62
edits
Changes
From SME Server
Jump to navigationJump to searchCreated page with "{{Languages|Smeserver-fail2ban}} == Fail2ban for SME Server == {{Level|Easy|The instructions on this page can be followed by a beginner.}} === Maintainer === [[User:VIP-ire|..."
{{Languages|Smeserver-fail2ban}}
== Fail2ban for SME Server ==
{{Level|Easy|The instructions on this page can be followed by a beginner.}}
=== Maintainer ===
[[User:VIP-ire|Daniel B.]]<br/>
[http://www.firewall-services.com Firewall Services]<br>
mailto:daniel@firewall-services.com
=== Description ===
Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator.
Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.
{{Tip box|fail2ban is not only a tool against brute force attack on ssh but it can be a tool useful against http protocol attacks or [http://forums.contribs.org/index.php/topic,50162.msg252195.html#msg252195 spam attacks] on your server. See the [[Fail2ban#Jail.conf |jail section]]}}
=== Requirements ===
This contrib has been developped and tested on SME Server 8 and later. It probably won't work on SME 7.
{{Note box|The SME feature [http://wiki.contribs.org/AutoBlock AutoBlock SSH] should be disabled to ensure that fail2ban controls SSH traffic and not the SME build-in firewall.}}
=== Installation ===
Configure Firewall-Services's repository:
db yum_repositories set fws repository \
BaseURL http://repo.firewall-services.com/centos/\$releasever \
EnableGroups no GPGCheck yes \
Name "Firewall Services" \
GPGKey http://repo.firewall-services.com/RPM-GPG-KEY \
Visible yes status disabled
Configure EPEL's repository:
For SME 8.x,
/sbin/e-smith/db yum_repositories set epel repository \
Name 'Epel - EL5' \
BaseUrl 'http://download.fedoraproject.org/pub/epel/5/$basearch' \
MirrorList 'http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=$basearch' \
EnableGroups no \
GPGCheck yes \
GPGKey http://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL \
Visible no \
status disabled
signal-event yum-modify
*install the rpms
yum --enablerepo=fws --enablerepo=epel install smeserver-fail2ban
{{note box| you have to install the fail2ban version of fws repository and not the epel version}}
* Appply the needed configuration:
expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf
or
signal-event post-upgrade; signal-event reboot
{{warning box| Failing to run either of these command will completly lock network access next time iptables rules are reloaded}}
===DB command===
there is no panel yet you can manage the contrib by the db configuration, it is quite simple
# config show fail2ban
fail2ban=service
Mail=enabled
status=enabled
Available options are below:
* '''IgnoreIP''': a comma separated list of IP or CIDR networks which will never be blocked by fail2ban. Exemple: 12.15.22.4,17.20.0.0/16. All your local networks and networks allowed to access the server-manager are already automatically whitelisted
* '''FilterLocalNetworks''' can be enabled or disabled (default is disabled). If set to enabled, local networks won't be whitelisted, and fail2ban can also ban hosts from the internal networks. Note that networks allowed to access the server-manager are not affected (they will never be blocked)
* '''BanTime''': Duration (in seconds) of a ban. Default to 1800
* '''FindTime''': The window fail2ban will check, in seconds. Default is 900. So, this mean fail2ban will only check for the number of failed login attempts in the last 15 minuts
* '''MaxRetry''': Number of failed attempts in the last '''FindTime''' seconds to trigger a ban. Default is 3
* '''Mail''': can be enabled or disabled (default is enabled). If enabled, each ban will be notified by mail
* '''MailRecipient''': if '''Mail''' is enabled, the email address which should receive ban notifications. Default is root (the admin account will receive)
After changing one of these settings, you need to apply it:
signal-event fail2ban-conf
===Services===
The following services are monitored, and fail2ban will ban client IP for '''BanTime''' if more than '''MaxRetry''' authentication failure occure in less than '''FindTime'''
*ssh
*dovecot (only on SME9, or if you run [https://wikit.firewall-services.com/doku.php/smedev/dovecot smeserver-dovecot])
*qpsmtpd. If a remote server send you too many mails which qpsmtpd rejects, it's probably spammer, so Fail2ban will blacklist it. MaxRetry is x3 for this service, so with the default config, a remote server will be blacklisted if 9 mails are rejected in less than 15 minutes
*httpd-e-smith. The standard http server. 3 different filters check apache logs:
** noscripts: check client which ask for scripts which are not available on your server. It's usually script-kiddies trying to exploit security vulerabilities
