5,576
edits
Changes
From SME Server
Jump to navigationJump to searchCreated page with "{{Languages|Smeserver-fail2ban}} == Fail2ban for SME Server == {{Level|Easy|The instructions on this page can be followed by a beginner.}} === Maintainer === [[User:VIP-ire|..."
{{Languages|Smeserver-fail2ban}}
== Fail2ban for SME Server ==
{{Level|Easy|The instructions on this page can be followed by a beginner.}}
=== Maintainer ===
[[User:VIP-ire|Daniel B.]]<br/>
[http://www.firewall-services.com Firewall Services]<br>
mailto:daniel@firewall-services.com
=== Description ===
Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator.
Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.
=== Requirements ===
This contrib has been developped and tested on SME Server 8 and later. It probably won't work on SME 7.
=== Installation ===
Configure Firewall-Services's repository:
db yum_repositories set fws repository \
BaseURL http://repo.firewall-services.com/centos/\$releasever \
EnableGroups no GPGCheck yes \
Name "Firewall Services" \
GPGKey http://repo.firewall-services.com/RPM-GPG-KEY \
Visible yes status disabled
Configure EPEL's repository:
For SME 8.x,
/sbin/e-smith/db yum_repositories set epel repository \
Name 'Epel - EL5' \
BaseUrl 'http://download.fedoraproject.org/pub/epel/5/$basearch' \
MirrorList 'http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=$basearch' \
EnableGroups no \
GPGCheck yes \
GPGKey http://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL \
Visible no \
status disabled
signal-event yum-modify
*install the rpms
yum --enablerepo=fws --enablerepo=epel install smeserver-fail2ban
{{note box| you have to install the fail2ban version of fws repository and not the epel version}}
* Appply the needed configuration:
expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf
or
signal-event post-upgrade; signal-event reboot
===DB command===
there is no panel yet you can manage the contrib by the db configuration, it is quite simple
# config show fail2ban
fail2ban=service
Mail=enabled
status=enabled
===Jail.conf===
The jail.conf is templated and the default file contains the configuration as below. You can add your own template of jail.conf at
/etc/e-smith/templates/etc/fail2ban/jail.conf
and do this to expland templates
expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf
====default jail.conf====
[DEFAULT]
ignoreip = 127.0.0.0/8 192.168.12.210 192.168.12.0/24
bantime = 1800
findtime = 900
maxretry = 3
usedns = yes
backend = auto
[ssh]
enabled = true
filter = sshd
logpath = /var/log/sshd/current
action = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
smeserver-sendmail[name="SSH",dest=root]
[ssh-ddos]
enabled = true
filter = sshd-ddos
logpath = /var/log/sshd/current
action = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
smeserver-sendmail[name="SSH",dest=root]
[qpsmtpd]
enabled = true
filter = qpsmtpd
logpath = /var/log/*qpsmtpd/current
maxretry = 9
action = smeserver-iptables[port="25,465",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Qpsmtpd",dest=root]
[http-overflows]
enabled = true
filter = apache-overflows
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (overflows)",dest=root]
[http-noscript]
enabled = true
filter = apache-noscript
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (noscript)",dest=root]
[http-scan]
enabled = true
filter = apache-scan
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (scan)",dest=root]
[http-auth]
enabled = true
filter = apache-auth
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (auth)",dest=root]
[pam-generic]
enabled = true
filter = pam-generic
logpath = /var/log/secure
maxretry = 6
action = smeserver-iptables[bantime=1800]
smeserver-sendmail[name="PAM generic",dest=root]
[recidive]
enabled = true
filter = recidive
logpath = /var/log/fail2ban/daemon.log
bantime = 604800
findtime = 86400
maxretry = 5
backend = polling
action = smeserver-iptables[bantime=604800]
smeserver-sendmail[name="Recidive",dest=root]
=== Uninstall ===
yum remove smeserver-fail2ban
=== Bugs ===
Please raise bugs under the SME-Contribs section in [http://bugs.contribs.org/enter_bug.cgi bugzilla]
and select the smeserver-fail2ban component or use {{BugzillaFileBug|product=SME%20Contribs|component=smeserver-fail2ban|title=this link}}.
