Difference between revisions of "Fail2ban"
m (Remove obsolete note) |
|||
(55 intermediate revisions by 13 users not shown) | |||
Line 4: | Line 4: | ||
{{Level|Easy|The instructions on this page can be followed by a beginner.}} | {{Level|Easy|The instructions on this page can be followed by a beginner.}} | ||
− | + | == Maintainer == | |
− | [[User:VIP-ire|Daniel B.]]<br/> | + | [[User:VIP-ire|Daniel B.]]<br /> |
[http://www.firewall-services.com Firewall Services]<br> | [http://www.firewall-services.com Firewall Services]<br> | ||
mailto:daniel@firewall-services.com | mailto:daniel@firewall-services.com | ||
− | + | Please discuss, provide feedback and share experiences on the forums [http://forums.contribs.org/index.php/topic,51127.0.html '''here'''] | |
+ | |||
+ | == Description == | ||
Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator. | Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator. | ||
Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack. | Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack. | ||
+ | |||
+ | After installation the most important core services (and some additional ones) are monitored by default without the need for manual configuration (see: [[#Services|Services]]). | ||
{{Tip box|fail2ban is not only a tool against brute force attack on ssh but it can be a tool useful against http protocol attacks or [http://forums.contribs.org/index.php/topic,50162.msg252195.html#msg252195 spam attacks] on your server. See the [[Fail2ban#Jail.conf |jail section]]}} | {{Tip box|fail2ban is not only a tool against brute force attack on ssh but it can be a tool useful against http protocol attacks or [http://forums.contribs.org/index.php/topic,50162.msg252195.html#msg252195 spam attacks] on your server. See the [[Fail2ban#Jail.conf |jail section]]}} | ||
− | + | == Requirements == | |
− | This contrib has been | + | This contrib has been developed and tested on SME Server 8 and later. |
{{Note box|The SME feature [http://wiki.contribs.org/AutoBlock AutoBlock SSH] should be disabled to ensure that fail2ban controls SSH traffic and not the SME build-in firewall.}} | {{Note box|The SME feature [http://wiki.contribs.org/AutoBlock AutoBlock SSH] should be disabled to ensure that fail2ban controls SSH traffic and not the SME build-in firewall.}} | ||
− | == | + | ==Koozali SME v9/v10== |
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | + | {{#smeversion: smeserver-fail2ban}} | |
− | + | == Installation Koozali SME== | |
+ | <tabs container><tab name="For SME 10"> | ||
+ | yum --enablerepo=smecontribs install smeserver-fail2ban | ||
+ | </tab><tab name="For SME 9"> | ||
− | + | * install the rpms | |
+ | yum --enablerepo=smecontribs install smeserver-fail2ban | ||
− | * | + | * Apply the needed configuration: |
+ | Use care to execute these three commands precisely. Failure to do so may prevent remote login via ssh. | ||
+ | db configuration setprop masq status enabled | ||
expand-template /etc/rc.d/init.d/masq | expand-template /etc/rc.d/init.d/masq | ||
/etc/init.d/masq restart | /etc/init.d/masq restart | ||
signal-event fail2ban-conf | signal-event fail2ban-conf | ||
− | or | + | or, as an alternative, use the following commands. They will have the same effect after rebooting. |
+ | db configuration setprop masq status enabled | ||
signal-event post-upgrade; signal-event reboot | signal-event post-upgrade; signal-event reboot | ||
− | {{warning box| Failing to run either of these command will | + | {{warning box| Failing to run either of these command will completely lock network access next time iptables rules are reloaded}} |
+ | {{warning box| The masq service must be enabled for fail2Ban to work correctly. If you disable it, Fail2ban won't ban anything}} | ||
+ | </tab> | ||
+ | </tabs> | ||
