Difference between revisions of "Fail2ban"

Languages:

Fail2ban for SME Server

	Skill level: Easy
	The instructions on this page can be followed by a beginner.

Maintainer

Daniel B.
Firewall Services
mailto:daniel@firewall-services.com

Please discuss, provide feedback and share epxeriences on the forums here

Description

Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator. Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.

After installation the most important core services (and some additional ones) are monitored by default without the need for manual configuration (see: Services).

	Tip:
	fail2ban is not only a tool against brute force attack on ssh but it can be a tool useful against http protocol attacks or spam attacks on your server. See the jail section

Requirements

This contrib has been developped and tested on SME Server 8 and later. It probably won't work on SME 7.

	Note:
	The SME feature AutoBlock SSH should be disabled to ensure that fail2ban controls SSH traffic and not the SME build-in firewall.

Installation sme8 and sme9

Configure Firewall-Services's repository:

db yum_repositories set fws repository \
BaseURL http://repo.firewall-services.com/centos/\$releasever \
EnableGroups no GPGCheck yes \
Name "Firewall Services" \
GPGKey http://repo.firewall-services.com/RPM-GPG-KEY \
Visible yes status disabled

Configure EPEL's repository: For SME 8.x,

/sbin/e-smith/db yum_repositories set epel repository \
Name 'Epel - EL5' \
BaseUrl 'http://download.fedoraproject.org/pub/epel/5/$basearch' \
MirrorList 'http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=$basearch' \
EnableGroups no \
GPGCheck yes \
GPGKey http://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL \
Visible no \
status disabled

For SME 9.x,

/sbin/e-smith/db yum_repositories set epel repository \
Name 'Epel - EL6' \
BaseUrl 'http://download.fedoraproject.org/pub/epel/6/$basearch' \
MirrorList 'http://mirrors.fedoraproject.org/mirrorlist?repo=epel-6&arch=$basearch' \
EnableGroups no \
GPGCheck yes \
GPGKey http://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL \
Visible no \
status disabled

signal-event yum-modify

install the rpms

yum --enablerepo=fws --enablerepo=epel install smeserver-fail2ban

Apply the needed configuration:

Use care to execute these three commands precisely. Failure to do so may prevent remote login via ssh.

db configuration setprop masq status enabled
expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf

or, as an alternative, use the following commands. They will have the same effect after rebooting.

db configuration setprop masq status enabled
signal-event post-upgrade; signal-event reboot

	Warning:
	Failing to run either of these command will completely lock network access next time iptables rules are reloaded

	Warning:
	The masq service must be enabled for fail2Ban to work correctly. If you disable it, Fail2ban won't ban anything

Disable SME Feature AutoBlock SME 9 or greater

It's been noted that one of the features of fail2ban overlaps the built-in ssh AutoBlock feature of SME (https://wiki.contribs.org/AutoBlock). It is possible to disable the AutoBlock feature using the following optional steps.

1. View what your current settings are for the built in SME AutoBlock feature by entering the following at the cli.

# config show sshd

2. If AutoBlock is disabled no action is required. If AutoBlock is enabled, set it to disabled with the following commands:

# config setprop sshd AutoBlock disabled
# signal-event remoteaccess-update

DB command

there is no panel yet you can manage the contrib by the db configuration, it is quite simple

# config show fail2ban 
fail2ban=service
   Mail=enabled
   status=enabled

Available options are below:

IgnoreIP: a comma separated list of IP or CIDR networks which will never be blocked by fail2ban. Exemple: 12.15.22.4,17.20.0.0/16. All your local networks and networks allowed to access the server-manager are already automatically whitelisted
FilterLocalNetworks can be enabled or disabled (default is disabled). If set to enabled, local networks won't be whitelisted, and fail2ban can also ban hosts from the internal networks. Note that networks allowed to access the server-manager are not affected (they will never be blocked)
BanTime: Duration (in seconds) of a ban. Default to 1800
FindTime: The window fail2ban will check, in seconds. Default is 900. So, this mean fail2ban will only check for the number of failed login attempts in the last 15 minuts
MaxRetry: Number of failed attempts in the last FindTime seconds to trigger a ban. Default is 3
Mail: can be enabled or disabled (default is enabled). If enabled, each ban will be notified by mail
MailRecipient: if Mail is enabled, the email address which should receive ban notifications. Default is root (the admin account will receive)

After changing one of these settings, you need to apply it:

signal-event fail2ban-conf

for example :

config setprop fail2ban IgnoreIP 12.15.22.4,17.20.0.0/16
signal-event fail2ban-conf

	Note:
	`signal-event fail2ban-conf` effectively restarts the service and clears existing bans, but a suitable 'findtime' results in a reban. Be aware that the restart delay can be unexpectedly lengthy due to the resource intensive process of scanning the logs to reban offending addresses.