** scan: another set of filter for popular scans (phpMyAdmin, wp-login, admin area etc...)
** auth: will check for standard authentication failure
*pam. This will check a generic authentication failure. Everything which uses pam should work
*[[Sogo|SOGo]]. Check SOGo logs for failed authentications
*[[LemonLDAP-NG]]. Check system logs for auth failure on LemonLDAP::NG portal
*ftp. Check auth failure on your FTP daemon
*[[Ejabberd]]. Check auth failure against EJabberd
Each filters will disable itself if the corresponding service is disabled. You can also disable specific filter if you want. For example, if you want to disable Apache filters:
db configuration setprop httpd-e-smith Fail2Ban disabled
signal-event fail2ban-conf
===Selective bans===
Fail2Ban will do its best to do a selective ban. For example, if 3 auth failure against ssh are detected, only tcp port 22 (or any other port you choosed for SSH) will be blocked. Same for httpd-e-smith, SOGO, LemonLDAP::NG which will only blacklist tcp ports 80 and 443, qpsmtpd will block tcp ports 25 and 465, dovecot will block 143 and 993 etc...
There's only two ways to be completly locked (all port/protocol):
* pam. As this is a generic file, it's not possible to check which service was used when an auth failure occured, so the entire client IP will be blacklisted
* recidive. This is a special filter. It monitors fail2Ban logs, and blacklist client IP which gets locked several time. If a client is locked out 5 times in 24 hours, it'll be completly blacklisted for one full week
===Use Fail2ban===
====List all jails====
[root@sme8 ~]# fail2ban-client status
Status
|- Number of jail: 10
`- Jail list: http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive
====List IP banned from a specific jail====
[root@sme8 ~]# fail2ban-client status ssh
choose the specific jail with the command above which lists the Jail-list.
====Play with a script which list How many ip are banned from all jails====
nano /root/checklist_ban
#!/bin/bash
#lancer le script en sudo
JAILS=$(fail2ban-client status | grep " Jail list:" | sed 's/`- Jail list:\t\t//g' | sed 's/,//g')
for j in $JAILS
do
echo "$j $(fail2ban-client status $j | grep " Currently banned:" | sed 's/ |- Currently banned:\t//g')"
done
chmod 700 /root/checklist_ban
to launch the script, do the following command:
/root/checklist_ban
==== Unban an IP ====
In certain case you would to unban an IP immediately because you don't want waste time to wait the automatic IP unban process of fail2ban.
In first you you have to find the specific jail which has blocked you IP, you can refer to the mail that the admin user has received or you can list a specific jail.