+ | {{warning box| Starting SME10 and smeserver-fail2ban 0.1.18-29, manual change of configuration is included in core backup, if you use .local files in the folders action.d/ fail2ban.d/ filter.d/ jail.d/. Any change to rpm owned .conf file is not added in core backup. Use the .local files to override the conf file instead and it will be in the backup. See http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Configuration.}} | ||
+ | |||
+ | == Disable SME Feature AutoBlock SME 9 or greater == | ||
+ | It's been noted that one of the features of fail2ban overlaps the built-in ssh AutoBlock feature of SME (https://wiki.contribs.org/AutoBlock). | ||
+ | It is possible to disable the AutoBlock feature using the following optional steps. | ||
+ | |||
+ | 1. View what your current settings are for the built in SME AutoBlock feature by entering the following at the cli. | ||
+ | # config show sshd | ||
+ | 2. If AutoBlock is disabled no action is required. If AutoBlock is enabled, set it to disabled with the following commands: | ||
+ | # config setprop sshd AutoBlock disabled | ||
+ | # signal-event remoteaccess-update | ||
− | + | ==DB command== | |
− | there is | + | While there is a panel in the server-manager, you can also manage the contrib by the db configuration, it is quite simple |
# config show fail2ban | # config show fail2ban | ||
Line 85: | Line 75: | ||
Available options are below: | Available options are below: | ||
− | * '''IgnoreIP''': a comma separated list of IP or CIDR networks which will never be blocked by fail2ban. | + | * '''IgnoreIP''': a comma separated list of IP or CIDR networks which will never be blocked by fail2ban. Example: 12.15.22.4,17.20.0.0/16. All your local networks and networks allowed to access the server-manager are already automatically whitelisted |
* '''FilterLocalNetworks''' can be enabled or disabled (default is disabled). If set to enabled, local networks won't be whitelisted, and fail2ban can also ban hosts from the internal networks. Note that networks allowed to access the server-manager are not affected (they will never be blocked) | * '''FilterLocalNetworks''' can be enabled or disabled (default is disabled). If set to enabled, local networks won't be whitelisted, and fail2ban can also ban hosts from the internal networks. Note that networks allowed to access the server-manager are not affected (they will never be blocked) | ||
− | * '''BanTime''': Duration (in seconds) of a ban. Default to 1800 | + | * '''BanTime''': Duration (in seconds) of a ban. Default to 1800 (about 30 minutes) |
− | * '''FindTime''': The window fail2ban will check, in seconds. Default is 900. So, this | + | * '''FindTime''': The time window fail2ban will check, in seconds. Default is 900. So, this means fail2ban will only check for the number of failed login attempts in the last 15 minutes |
* '''MaxRetry''': Number of failed attempts in the last '''FindTime''' seconds to trigger a ban. Default is 3 | * '''MaxRetry''': Number of failed attempts in the last '''FindTime''' seconds to trigger a ban. Default is 3 | ||
− | * '''Mail''': can be enabled or disabled (default is enabled). If enabled, each ban will | + | * '''Mail''': can be enabled or disabled (default is enabled). If enabled, each ban will notify the admin by email |
* '''MailRecipient''': if '''Mail''' is enabled, the email address which should receive ban notifications. Default is root (the admin account will receive) | * '''MailRecipient''': if '''Mail''' is enabled, the email address which should receive ban notifications. Default is root (the admin account will receive) | ||
Line 101: | Line 91: | ||
signal-event fail2ban-conf | signal-event fail2ban-conf | ||
− | + | {{Note box|<code>signal-event fail2ban-conf</code> effectively restarts the service and clears existing bans, but a suitable 'findtime' results in a reban. Be aware that the restart delay can be unexpectedly lengthy due to the resource intensive process of scanning the logs to reban offending addresses.}} | |