Services

The following services are monitored out of the box, and fail2ban will ban client IP for BanTime if more than MaxRetry authentication failure occure in less than FindTime

ssh
dovecot (only on SME9, or if you run smeserver-dovecot)
qpsmtpd. If a remote server send you too many mails which qpsmtpd rejects, it's probably spammer, so Fail2ban will blacklist it. MaxRetry is x3 for this service, so with the default config, a remote server will be blacklisted if 9 mails are rejected in less than 15 minutes
httpd-e-smith. The standard http server. 3 different filters check apache logs:
- noscripts: check client which ask for scripts which are not available on your server. It's usually script-kiddies trying to exploit security vulerabilities
- scan: another set of filter for popular scans (phpMyAdmin, wp-login, admin area etc...)
- auth: will check for standard authentication failure
pam. This will check a generic authentication failure. Everything which uses pam should work
SOGo. Check SOGo logs for failed authentications
LemonLDAP-NG. Check system logs for auth failure on LemonLDAP::NG portal
ftp. Check auth failure on your FTP daemon
Ejabberd. Check auth failure against EJabberd

Each filters will disable itself if the corresponding service is disabled. You can also disable specific filter if you want. For example, if you want to disable Apache filters:

db configuration setprop httpd-e-smith Fail2Ban disabled
signal-event fail2ban-conf

Selective bans

Fail2Ban will do its best to do a selective ban. For example, if 3 auth failure against ssh are detected, only tcp port 22 (or any other port you choosed for SSH) will be blocked. Same for httpd-e-smith, SOGO, LemonLDAP::NG which will only blacklist tcp ports 80 and 443, qpsmtpd will block tcp ports 25 and 465, dovecot will block 143 and 993 etc...

There's only two ways to be completly locked (all port/protocol):

pam. As this is a generic file, it's not possible to check which service was used when an auth failure occured, so the entire client IP will be blacklisted
recidive. This is a special filter. It monitors fail2Ban logs, and blacklist client IP which gets locked several time. If a client is locked out 5 times in 24 hours, it'll be completly blacklisted for one full week

Use Fail2ban

List all jails

[root@sme8 ~]# fail2ban-client status 
Status
|- Number of jail:	10
`- Jail list:		http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive

List IP banned from a specific jail

[root@sme8 ~]# fail2ban-client status ssh

choose the specific jail with the command above which lists the Jail-list.

Example script which list How many ip are banned from all jails

nano /root/checklist_ban
#!/bin/bash
#lancer le script en sudo 
JAILS=$(fail2ban-client status | grep " Jail list:" | sed 's/`- Jail list://g' | sed 's/,//g')
for j in $JAILS
do
echo "$j $(fail2ban-client status $j | grep " Currently banned:" | sed 's/   |- Currently banned:\t//g')"
done

chmod 700 /root/checklist_ban

to launch the script, do the following command:

/root/checklist_ban

Unban an IP

In certain case you would to unban an IP immediately because you don't want waste time to wait the automatic IP unban process of fail2ban. In first you you have to find the specific jail which has blocked you IP, you can refer to the mail that the admin user has received or you can list a specific jail.

fail2ban-client status qpsmtpd

Status for the jail: qpsmtpd
|- filter
|  |- File list:	/var/log/qpsmtpd/current /var/log/sqpsmtpd/current 
|  |- Currently failed:	5
|  `- Total failed:	119
`- action
   |- Currently banned:	1
   |  `- IP list:	93.17.128.20 
   `- Total banned:	1