<nowiki><noinclude>[[Category: Contrib]]</noinclude></nowiki>
== Fail2ban for SME Server ==
{{Level|Easy|The instructions on this page can be followed by a beginner.}}
=== Maintainer ===
[[User:VIP-ire|Daniel B.]]<br/>
[http://www.firewall-services.com Firewall Services]<br>
mailto:daniel@firewall-services.com
=== Description ===
Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator.
Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.
=== Requirements ===
This contrib has been developped and tested on SME Server 8 and later. It probably won't work on SME 7.
=== Installation ===
Configure Firewall-Services's repository:
db yum_repositories set fws repository \
BaseURL http://repo.firewall-services.com/centos/\$releasever \
EnableGroups no GPGCheck yes \
Name "Firewall Services" \
GPGKey http://repo.firewall-services.com/RPM-GPG-KEY \
Visible yes status disabled
Configure EPEL's repository:
For SME 8.x,
/sbin/e-smith/db yum_repositories set epel repository \
Name 'Epel - EL5' \
BaseUrl 'http://download.fedoraproject.org/pub/epel/5/$basearch' \
MirrorList 'http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=$basearch' \
EnableGroups no \
GPGCheck yes \
GPGKey http://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL \
Visible no \
status disabled
signal-event yum-modify
*install the rpms
yum --enablerepo=fws --enablerepo=epel install smeserver-fail2ban
{{note box| you have to install the fail2ban version of fws repository and not the epel version}}
* Appply the needed configuration:
expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf
or
signal-event post-upgrade; signal-event reboot
===DB command===
there is no panel yet you can manage the contrib by the db configuration, it is quite simple
# config show fail2ban
fail2ban=service
Mail=enabled
status=enabled
===Jail.conf===
The jail.conf is templated and the default file contains the configuration as below. You can add your own template of jail.conf at
/etc/e-smith/templates/etc/fail2ban/jail.conf
and do this to expland templates
expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf
====default jail.conf====
[DEFAULT]
ignoreip = 127.0.0.0/8 192.168.12.210 192.168.12.0/24
bantime = 1800
findtime = 900
maxretry = 3
usedns = yes
backend = auto
[ssh]
enabled = true
filter = sshd
logpath = /var/log/sshd/current
action = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
smeserver-sendmail[name="SSH",dest=root]
[ssh-ddos]
enabled = true
filter = sshd-ddos
logpath = /var/log/sshd/current
action = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
smeserver-sendmail[name="SSH",dest=root]
[qpsmtpd]
enabled = true
filter = qpsmtpd
logpath = /var/log/*qpsmtpd/current
maxretry = 9
action = smeserver-iptables[port="25,465",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Qpsmtpd",dest=root]
[http-overflows]
enabled = true
filter = apache-overflows
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (overflows)",dest=root]
[http-noscript]
enabled = true
filter = apache-noscript
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (noscript)",dest=root]
[http-scan]
enabled = true
filter = apache-scan
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (scan)",dest=root]
[http-auth]
enabled = true
filter = apache-auth
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (auth)",dest=root]
[pam-generic]
enabled = true
filter = pam-generic
logpath = /var/log/secure
maxretry = 6
action = smeserver-iptables[bantime=1800]
smeserver-sendmail[name="PAM generic",dest=root]
[recidive]
enabled = true
filter = recidive
logpath = /var/log/fail2ban/daemon.log
bantime = 604800
findtime = 86400
maxretry = 5
backend = polling
action = smeserver-iptables[bantime=604800]
smeserver-sendmail[name="Recidive",dest=root]
=== Uninstall ===
yum remove smeserver-fail2ban
=== Bugs ===
Please raise bugs under the SME-Contribs section in [http://bugs.contribs.org/enter_bug.cgi bugzilla]
and select the smeserver-fail2ban component or use {{BugzillaFileBug|product=SME%20Contribs|component=smeserver-fail2ban|title=this link}}.
<nowiki><noinclude>[[Category: Contrib]]</noinclude></nowiki>