− | The following services are monitored, and fail2ban will ban client IP for '''BanTime''' if more than '''MaxRetry''' authentication failure occure in less than '''FindTime''' | + | |
+ | == Services == | ||
+ | The following services are monitored out of the box, and fail2ban will ban client IP for '''BanTime''' if more than '''MaxRetry''' authentication failure occure in less than '''FindTime''' | ||
*ssh | *ssh | ||
Line 122: | Line 114: | ||
signal-event fail2ban-conf | signal-event fail2ban-conf | ||
− | + | == Selective bans == | |
Fail2Ban will do its best to do a selective ban. For example, if 3 auth failure against ssh are detected, only tcp port 22 (or any other port you choosed for SSH) will be blocked. Same for httpd-e-smith, SOGO, LemonLDAP::NG which will only blacklist tcp ports 80 and 443, qpsmtpd will block tcp ports 25 and 465, dovecot will block 143 and 993 etc... | Fail2Ban will do its best to do a selective ban. For example, if 3 auth failure against ssh are detected, only tcp port 22 (or any other port you choosed for SSH) will be blocked. Same for httpd-e-smith, SOGO, LemonLDAP::NG which will only blacklist tcp ports 80 and 443, qpsmtpd will block tcp ports 25 and 465, dovecot will block 143 and 993 etc... | ||
Line 129: | Line 121: | ||
* recidive. This is a special filter. It monitors fail2Ban logs, and blacklist client IP which gets locked several time. If a client is locked out 5 times in 24 hours, it'll be completly blacklisted for one full week | * recidive. This is a special filter. It monitors fail2Ban logs, and blacklist client IP which gets locked several time. If a client is locked out 5 times in 24 hours, it'll be completly blacklisted for one full week | ||
− | + | == Use Fail2ban == | |
− | + | === List all jails === | |
[root@sme8 ~]# fail2ban-client status | [root@sme8 ~]# fail2ban-client status | ||
Status | Status | ||
Line 136: | Line 128: | ||
`- Jail list: http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive | `- Jail list: http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive | ||
− | + | === List IP banned from a specific jail === | |
[root@sme8 ~]# fail2ban-client status ssh | [root@sme8 ~]# fail2ban-client status ssh | ||
choose the specific jail with the command above which lists the Jail-list. | choose the specific jail with the command above which lists the Jail-list. | ||
− | === | + | === Example script which list How many ip are banned from all jails === |
nano /root/checklist_ban | nano /root/checklist_ban | ||
− | |||
#!/bin/bash | #!/bin/bash | ||
#lancer le script en sudo | #lancer le script en sudo | ||
− | JAILS=$(fail2ban-client status | grep " Jail list:" | sed 's/`- Jail list: | + | JAILS=$(fail2ban-client status | grep " Jail list:" | sed 's/`- Jail list://g' | sed 's/,//g') |
for j in $JAILS | for j in $JAILS | ||
do | do | ||
echo "$j $(fail2ban-client status $j | grep " Currently banned:" | sed 's/ |- Currently banned:\t//g')" | echo "$j $(fail2ban-client status $j | grep " Currently banned:" | sed 's/ |- Currently banned:\t//g')" | ||
done | done | ||
+ | |||
chmod 700 /root/checklist_ban | chmod 700 /root/checklist_ban | ||
Line 157: | Line 149: | ||
/root/checklist_ban | /root/checklist_ban | ||
− | + | === Unban an IP === | |
In certain case you would to unban an IP immediately because you don't want waste time to wait the automatic IP unban process of fail2ban. | In certain case you would to unban an IP immediately because you don't want waste time to wait the automatic IP unban process of fail2ban. | ||
In first you you have to find the specific jail which has blocked you IP, you can refer to the mail that the admin user has received or you can list a specific jail. | In first you you have to find the specific jail which has blocked you IP, you can refer to the mail that the admin user has received or you can list a specific jail. | ||
