62
edits
Changes
From SME Server
Jump to navigationJump to searchno edit summary
{{Languages|Fail2ban}}
{{Languages|Fail2ban}}
== Fail2ban for SME Server ==
== Fail2ban pour SME Server ==
{{Level|Easy|The instructions on this page can be followed by a beginner.}}
{{Level|Easy|The instructions on this page can be followed by a beginner.}}
=== Maintainer ===
=== Mainteneur ===
[[User:VIP-ire|Daniel B.]]<br/>
[[User:VIP-ire|Daniel B.]]<br/>
[http://www.firewall-services.com Firewall Services]<br>
[http://www.firewall-services.com Firewall Services]<br>
{{Tip box|fail2ban is not only a tool against brute force attack on ssh but it can be a tool useful against http protocol attacks or [http://forums.contribs.org/index.php/topic,50162.msg252195.html#msg252195 spam attacks] on your server. See the [[Fail2ban#Jail.conf |jail section]]}}
{{Tip box|fail2ban is not only a tool against brute force attack on ssh but it can be a tool useful against http protocol attacks or [http://forums.contribs.org/index.php/topic,50162.msg252195.html#msg252195 spam attacks] on your server. See the [[Fail2ban#Jail.conf |jail section]]}}
=== Requirements ===
=== Systèmes requis ===
This contrib has been developped and tested on SME Server 8 and later. It probably won't work on SME 7.
This contrib has been developped and tested on SME Server 8 and later. It probably won't work on SME 7.
{{warning box| Failing to run either of these command will completly lock network access next time iptables rules are reloaded}}
{{warning box| Failing to run either of these command will completly lock network access next time iptables rules are reloaded}}
===DB command===
=== Commandes DB ===
there is no panel yet you can manage the contrib by the db configuration, it is quite simple
there is no panel yet you can manage the contrib by the db configuration, it is quite simple
signal-event fail2ban-conf
signal-event fail2ban-conf
===Services===
=== Services ===
The following services are monitored, and fail2ban will ban client IP for '''BanTime''' if more than '''MaxRetry''' authentication failure occure in less than '''FindTime'''
The following services are monitored, and fail2ban will ban client IP for '''BanTime''' if more than '''MaxRetry''' authentication failure occure in less than '''FindTime'''
signal-event fail2ban-conf
signal-event fail2ban-conf
===Selective bans===
=== Bans Sélectifs ===
Fail2Ban will do its best to do a selective ban. For example, if 3 auth failure against ssh are detected, only tcp port 22 (or any other port you choosed for SSH) will be blocked. Same for httpd-e-smith, SOGO, LemonLDAP::NG which will only blacklist tcp ports 80 and 443, qpsmtpd will block tcp ports 25 and 465, dovecot will block 143 and 993 etc...
Fail2Ban will do its best to do a selective ban. For example, if 3 auth failure against ssh are detected, only tcp port 22 (or any other port you choosed for SSH) will be blocked. Same for httpd-e-smith, SOGO, LemonLDAP::NG which will only blacklist tcp ports 80 and 443, qpsmtpd will block tcp ports 25 and 465, dovecot will block 143 and 993 etc...
* recidive. This is a special filter. It monitors fail2Ban logs, and blacklist client IP which gets locked several time. If a client is locked out 5 times in 24 hours, it'll be completly blacklisted for one full week
* recidive. This is a special filter. It monitors fail2Ban logs, and blacklist client IP which gets locked several time. If a client is locked out 5 times in 24 hours, it'll be completly blacklisted for one full week
===Use Fail2ban===
=== Utilisation de Fail2ban===
====List all jails====
==== Lister toutes les prisons ====
[root@sme8 ~]# fail2ban-client status
[root@sme8 ~]# fail2ban-client status
Status
Status
`- Jail list: http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive
`- Jail list: http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive
====List IP banned from a specific jail====
==== Lister les IP bannis d'une prison spécifique ====
[root@sme8 ~]# fail2ban-client status ssh
[root@sme8 ~]# fail2ban-client status ssh
choose the specific jail with the command above which lists the Jail-list.
choose the specific jail with the command above which lists the Jail-list.
====Play with a script which list How many ip are banned from all jails====
==== Jouez avec un script qui liste combien d'IP sont interdits dans toutes les prisons ====
nano /root/checklist_ban
nano /root/checklist_ban
/root/checklist_ban
/root/checklist_ban
==== Unban an IP ====
==== Réintégrer une IP ====
In certain case you would to unban an IP immediately because you don't want waste time to wait the automatic IP unban process of fail2ban.
In certain case you would to unban an IP immediately because you don't want waste time to wait the automatic IP unban process of fail2ban.
In first you you have to find the specific jail which has blocked you IP, you can refer to the mail that the admin user has received or you can list a specific jail.
In first you you have to find the specific jail which has blocked you IP, you can refer to the mail that the admin user has received or you can list a specific jail.
/etc/init.d/masq restart
/etc/init.d/masq restart
signal-event fail2ban-conf
signal-event fail2ban-conf
====default jail.conf====
==== Default jail.conf ====
[DEFAULT]
[DEFAULT]
ignoreip = 127.0.0.0/8 192.168.XXX.XXX 192.168.XXX.0/24
ignoreip = 127.0.0.0/8 192.168.XXX.XXX 192.168.XXX.0/24
smeserver-sendmail[name="Recidive",dest=root]
smeserver-sendmail[name="Recidive",dest=root]
=== Uninstall ===
=== Désinstallation ===
yum remove smeserver-fail2ban fail2ban
yum remove smeserver-fail2ban fail2ban
