Changes

{{Level|Easy|The instructions on this page can be followed by a beginner.}}

{{Level|Easy|The instructions on this page can be followed by a beginner.}}

=== Maintainer ===

== Maintainer ==

[[User:VIP-ire|Daniel B.]]<br/>

[[User:VIP-ire|Daniel B.]]<br/>

[http://www.firewall-services.com Firewall Services]<br>

[http://www.firewall-services.com Firewall Services]<br>

Please discuss, provide feedback and share epxeriences on the forums [http://forums.contribs.org/index.php/topic,51127.0.html '''here''']

Please discuss, provide feedback and share epxeriences on the forums [http://forums.contribs.org/index.php/topic,51127.0.html '''here''']

=== Description ===

== Description ==

Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator.  

Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator.  

Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.

Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.

{{Tip box|fail2ban is not only a tool against brute force attack on ssh but it can be a tool useful against http protocol attacks or [http://forums.contribs.org/index.php/topic,50162.msg252195.html#msg252195 spam attacks] on your server. See the [[Fail2ban#Jail.conf |jail section]]}}

{{Tip box|fail2ban is not only a tool against brute force attack on ssh but it can be a tool useful against http protocol attacks or [http://forums.contribs.org/index.php/topic,50162.msg252195.html#msg252195 spam attacks] on your server. See the [[Fail2ban#Jail.conf |jail section]]}}

=== Requirements ===

== Requirements ==

This contrib has been developped and tested on SME Server 8 and later. It probably won't work on SME 7.

This contrib has been developped and tested on SME Server 8 and later. It probably won't work on SME 7.

{{Note box|The SME feature [http://wiki.contribs.org/AutoBlock AutoBlock SSH] should be disabled to ensure that fail2ban controls SSH traffic and not the SME build-in firewall.}}

{{Note box|The SME feature [http://wiki.contribs.org/AutoBlock AutoBlock SSH] should be disabled to ensure that fail2ban controls SSH traffic and not the SME build-in firewall.}}

=== Installation sme8 and sme9===

== Installation sme8 and sme9 ==

Configure Firewall-Services's repository:

Configure Firewall-Services's repository:

{{warning box| Failing to run either of these command will completely lock network access next time iptables rules are reloaded}}

{{warning box| Failing to run either of these command will completely lock network access next time iptables rules are reloaded}}

===DB command===

==DB command==

there is no panel yet you can manage the contrib by the db configuration, it is quite simple

there is no panel yet you can manage the contrib by the db configuration, it is quite simple

{{Note box|<code>signal-event fail2ban-conf</code> effectively restarts the service and clears existing bans, but a suitable 'findtime' results in a reban. Be aware that the restart delay can be unexpectedly lengthy due to the resource intensive process of scanning the logs  to reban offending addresses.}}

{{Note box|<code>signal-event fail2ban-conf</code> effectively restarts the service and clears existing bans, but a suitable 'findtime' results in a reban. Be aware that the restart delay can be unexpectedly lengthy due to the resource intensive process of scanning the logs  to reban offending addresses.}}

===Services===

== Services ==

The following services are monitored out of the box, and fail2ban will ban client IP for '''BanTime''' if more than '''MaxRetry''' authentication failure occure in less than '''FindTime'''

The following services are monitored out of the box, and fail2ban will ban client IP for '''BanTime''' if more than '''MaxRetry''' authentication failure occure in less than '''FindTime'''

  signal-event fail2ban-conf

  signal-event fail2ban-conf

===Selective bans===

== Selective bans ==

Fail2Ban will do its best to do a selective ban. For example, if 3 auth failure against ssh are detected, only tcp port 22 (or any other port you choosed for SSH) will be blocked. Same for httpd-e-smith, SOGO, LemonLDAP::NG which will only blacklist tcp ports 80 and 443, qpsmtpd will block tcp ports 25 and 465, dovecot will block 143 and 993 etc...

Fail2Ban will do its best to do a selective ban. For example, if 3 auth failure against ssh are detected, only tcp port 22 (or any other port you choosed for SSH) will be blocked. Same for httpd-e-smith, SOGO, LemonLDAP::NG which will only blacklist tcp ports 80 and 443, qpsmtpd will block tcp ports 25 and 465, dovecot will block 143 and 993 etc...

* recidive. This is a special filter. It monitors fail2Ban logs, and blacklist client IP which gets locked several time. If a client is locked out 5 times in 24 hours, it'll be completly blacklisted for one full week

* recidive. This is a special filter. It monitors fail2Ban logs, and blacklist client IP which gets locked several time. If a client is locked out 5 times in 24 hours, it'll be completly blacklisted for one full week

===Use Fail2ban===

== Use Fail2ban ==

====List all jails====

=== List all jails ===

  [root@sme8 ~]# fail2ban-client status  

  [root@sme8 ~]# fail2ban-client status  

  Status

  Status

  `- Jail list: http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive

  `- Jail list: http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive

====List IP banned from a specific jail====

=== List IP banned from a specific jail ===

  [root@sme8 ~]# fail2ban-client status ssh

  [root@sme8 ~]# fail2ban-client status ssh

choose the specific jail with the command above which lists the Jail-list.

choose the specific jail with the command above which lists the Jail-list.

====Play with a script which list How many ip are banned from all jails====

=== Example script which list How many ip are banned from all jails ===

  nano /root/checklist_ban

  nano /root/checklist_ban

==== Unban an IP ====

=== Unban an IP ===

In certain case you would to unban an IP immediately because you don't want waste time to wait the  automatic IP unban process of fail2ban.

In certain case you would to unban an IP immediately because you don't want waste time to wait the  automatic IP unban process of fail2ban.

In first you you have to find the specific jail which has blocked you IP, you can refer to the mail that the admin user has received or you can list a specific jail.

In first you you have to find the specific jail which has blocked you IP, you can refer to the mail that the admin user has received or you can list a specific jail.