Line 196: | Line 188: | ||
/etc/init.d/masq restart | /etc/init.d/masq restart | ||
signal-event fail2ban-conf | signal-event fail2ban-conf | ||
+ | |||
+ | |||
====default jail.conf==== | ====default jail.conf==== | ||
[DEFAULT] | [DEFAULT] | ||
Line 276: | Line 270: | ||
smeserver-sendmail[name="Recidive",dest=root] | smeserver-sendmail[name="Recidive",dest=root] | ||
− | === Uninstall | + | ====Custom local filters==== |
+ | |||
+ | You can add your custom rules by adding a filtername.local file in /etc/fail2ban/filters.d/ | ||
+ | wget https://bugs.koozali.org/attachment.cgi?id=6229 -O /etc/fail2ban/filters.d/apache-badbots.local | ||
+ | |||
+ | would be an example of local bad bots rules, be careful to test for your personal case. Some advanced rules could create a lot of false positive and lock out your users. | ||
+ | |||
+ | == Uninstall == | ||
yum remove smeserver-fail2ban fail2ban | yum remove smeserver-fail2ban fail2ban | ||
− | === Bugs | + | |
+ | ==User contributions== | ||
+ | === Testing new regex === | ||
+ | You can test new regex - notes from here http://bugs.contribs.org/show_bug.cgi?id=8955 | ||
+ | |||
+ | fail2ban-regex [LOG] [REGEX] | ||
+ | |||
+ | You can also test the actual conf files as follows | ||
+ | |||
+ | fail2ban-regex /var/log/qpsmtpd/current /etc/fail2ban/filter.d/qpsmtpd.conf | ||
+ | |||
+ | Note that some characters such as ` may need escaping on the command line like this \` but do not need escaping in the conf files | ||
+ | |||
+ | e.g From qpsmptd.conf file this works in the conf file | ||
+ | |||
+ | ^\s*\d+\s*logging::logterse plugin \(deny\): ` <HOST>\s*.*90\d.*msg denied before queued$ | ||
+ | |||
+ | However, on the command line it needs writing like this | ||
+ | |||
+ | ^\s*\d+\s*logging::logterse plugin \(deny\): \` <HOST>\s*.*90\d.*msg denied before queued$ | ||
+ | |||
+ | |||
+ | ===Show IPs banned by service=== | ||
+ | ====Check the fail2ban log==== | ||
+ | Here is another quick script that shows you the most recent IPs banned in the logs. Note that they may have been unbanned but there is no check for this. | ||
+ | mkdir /root/bin | ||
+ | nano -w /root/bin/IP_list.sh | ||
+ | |||
+ | and copy and paste the below code into the file: | ||
+ | |||
+ | #!/bin/sh | ||
+ | # Set CLI vars to something we can read | ||
+ | TYPE=$1 | ||
+ | LOG=$2 | ||
+ | |||
+ | # Set main grep string | ||
+ | SEARCH="Ban ((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])" | ||
+ | |||
+ | # Add the search term | ||
+ | SEARCH="\[$TYPE]\ $SEARCH" | ||
+ | |||
+ | # Now search the log | ||
+ | grep -oE "\[$TYPE\] Ban ((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])" $LOG | ||
+ | |||
+ | Save the file and make it executable: | ||
+ | chmod 755 /root/bin/IP_list.sh | ||
+ | |||
+ | Usage : | ||
+ | IP_list.sh [service] [log] | ||
+ | |||
+ | e.g. | ||
+ | IP_list.sh qpsmtpd /var/log/fail2ban/daemon.log | ||
+ | ====Check the fail2ban banned IP for all active jails ==== | ||
+ | by [[User:Unnilennium|Unnilennium]] ([[User talk:Unnilennium|talk]]) | ||
+ | mkdir /root/bin | ||
+ | vim /root/bin/sfail2ban | ||
+ | |||
+ | paste this in it: | ||
+ | #!/bin/bash | ||
+ | for SERVI in $(fail2ban-client status|grep 'Jail list'|cut -d':' -f2|sed 's/, / /g'| sed -e 's/^[ \t]*//') | ||
+ | do | ||
+ | fail2ban-client status $SERVI |grep -E 'IP list|Status for the jail'|sed 'N;s/\n/:/'|cut -d: -f2,4 | ||
+ | done | ||
+ | then do | ||
+ | chmod 755 /root/bin/sfail2ban | ||
+ | |||
+ | Usage : | ||
+ | sfail2ban | ||
+ | output: | ||
+ | # sfail2ban | ||
+ | ftp: | ||
+ | imap: | ||
+ | pam-generic: | ||
+ | qpsmtpd: | ||
+ | recidive: 141.98.80.15 | ||
+ | ssh: | ||
+ | ssh-ddos: | ||
+ | wordpress: | ||
+ | |||
+ | ====Print a summary of the fail2ban db==== | ||