fail2ban-client status qpsmtpd
Status for the jail: qpsmtpd
|- filter
| |- File list: /var/log/qpsmtpd/current /var/log/sqpsmtpd/current
| |- Currently failed: 5
| `- Total failed: 119
`- action
|- Currently banned: 1
| `- IP list: 93.17.128.20
`- Total banned: 1
If you want to know all you active jail, then do :
fail2ban-client status
Therefore you have to play with this command to unban your IP
fail2ban-client set qpsmtpd unbanip 93.17.128.20
the generic command is :
fail2ban-client set JAIL unbanip MYIP
===Jail.conf===
The jail.conf is templated (/etc/e-smith/templates/etc/fail2ban/jail.conf) and the default file contains the configuration as below. You can add your own template of jail.conf at
/etc/e-smith/templates-custom/etc/fail2ban/jail.conf
if first time you need to create the folder for your custom template
mkdir -p /etc/e-smith/templates-custom/etc/fail2ban/jail.conf
and do this to expland templates
expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf
====default jail.conf====
[DEFAULT]
ignoreip = 127.0.0.0/8 192.168.XXX.XXX 192.168.XXX.0/24
bantime = 1800
findtime = 900
maxretry = 3
usedns = yes
backend = auto
{{Note box|msg=Your network and your server are in the list of ignored IP by fail2ban (see IgnoreIP)}}
[ssh]
enabled = true
filter = sshd
logpath = /var/log/sshd/current
action = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
smeserver-sendmail[name="SSH",dest=root]
[ssh-ddos]
enabled = true
filter = sshd-ddos
logpath = /var/log/sshd/current
action = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
smeserver-sendmail[name="SSH",dest=root]
[qpsmtpd]
enabled = true
filter = qpsmtpd
logpath = /var/log/*qpsmtpd/current
maxretry = 9
action = smeserver-iptables[port="25,465",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Qpsmtpd",dest=root]
[http-overflows]
enabled = true
filter = apache-overflows
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (overflows)",dest=root]
[http-noscript]
enabled = true
filter = apache-noscript
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (noscript)",dest=root]
[http-scan]
enabled = true
filter = apache-scan
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (scan)",dest=root]
[http-auth]
enabled = true
filter = apache-auth
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (auth)",dest=root]
[pam-generic]
enabled = true
filter = pam-generic
logpath = /var/log/secure
maxretry = 6
action = smeserver-iptables[bantime=1800]
smeserver-sendmail[name="PAM generic",dest=root]
[recidive]
enabled = true
filter = recidive
logpath = /var/log/fail2ban/daemon.log
bantime = 604800
findtime = 86400
maxretry = 5
backend = polling
action = smeserver-iptables[bantime=604800]
smeserver-sendmail[name="Recidive",dest=root]
=== Uninstall ===
yum remove smeserver-fail2ban fail2ban
=== Bugs ===
Please raise bugs under the SME-Contribs section in [http://bugs.contribs.org/enter_bug.cgi bugzilla]
and select the smeserver-fail2ban component or use {{BugzillaFileBug|product=SME%20Contribs|component=smeserver-fail2ban|title=this link}}.
[[Category: Contrib]]
== Fail2ban for SME Server ==
{{Level|Easy|The instructions on this page can be followed by a beginner.}}
=== Maintainer ===
[[User:VIP-ire|Daniel B.]]<br/>
[http://www.firewall-services.com Firewall Services]<br>
mailto:daniel@firewall-services.com
=== Description ===
Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator.
Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.
{{Tip box|fail2ban is not only a tool against brute force attack on ssh but it can be a tool useful against http protocol attacks or [http://forums.contribs.org/index.php/topic,50162.msg252195.html#msg252195 spam attacks] on your server. See the [[Fail2ban#Jail.conf |jail section]]}}
=== Requirements ===
This contrib has been developped and tested on SME Server 8 and later. It probably won't work on SME 7.
