules are reloaded

	Warning:
	The masq service must be enabled for fail2Ban to work correctly. If you disable it, Fail2ban won't ban anything

	Note:
	`signal-event fail2ban-conf` effectively restarts the service and clears existing bans, but a suitable 'findtime' results in a reban. Be aware that the restart delay can be unexpectedly lengthy due to the resource intensive process of scanning the logs to reban offending addresses.

	Note:
	Your network and your server are in the list of ignored IP by fail2ban (see IgnoreIP)