+ | mkdir -p /root/bin | ||
+ | vi /root/bin/bansummary.sh | ||
+ | |||
+ | Paste this | ||
+ | <nowiki>#!/bin/bash | ||
+ | echo -e \ | ||
+ | "IP \t"\ | ||
+ | "BanTime \t"\ | ||
+ | "UnbanTime \t"\ | ||
+ | "Jail" | ||
+ | |||
+ | for ban in $(db fail2ban show |awk -F\= ' $2=="ban" {print $1}'); | ||
+ | do | ||
+ | IP=$(db fail2ban getprop $ban Host) | ||
+ | Bantime=$(date +"%F %T" -d @$(db fail2ban getprop $ban BanTimestamp)) | ||
+ | UnBanTime=$(date +"%F %T" -d @$(db fail2ban getprop $ban UnbanTimestamp)) | ||
+ | LastJail=$(zgrep -H "Ban $IP" $(find /var/log/fail2ban -type f -ctime -7) |tail -1 |awk '{print $6}') | ||
+ | |||
+ | printf "%-15s" "$IP" | ||
+ | echo -e "\t$Bantime\t$UnBanTime\t$LastJail" | ||
+ | done | ||
+ | </nowiki> | ||
+ | |||
+ | save, then make executable | ||
+ | chmod 755 /root/bin/bansummary.sh | ||
+ | |||
+ | Usage: | ||
+ | bansummary.sh | ||
+ | Output: | ||
+ | <nowiki>IP BanTime UnbanTime Jail | ||
+ | 46.246.39.228 2017-09-09 18:45:00 2017-09-10 18:45:00 [http-scan] | ||
+ | 124.239.180.102 2017-09-09 12:07:32 2017-09-10 12:07:32 [http-scan] | ||
+ | 212.237.54.93 2017-09-09 19:27:32 2017-09-10 19:27:32 [http-scan] | ||
+ | </nowiki> | ||
+ | |||
+ | ===WordPress=== | ||
+ | Fail2Ban works with WordPress but needs some extra configuration. Please review the WordPress page, https://wiki.contribs.org/Wordpress#Fail2Ban | ||
+ | |||
+ | == Bugs == | ||
Please raise bugs under the SME-Contribs section in [http://bugs.contribs.org/enter_bug.cgi bugzilla] | Please raise bugs under the SME-Contribs section in [http://bugs.contribs.org/enter_bug.cgi bugzilla] | ||
and select the smeserver-fail2ban component or use {{BugzillaFileBug|product=SME%20Contribs|component=smeserver-fail2ban|title=this link}}. | and select the smeserver-fail2ban component or use {{BugzillaFileBug|product=SME%20Contribs|component=smeserver-fail2ban|title=this link}}. | ||
+ | |||
+ | Below is an overview of the current issues for this contrib:{{#bugzilla:columns=id,product,version,status,summary|sort=id|order=desc|component=smeserver-fail2ban|noresultsmessage=No open bugs found.}} | ||
+ | |||
+ | ==Changelog== | ||
+ | Only released version in smecontrib are listed here. | ||
+ | |||
+ | {{#smechangelog: smeserver-fail2ban}} | ||
+ | ---- | ||
[[Category: Contrib]] | [[Category: Contrib]] | ||
+ | [[Category: Security]] |
Latest revision as of 20:25, 30 July 2022
Fail2ban for SME Server
Maintainer
Daniel B.
Firewall Services
mailto:daniel@firewall-services.com
Please discuss, provide feedback and share experiences on the forums here
Description
Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator. Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.
After installation the most important core services (and some additional ones) are monitored by default without the need for manual configuration (see: Services).
Requirements
This contrib has been developed and tested on SME Server 8 and later.
Koozali SME v9/v10
Installation Koozali SME
yum --enablerepo=smecontribs install smeserver-fail2ban
- install the rpms
yum --enablerepo=smecontribs install smeserver-fail2ban
- Apply the needed configuration:
Use care to execute these three commands precisely. Failure to do so may prevent remote login via ssh.
db configuration setprop masq status enabled expand-template /etc/rc.d/init.d/masq /etc/init.d/masq restart signal-event fail2ban-conf
or, as an alternative, use the following commands. They will have the same effect after rebooting.
db configuration setprop masq status enabled signal-event post-upgrade; signal-event reboot
Disable SME Feature AutoBlock SME 9 or greater
It's been noted that one of the features of fail2ban overlaps the built-in ssh AutoBlock feature of SME (https://wiki.contribs.org/AutoBlock). It is possible to disable the AutoBlock feature using the following optional steps.