{{Note box|The SME feature [http://wiki.contribs.org/AutoBlock AutoBlock SSH] should be disabled to ensure that fail2ban controls SSH traffic and not the SME build-in firewall.}}
=== Installation ===
Configure Firewall-Services's repository:
db yum_repositories set fws repository \
BaseURL http://repo.firewall-services.com/centos/\$releasever \
EnableGroups no GPGCheck yes \
Name "Firewall Services" \
GPGKey http://repo.firewall-services.com/RPM-GPG-KEY \
Visible yes status disabled
Configure EPEL's repository:
For SME 8.x,
/sbin/e-smith/db yum_repositories set epel repository \
Name 'Epel - EL5' \
BaseUrl 'http://download.fedoraproject.org/pub/epel/5/$basearch' \
MirrorList 'http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=$basearch' \
EnableGroups no \
GPGCheck yes \
GPGKey http://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL \
Visible no \
status disabled
signal-event yum-modify
*install the rpms
yum --enablerepo=fws --enablerepo=epel install smeserver-fail2ban
{{note box| you have to install the fail2ban version of fws repository and not the epel version}}
* Appply the needed configuration:
expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf
or
signal-event post-upgrade; signal-event reboot
{{warning box| Failing to run either of these command will completly lock network access next time iptables rules are reloaded}}
===DB command===
there is no panel yet you can manage the contrib by the db configuration, it is quite simple
# config show fail2ban
fail2ban=service
Mail=enabled
status=enabled
Available options are below:
* '''IgnoreIP''': a comma separated list of IP or CIDR networks which will never be blocked by fail2ban. Exemple: 12.15.22.4,17.20.0.0/16. All your local networks and networks allowed to access the server-manager are already automatically whitelisted
* '''FilterLocalNetworks''' can be enabled or disabled (default is disabled). If set to enabled, local networks won't be whitelisted, and fail2ban can also ban hosts from the internal networks. Note that networks allowed to access the server-manager are not affected (they will never be blocked)
* '''BanTime''': Duration (in seconds) of a ban. Default to 1800
* '''FindTime''': The window fail2ban will check, in seconds. Default is 900. So, this mean fail2ban will only check for the number of failed login attempts in the last 15 minuts
* '''MaxRetry''': Number of failed attempts in the last '''FindTime''' seconds to trigger a ban. Default is 3
* '''Mail''': can be enabled or disabled (default is enabled). If enabled, each ban will be notified by mail
* '''MailRecipient''': if '''Mail''' is enabled, the email address which should receive ban notifications. Default is root (the admin account will receive)
After changing one of these settings, you need to apply it:
signal-event fail2ban-conf
===Services===
The following services are monitored, and fail2ban will ban client IP for '''BanTime''' if more than '''MaxRetry''' authentication failure occure in less than '''FindTime'''
*ssh
*dovecot (only on SME9, or if you run [https://wikit.firewall-services.com/doku.php/smedev/dovecot smeserver-dovecot])
*qpsmtpd. If a remote server send you too many mails which qpsmtpd rejects, it's probably spammer, so Fail2ban will blacklist it. MaxRetry is x3 for this service, so with the default config, a remote server will be blacklisted if 9 mails are rejected in less than 15 minutes
*httpd-e-smith. The standard http server. 3 different filters check apache logs:
** noscripts: check client which ask for scripts which are not available on your server. It's usually script-kiddies trying to exploit security vulerabilities
** scan: another set of filter for popular scans (phpMyAdmin, wp-login, admin area etc...)
** auth: will check for standard authentication failure
*pam. This will check a generic authentication failure. Everything which uses pam should work
*[[Sogo|SOGo]]. Check SOGo logs for failed authentications
*[[LemonLDAP-NG]]. Check system logs for auth failure on LemonLDAP::NG portal
*ftp. Check auth failure on your FTP daemon
*[[Ejabberd]]. Check auth failure against EJabberd
Each filters will disable itself if the corresponding service is disabled. You can also disable specific filter if you want. For example, if you want to disable Apache filters:
db configuration setprop httpd-e-smith Fail2Ban disabled
signal-event fail2ban-conf
===Selective bans===
Fail2Ban will do its best to do a selective ban. For example, if 3 auth failure against ssh are detected, only tcp port 22 (or any other port you choosed for SSH) will be blocked. Same for httpd-e-smith, SOGO, LemonLDAP::NG which will only blacklist tcp ports 80 and 443, qpsmtpd will block tcp ports 25 and 465, dovecot will block 143 and 993 etc...
There's only two ways to be completly locked (all port/protocol):
* pam. As this is a generic file, it's not possible to check which service was used when an auth failure occured, so the entire client IP will be blacklisted
* recidive. This is a special filter. It monitors fail2Ban logs, and blacklist client IP which gets locked several time. If a client is locked out 5 times in 24 hours, it'll be completly blacklisted for one full week
===Use Fail2ban===
====List all jails====
[root@sme8 ~]# fail2ban-client status
Status
|- Number of jail: 10
`- Jail list: http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive
====List IP banned from a specific jail====
[root@sme8 ~]# fail2ban-client status ssh
choose the specific jail with the command above which lists the Jail-list.