If you want to know all you active jail, then do :

fail2ban-client status

Therefore you have to play with this command to unban your IP

fail2ban-client set qpsmtpd unbanip 93.17.128.20

the generic command is :

fail2ban-client set JAIL unbanip MYIP

Jail.conf

The jail.conf is templated (/etc/e-smith/templates/etc/fail2ban/jail.conf) and the default file contains the configuration as below. You can add your own template of jail.conf at

/etc/e-smith/templates-custom/etc/fail2ban/jail.conf

if first time you need to create the folder for your custom template

mkdir -p  /etc/e-smith/templates-custom/etc/fail2ban/jail.conf

and do this to expland templates

expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf

default jail.conf

[DEFAULT]
ignoreip = 127.0.0.0/8 192.168.XXX.XXX 192.168.XXX.0/24
bantime  = 1800
findtime  = 900
maxretry = 3
usedns = yes
backend = auto

	Note:
	Your network and your server are in the list of ignored IP by fail2ban (see IgnoreIP)

[ssh]
enabled  = true
filter   = sshd
logpath  = /var/log/sshd/current
action   = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="SSH",dest=root]

[ssh-ddos]
enabled  = true
filter   = sshd-ddos
logpath  = /var/log/sshd/current
action   = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="SSH",dest=root]

[qpsmtpd]
enabled  = true
filter   = qpsmtpd
logpath  = /var/log/*qpsmtpd/current
maxretry = 9
action   = smeserver-iptables[port="25,465",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Qpsmtpd",dest=root]

[http-overflows]
enabled  = true
filter   = apache-overflows
logpath  = /var/log/httpd/error_log
action   = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Apache (overflows)",dest=root]

[http-noscript]
enabled  = true
filter   = apache-noscript
logpath  = /var/log/httpd/error_log
action   = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Apache (noscript)",dest=root]

[http-scan]
enabled  = true
filter   = apache-scan
logpath  = /var/log/httpd/error_log
action   = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Apache (scan)",dest=root]

[http-auth]
enabled  = true
filter   = apache-auth
logpath  = /var/log/httpd/error_log
action   = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Apache (auth)",dest=root]

[pam-generic]
enabled  = true
filter   = pam-generic
logpath  = /var/log/secure
maxretry = 6
action   = smeserver-iptables[bantime=1800]
          smeserver-sendmail[name="PAM generic",dest=root]

[recidive]
enabled  = true
filter   = recidive
logpath  = /var/log/fail2ban/daemon.log
bantime  = 604800
findtime = 86400
maxretry = 5
backend  = polling
action   = smeserver-iptables[bantime=604800]
          smeserver-sendmail[name="Recidive",dest=root]

Uninstall

yum remove smeserver-fail2ban fail2ban

Bugs

Please raise bugs under the SME-Contribs section in bugzilla and select the smeserver-fail2ban component or use this link .

Below is an overview of the current issues for this contrib:

ID	Product	Version	Status	Summary (12 tasks) ⇒
12453	SME Contribs	10.0	CONFIRMED	extra coma leading to empty string fails ignore ip template fragment
12402	SME Contribs	10.0	UNCONFIRMED	Using smeserver-git makes smeserver-fail2ban ban even though whitelisted.
12285	SME Contribs	10.0	UNCONFIRMED	WARNING message in daemon log after reboot about ssh
12199	SME Contribs	10.0	CONFIRMED	add externalip /internal ip to whitelist
11805	SME Contribs	10.0	CONFIRMED	NFR: use fail2ban db to list banned host
11801	SME Contribs	10.0	CONFIRMED	NFR: add a permanent/custom or manual jail
10799	SME Contribs	Futur	CONFIRMED	NFR: Fail2ban OpenVPN routed templates
10798	SME Contribs	9.2	CONFIRMED	NFR convert long mask to bit mask if entered as long mask
10786	SME Contribs	9.2	CONFIRMED	lockout without a full masq restart
10638	SME Contribs	9.2	CONFIRMED	IgnoreIP entry created with trailing slash stopping f2b from working
10422	SME Contribs	9.2	UNCONFIRMED	NFR: portscan jail
8955	SME Contribs	9.2	UNCONFIRMED	Fail2Ban error in qpsmtpd.conf regex

User contributions

Testing new regex

You can test new regex - notes from here http://bugs.contribs.org/show_bug.cgi?id=8955

fail2ban-regex [LOG] [REGEX]