1. View what your current settings are for the built in SME AutoBlock feature by entering the following at the cli.
# config show sshd
2. If AutoBlock is disabled no action is required. If AutoBlock is enabled, set it to disabled with the following commands:
# config setprop sshd AutoBlock disabled # signal-event remoteaccess-update
DB command
While there is a panel in the server-manager, you can also manage the contrib by the db configuration, it is quite simple
# config show fail2ban fail2ban=service Mail=enabled status=enabled
Available options are below:
- IgnoreIP: a comma separated list of IP or CIDR networks which will never be blocked by fail2ban. Example: 12.15.22.4,17.20.0.0/16. All your local networks and networks allowed to access the server-manager are already automatically whitelisted
- FilterLocalNetworks can be enabled or disabled (default is disabled). If set to enabled, local networks won't be whitelisted, and fail2ban can also ban hosts from the internal networks. Note that networks allowed to access the server-manager are not affected (they will never be blocked)
- BanTime: Duration (in seconds) of a ban. Default to 1800 (about 30 minutes)
- FindTime: The time window fail2ban will check, in seconds. Default is 900. So, this means fail2ban will only check for the number of failed login attempts in the last 15 minutes
- MaxRetry: Number of failed attempts in the last FindTime seconds to trigger a ban. Default is 3
- Mail: can be enabled or disabled (default is enabled). If enabled, each ban will notify the admin by email
- MailRecipient: if Mail is enabled, the email address which should receive ban notifications. Default is root (the admin account will receive)
After changing one of these settings, you need to apply it:
signal-event fail2ban-conf
for example :
config setprop fail2ban IgnoreIP 12.15.22.4,17.20.0.0/16 signal-event fail2ban-conf
Services
The following services are monitored out of the box, and fail2ban will ban client IP for BanTime if more than MaxRetry authentication failure occure in less than FindTime
- ssh
- dovecot (only on SME9, or if you run smeserver-dovecot)
- qpsmtpd. If a remote server send you too many mails which qpsmtpd rejects, it's probably spammer, so Fail2ban will blacklist it. MaxRetry is x3 for this service, so with the default config, a remote server will be blacklisted if 9 mails are rejected in less than 15 minutes
- httpd-e-smith. The standard http server. 3 different filters check apache logs:
- noscripts: check client which ask for scripts which are not available on your server. It's usually script-kiddies trying to exploit security vulerabilities
- scan: another set of filter for popular scans (phpMyAdmin, wp-login, admin area etc...)
- auth: will check for standard authentication failure
- pam. This will check a generic authentication failure. Everything which uses pam should work
- SOGo. Check SOGo logs for failed authentications
- LemonLDAP-NG. Check system logs for auth failure on LemonLDAP::NG portal
- ftp. Check auth failure on your FTP daemon
- Ejabberd. Check auth failure against EJabberd
Each filters will disable itself if the corresponding service is disabled. You can also disable specific filter if you want. For example, if you want to disable Apache filters:
db configuration setprop httpd-e-smith Fail2Ban disabled signal-event fail2ban-conf
Selective bans
Fail2Ban will do its best to do a selective ban. For example, if 3 auth failure against ssh are detected, only tcp port 22 (or any other port you choosed for SSH) will be blocked. Same for httpd-e-smith, SOGO, LemonLDAP::NG which will only blacklist tcp ports 80 and 443, qpsmtpd will block tcp ports 25 and 465, dovecot will block 143 and 993 etc...
There's only two ways to be completly locked (all port/protocol):
- pam. As this is a generic file, it's not possible to check which service was used when an auth failure occured, so the entire client IP will be blacklisted
- recidive. This is a special filter. It monitors fail2Ban logs, and blacklist client IP which gets locked several time. If a client is locked out 5 times in 24 hours, it'll be completly blacklisted for one full week
Use Fail2ban
List all jails
[root@sme8 ~]# fail2ban-client status Status |- Number of jail: 10 `- Jail list: http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive
List IP banned from a specific jail
[root@sme8 ~]# fail2ban-client status ssh
choose the specific jail with the command above which lists the Jail-list.
Example script which list How many ip are banned from all jails
nano /root/checklist_ban #!/bin/bash #lancer le script en sudo JAILS=$(fail2ban-client status | grep " Jail list:" | sed 's/`- Jail list://g' | sed 's/,//g') for j in $JAILS do echo "$j $(fail2ban-client status $j | grep " Currently banned:" | sed 's/ |- Currently banned:\t//g')" done
chmod 700 /root/checklist_ban
to launch the script, do the following command:
/root/checklist_ban
Unban an IP
In certain case you would to unban an IP immediately because you don't want waste time to wait the automatic IP unban process of fail2ban. In first you you have to find the specific jail which has blocked you IP, you can refer to the mail that the admin user has received or you can list a specific jail.