====Play with a script which list How many ip are banned from all jails====
nano /root/checklist_ban
#!/bin/bash
#lancer le script en sudo
JAILS=$(fail2ban-client status | grep " Jail list:" | sed 's/`- Jail list:\t\t//g' | sed 's/,//g')
for j in $JAILS
do
echo "$j $(fail2ban-client status $j | grep " Currently banned:" | sed 's/ |- Currently banned:\t//g')"
done
chmod 700 /root/checklist_ban
to launch the script, do the following command:
/root/checklist_ban
==== Unban an IP ====
In certain case you would to unban an IP immediately because you don't want waste time to wait the automatic IP unban process of fail2ban.
In first you you have to find the specific jail which has blocked you IP, you can refer to the mail that the admin user has received or you can list a specific jail.
fail2ban-client status qpsmtpd
Status for the jail: qpsmtpd
|- filter
| |- File list: /var/log/qpsmtpd/current /var/log/sqpsmtpd/current
| |- Currently failed: 5
| `- Total failed: 119
`- action
|- Currently banned: 1
| `- IP list: 93.17.128.20
`- Total banned: 1
If you want to know all you active jail, then do :
fail2ban-client status
Therefore you have to play with this command to unban your IP
fail2ban-client set qpsmtpd unbanip 93.17.128.20
the generic command is :
fail2ban-client set JAIL unbanip MYIP
===Jail.conf===
The jail.conf is templated (/etc/e-smith/templates/etc/fail2ban/jail.conf) and the default file contains the configuration as below. You can add your own template of jail.conf at
/etc/e-smith/templates-custom/etc/fail2ban/jail.conf
if first time you need to create the folder for your custom template
mkdir -p /etc/e-smith/templates-custom/etc/fail2ban/jail.conf
and do this to expland templates
expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf
====default jail.conf====
[DEFAULT]
ignoreip = 127.0.0.0/8 192.168.XXX.XXX 192.168.XXX.0/24
bantime = 1800
findtime = 900
maxretry = 3
usedns = yes
backend = auto
{{Note box|msg=Your network and your server are in the list of ignored IP by fail2ban (see IgnoreIP)}}
[ssh]
enabled = true
filter = sshd
logpath = /var/log/sshd/current
action = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
smeserver-sendmail[name="SSH",dest=root]
[ssh-ddos]
enabled = true
filter = sshd-ddos
logpath = /var/log/sshd/current
action = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
smeserver-sendmail[name="SSH",dest=root]
[qpsmtpd]
enabled = true
filter = qpsmtpd
logpath = /var/log/*qpsmtpd/current
maxretry = 9
action = smeserver-iptables[port="25,465",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Qpsmtpd",dest=root]
[http-overflows]
enabled = true
filter = apache-overflows
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (overflows)",dest=root]
[http-noscript]
enabled = true
filter = apache-noscript
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (noscript)",dest=root]
[http-scan]
enabled = true
filter = apache-scan
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (scan)",dest=root]
[http-auth]
enabled = true
filter = apache-auth
logpath = /var/log/httpd/error_log
action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
smeserver-sendmail[name="Apache (auth)",dest=root]
[pam-generic]
enabled = true
filter = pam-generic
logpath = /var/log/secure
maxretry = 6
action = smeserver-iptables[bantime=1800]
smeserver-sendmail[name="PAM generic",dest=root]
[recidive]
enabled = true
filter = recidive
logpath = /var/log/fail2ban/daemon.log
bantime = 604800
findtime = 86400
maxretry = 5
backend = polling
action = smeserver-iptables[bantime=604800]
smeserver-sendmail[name="Recidive",dest=root]
=== Uninstall ===
yum remove smeserver-fail2ban fail2ban
=== Bugs ===
Please raise bugs under the SME-Contribs section in [http://bugs.contribs.org/enter_bug.cgi bugzilla]
and select the smeserver-fail2ban component or use {{BugzillaFileBug|product=SME%20Contribs|component=smeserver-fail2ban|title=this link}}.
[[Category: Contrib]]