You can also test the actual conf files as follows

fail2ban-regex /var/log/qpsmtpd/current /etc/fail2ban/filter.d/qpsmtpd.conf

Note that some characters such as ` may need escaping on the command line like this \` but do not need escaping in the conf files

e.g From qpsmptd.conf file this works in the conf file

^\s*\d+\s*logging::logterse plugin \(deny\): ` <HOST>\s*.*90\d.*msg denied before queued$

However, on the command line it needs writing like this

^\s*\d+\s*logging::logterse plugin \(deny\): \` <HOST>\s*.*90\d.*msg denied before queued$

Show IPs banned by service

Check the fail2ban log

Here is another quick script that shows you the most recent IPs banned in the logs. Note that they may have been unbanned but there is no check for this.

mkdir /root/bin
nano -w /root/bin/IP_list.sh

and copy and paste the below code into the file:

#!/bin/sh
# Set CLI vars to something we can read
TYPE=$1
LOG=$2

# Set main grep string
SEARCH="Ban ((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])"

# Add the search term
SEARCH="\[$TYPE]\ $SEARCH"

# Now search the log
grep -oE "\[$TYPE\] Ban ((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])" $LOG

Save the file and make it executable:

chmod 755 /root/bin/IP_list.sh

Usage :

IP_list.sh [service] [log]

e.g.

IP_list.sh qpsmtpd /var/log/fail2ban/daemon.log

Check the fail2ban banned IP for all active jails

by Unnilennium (talk)

mkdir /root/bin
vim /root/bin/sfail2ban

paste this in it:

#!/bin/bash
for SERVI in $(fail2ban-client status|grep 'Jail list'|cut -d':' -f2|sed 's/, / /g'| sed -e 's/^[ \t]*//')
do
fail2ban-client status $SERVI |grep -E 'IP list|Status for the jail'
done

then do

chmod 755 /root/bin/sfail2ban

Usage :

sfail2ban

output:

# sfail2ban
Status for the jail: ftp
   `- Banned IP list:
Status for the jail: http-auth
   `- Banned IP list:
Status for the jail: http-badbots
   `- Banned IP list:
Status for the jail: http-fakegooglebot
   `- Banned IP list:
Status for the jail: http-noscript
   `- Banned IP list:
Status for the jail: http-overflows
   `- Banned IP list:
Status for the jail: http-scan
   `- Banned IP list:
Status for the jail: http-shellshock
   `- Banned IP list:
Status for the jail: imap
   `- Banned IP list:
Status for the jail: pam-generic
   `- Banned IP list:
Status for the jail: qpsmtpd
   `- Banned IP list:
Status for the jail: recidive
   `- Banned IP list:
Status for the jail: ssh
   `- Banned IP list:
Status for the jail: ssh-ddos
   `- Banned IP list:

Print a summary of the fail2ban db

mkdir -p /root/bin
vi /root/bin/bansummary.sh

Paste this

#!/bin/bash
echo -e \
"IP             \t"\
"BanTime             \t"\
"UnbanTime           \t"\
"Jail"

for ban in $(db fail2ban show |awk -F\= ' $2=="ban" {print $1}'); 
  do
    IP=$(db fail2ban getprop $ban Host)
    Bantime=$(date +"%F %T" -d @$(db fail2ban getprop $ban BanTimestamp))
    UnBanTime=$(date +"%F %T" -d @$(db fail2ban getprop $ban UnbanTimestamp))
    LastJail=$(zgrep -H "Ban $IP" $(find /var/log/fail2ban -type f -ctime -7) |tail -1 |awk '{print $6}') 

    printf "%-15s" "$IP"
    echo -e "\t$Bantime\t$UnBanTime\t$LastJail"
  done

save, then make executable

chmod 755 /root/bin/bansummary.sh

Usage:

bansummary.sh

Output:

IP             	BanTime             	UnbanTime           	Jail
46.246.39.228  	2017-09-09 18:45:00	2017-09-10 18:45:00	[http-scan]
124.239.180.102	2017-09-09 12:07:32	2017-09-10 12:07:32	[http-scan]
212.237.54.93  	2017-09-09 19:27:32	2017-09-10 19:27:32	[http-scan]