fail2ban-client status qpsmtpd
Status for the jail: qpsmtpd |- filter | |- File list: /var/log/qpsmtpd/current /var/log/sqpsmtpd/current | |- Currently failed: 5 | `- Total failed: 119 `- action |- Currently banned: 1 | `- IP list: 93.17.128.20 `- Total banned: 1
If you want to know all you active jail, then do :
fail2ban-client status
Therefore you have to play with this command to unban your IP
fail2ban-client set qpsmtpd unbanip 93.17.128.20
the generic command is :
fail2ban-client set JAIL unbanip MYIP
Jail.conf
The jail.conf is templated (/etc/e-smith/templates/etc/fail2ban/jail.conf) and the default file contains the configuration as below. You can add your own template of jail.conf at
/etc/e-smith/templates-custom/etc/fail2ban/jail.conf
if first time you need to create the folder for your custom template
mkdir -p /etc/e-smith/templates-custom/etc/fail2ban/jail.conf
and do this to expland templates
expand-template /etc/rc.d/init.d/masq /etc/init.d/masq restart signal-event fail2ban-conf
default jail.conf
[DEFAULT] ignoreip = 127.0.0.0/8 192.168.XXX.XXX 192.168.XXX.0/24 bantime = 1800 findtime = 900 maxretry = 3 usedns = yes backend = auto
[ssh] enabled = true filter = sshd logpath = /var/log/sshd/current action = smeserver-iptables[port="22",protocol=tcp,bantime=1800] smeserver-sendmail[name="SSH",dest=root]
[ssh-ddos] enabled = true filter = sshd-ddos logpath = /var/log/sshd/current action = smeserver-iptables[port="22",protocol=tcp,bantime=1800] smeserver-sendmail[name="SSH",dest=root]
[qpsmtpd] enabled = true filter = qpsmtpd logpath = /var/log/*qpsmtpd/current maxretry = 9 action = smeserver-iptables[port="25,465",protocol=tcp,bantime=1800] smeserver-sendmail[name="Qpsmtpd",dest=root]
[http-overflows] enabled = true filter = apache-overflows logpath = /var/log/httpd/error_log action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800] smeserver-sendmail[name="Apache (overflows)",dest=root]
[http-noscript] enabled = true filter = apache-noscript logpath = /var/log/httpd/error_log action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800] smeserver-sendmail[name="Apache (noscript)",dest=root]
[http-scan] enabled = true filter = apache-scan logpath = /var/log/httpd/error_log action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800] smeserver-sendmail[name="Apache (scan)",dest=root]
[http-auth] enabled = true filter = apache-auth logpath = /var/log/httpd/error_log action = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800] smeserver-sendmail[name="Apache (auth)",dest=root]
[pam-generic] enabled = true filter = pam-generic logpath = /var/log/secure maxretry = 6 action = smeserver-iptables[bantime=1800] smeserver-sendmail[name="PAM generic",dest=root]
[recidive] enabled = true filter = recidive logpath = /var/log/fail2ban/daemon.log bantime = 604800 findtime = 86400 maxretry = 5 backend = polling action = smeserver-iptables[bantime=604800] smeserver-sendmail[name="Recidive",dest=root]
Custom local filters
You can add your custom rules by adding a filtername.local file in /etc/fail2ban/filters.d/
wget https://bugs.koozali.org/attachment.cgi?id=6229 -O /etc/fail2ban/filters.d/apache-badbots.local
would be an example of local bad bots rules, be careful to test for your personal case. Some advanced rules could create a lot of false positive and lock out your users.
Uninstall
yum remove smeserver-fail2ban fail2ban
User contributions
Testing new regex
You can test new regex - notes from here http://bugs.contribs.org/show_bug.cgi?id=8955
fail2ban-regex [LOG] [REGEX]
You can also test the actual conf files as follows
fail2ban-regex /var/log/qpsmtpd/current /etc/fail2ban/filter.d/qpsmtpd.conf
Note that some characters such as ` may need escaping on the command line like this \` but do not need escaping in the conf files
e.g From qpsmptd.conf file this works in the conf file
^\s*\d+\s*logging::logterse plugin \(deny\): ` <HOST>\s*.*90\d.*msg denied before queued$
However, on the command line it needs writing like this
^\s*\d+\s*logging::logterse plugin \(deny\): \` <HOST>\s*.*90\d.*msg denied before queued$
Show IPs banned by service
Check the fail2ban log
Here is another quick script that shows you the most recent IPs banned in the logs. Note that they may have been unbanned but there is no check for this.
mkdir /root/bin nano -w /root/bin/IP_list.sh
and copy and paste the below code into the file:
#!/bin/sh # Set CLI vars to something we can read TYPE=$1 LOG=$2 # Set main grep string SEARCH="Ban ((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])" # Add the search term SEARCH="\[$TYPE]\ $SEARCH" # Now search the log grep -oE "\[$TYPE\] Ban ((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])" $LOG
Save the file and make it executable:
chmod 755 /root/bin/IP_list.sh
Usage :
IP_list.sh [service] [log]
e.g.
IP_list.sh qpsmtpd /var/log/fail2ban/daemon.log
Check the fail2ban banned IP for all active jails
by Unnilennium (talk)
mkdir /root/bin vim /root/bin/sfail2ban
paste this in it:
#!/bin/bash for SERVI in $(fail2ban-client status|grep 'Jail list'|cut -d':' -f2|sed 's/, / /g'| sed -e 's/^[ \t]*//') do fail2ban-client status $SERVI |grep -E 'IP list|Status for the jail'|sed 'N;s/\n/:/'|cut -d: -f2,4 done
then do
chmod 755 /root/bin/sfail2ban
Usage :
sfail2ban
output:
# sfail2ban ftp: imap: pam-generic: qpsmtpd: recidive: 141.98.80.15 ssh: ssh-ddos: wordpress:
Print a summary of the fail2ban db
mkdir -p /root/bin vi /root/bin/bansummary.sh
Paste this
#!/bin/bash echo -e \ "IP \t"\ "BanTime \t"\ "UnbanTime \t"\ "Jail" for ban in $(db fail2ban show |awk -F\= ' $2=="ban" {print $1}'); do IP=$(db fail2ban getprop $ban Host) Bantime=$(date +"%F %T" -d @$(db fail2ban getprop $ban BanTimestamp)) UnBanTime=$(date +"%F %T" -d @$(db fail2ban getprop $ban UnbanTimestamp)) LastJail=$(zgrep -H "Ban $IP" $(find /var/log/fail2ban -type f -ctime -7) |tail -1 |awk '{print $6}') printf "%-15s" "$IP" echo -e "\t$Bantime\t$UnBanTime\t$LastJail" done
save, then make executable
chmod 755 /root/bin/bansummary.sh
Usage:
bansummary.sh
Output:
IP BanTime UnbanTime Jail 46.246.39.228 2017-09-09 18:45:00 2017-09-10 18:45:00 [http-scan] 124.239.180.102 2017-09-09 12:07:32 2017-09-10 12:07:32 [http-scan] 212.237.54.93 2017-09-09 19:27:32 2017-09-10 19:27:32 [http-scan]
WordPress
Fail2Ban works with WordPress but needs some extra configuration. Please review the WordPress page, https://wiki.contribs.org/Wordpress#Fail2Ban
Bugs
Please raise bugs under the SME-Contribs section in bugzilla and select the smeserver-fail2ban component or use this link .
Below is an overview of the current issues for this contrib:
ID | Product | Version | Status | Summary (12 tasks) ⇒ |
---|---|---|---|---|
12453 | SME Contribs | 10.0 | CONFIRMED | extra coma leading to empty string fails ignore ip template fragment |
12402 | SME Contribs | 10.0 | UNCONFIRMED | Using smeserver-git makes smeserver-fail2ban ban even though whitelisted. |
12285 | SME Contribs | 10.0 | UNCONFIRMED | WARNING message in daemon log after reboot about ssh |
12199 | SME Contribs | 10.0 | CONFIRMED | add externalip /internal ip to whitelist |
11805 | SME Contribs | 10.0 | CONFIRMED | NFR: use fail2ban db to list banned host |
11801 | SME Contribs | 10.0 | CONFIRMED | NFR: add a permanent/custom or manual jail |
10799 | SME Contribs | Futur | CONFIRMED | NFR: Fail2ban OpenVPN routed templates |
10798 | SME Contribs | 9.2 | CONFIRMED | NFR convert long mask to bit mask if entered as long mask |
10786 | SME Contribs | 9.2 | CONFIRMED | lockout without a full masq restart |
10638 | SME Contribs | 9.2 | CONFIRMED | IgnoreIP entry created with trailing slash stopping f2b from working |
10422 | SME Contribs | 9.2 | UNCONFIRMED | NFR: portscan jail |
8955 | SME Contribs | 9.2 | UNCONFIRMED | Fail2Ban error in qpsmtpd.conf regex |
Changelog
Only released version in smecontrib are listed here.
- Edit SM2 Menu entry to conform to new arrangements [SME: 12493]
2022/07/29 Jean-Philippe Pialasse 0.1.18-30.sme
- add to core backup [SME: 12008]
- revert previous patch, wrong package [SME: 12011]
- add to core backup [SME: 12011]
- apply locale patch 2022-07-22