Fail2ban/fr

Languages:

English  • français

Fail2ban pour SME Server

	Skill level: Facile
	Les instructions sur cette page peuvent être suivis par un débutant.

Mainteneur

Daniel B.
Firewall Services
mailto:daniel@firewall-services.com

Description

Fail2ban fonctionne en surveillant les fichiers journaux (Ex : /var/log/pwdfail, /var/log/auth.log, etc.) pour les entrées sélectionnées et l'exécution de scripts basés sur eux. Le plus souvent il est utilisé pour bloquer des adresses IP sélectionnés qui peuvent appartenir à des hôtes qui tentent de compromettre la sécurité du système. Il peut interdire une IP de l'hôte qui fait trop de tentatives de connexion ou autre action non désirée dans un laps de temps défini par l'administrateur.

Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.

	Tip:
	Fail2ban n'est pas seulement un outil contre les attaques par force brute sur SSH, mais il peut être un outil utile contre les attaques de protocole http ou spam sur votre serveur. Voir la section prison

Systèmes requis

Cette contrib a été développé et testé sur SME Server 8 et plus. Il ne fonctionnera probablement pas sur les SME 7.

	Note:
	L'option SME AutoBlock SSH doit être désactivé pour s'assurer que les contrôles de fail2ban du trafic SSH ne sont pas construite dans le Firewall.

Installation

Configurez les dépôts Firewall-Services, rpmforge :

db yum_repositories set fws repository \
BaseURL http://repo.firewall-services.com/centos/\$releasever \
EnableGroups no GPGCheck yes \
Name "Firewall Services" \
GPGKey http://repo.firewall-services.com/RPM-GPG-KEY \
Visible yes status disabled

Configurez les dépôts EPEL : Pour SME 8.x,

/sbin/e-smith/db yum_repositories set epel repository \
Name 'Epel - EL5' \
BaseUrl 'http://download.fedoraproject.org/pub/epel/5/$basearch' \
MirrorList 'http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=$basearch' \
EnableGroups no \
GPGCheck yes \
GPGKey http://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL \
Visible no \
status disabled

signal-event yum-modify

• Redémarrez les services

yum --enablerepo=fws --enablerepo=epel install smeserver-fail2ban

	Note:
	you have to install the fail2ban version of fws repository and not the epel version

• Appliquer la configuration nécessaire :

expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf

ou

signal-event post-upgrade; signal-event reboot

	Warning:
	A défaut d'exécuter l'une de ces commandes, l'accès au réseau sera verrouillés le temps de recharger les règles d'iptables

Commandes DB

Il n'y à pas de panneau de configuration, vous pouvez encore gérer la contrib avec db configuration, c'est assez simple.

# config show fail2ban 
fail2ban=service
   Mail=enabled
   status=enabled

Les options disponibles sont ci-dessous :

• IgnoreIP: a comma separated list of IP or CIDR networks which will never be blocked by fail2ban. Exemple: 12.15.22.4,17.20.0.0/16. All your local networks and networks allowed to access the server-manager are already automatically whitelisted
• FilterLocalNetworks can be enabled or disabled (default is disabled). If set to enabled, local networks won't be whitelisted, and fail2ban can also ban hosts from the internal networks. Note that networks allowed to access the server-manager are not affected (they will never be blocked)
• BanTime: Duration (in seconds) of a ban. Default to 1800
• FindTime: The window fail2ban will check, in seconds. Default is 900. So, this mean fail2ban will only check for the number of failed login attempts in the last 15 minuts
• MaxRetry: Number of failed attempts in the last FindTime seconds to trigger a ban. Default is 3
• Mail: can be enabled or disabled (default is enabled). If enabled, each ban will be notified by mail
• MailRecipient: if Mail is enabled, the email address which should receive ban notifications. Default is root (the admin account will receive)

Ensuite, pour appliquer les changements :

signal-event fail2ban-conf

Services

Les services suivants sont surveillés, et fail2ban interdira les IP pour BanTime si plus de MaxRetry de l'échec d'authentification se produisent avec moins de FindTime

• ssh
• dovecot (only on SME9, or if you run smeserver-dovecot)
• qpsmtpd. If a remote server send you too many mails which qpsmtpd rejects, it's probably spammer, so Fail2ban will blacklist it. MaxRetry is x3 for this service, so with the default config, a remote server will be blacklisted if 9 mails are rejected in less than 15 minutes
• httpd-e-smith. The standard http server. 3 different filters check apache logs:
  • noscripts: check client which ask for scripts which are not available on your server. It's usually script-kiddies trying to exploit security vulerabilities
  • scan: another set of filter for popular scans (phpMyAdmin, wp-login, admin area etc...)
  • auth: will check for standard authentication failure
• pam. This will check a generic authentication failure. Everything which uses pam should work
• SOGo. Check SOGo logs for failed authentications
• LemonLDAP-NG. Check system logs for auth failure on LemonLDAP::NG portal
• ftp. Check auth failure on your FTP daemon
• Ejabberd. Check auth failure against EJabberd

Each filters will disable itself if the corresponding service is disabled. You can also disable specific filter if you want. For example, if you want to disable Apache filters:

db configuration setprop httpd-e-smith Fail2Ban disabled
signal-event fail2ban-conf

Bans Sélectifs

Fail2Ban fera de son mieux pour faire une interdiction sélective. Par exemple, si 3 échecs d'authentification avec SSH sont détectés, seul le port TCP 22 (ou tout autre port vous avez choisi pour SSH) seront bloqués. Idem pour httpd-e-smith, SOGO, LemonLDAP::NG which will only blacklist tcp ports 80 et 443, qpsmtpd will block tcp ports 25 et 465, dovecot will block 143 et 993 etc...

Il y a seulement deux façons de verrouiller complètement (tous port/protocol) :

• pam. Comme il s'agit d'un fichier générique, il n'est pas possible de vérifier où le service a été utilisé lors d'un échec d'authentification, donc l'ensemble de l'IP du client sera mis en liste noire.
• recidive. Il s'agit d'un filtre spécial. Il surveille les journaux Fail2Ban et IP du client et la liste noire qui est verrouillé plusieurs fois. Si un client est bloqué 5 fois en 24 heures, il sera complètement mis en liste noire pour une semaine complète

Utilisation de Fail2ban

Lister toutes les prisons

[root@sme8 ~]# fail2ban-client status 
Status
|- Number of jail:	10
`- Jail list:		http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive

Lister les IP bannis d'une prison spécifique

[root@sme8 ~]# fail2ban-client status ssh

choose the specific jail with the command above which lists the Jail-list.

Jouez avec un script qui liste combien d'IP sont interdits dans toutes les prisons

nano /root/checklist_ban

#!/bin/bash
#lancer le script en sudo 
JAILS=$(fail2ban-client status | grep " Jail list:" | sed 's/`- Jail list:\t\t//g' | sed 's/,//g')
for j in $JAILS
do
echo "$j $(fail2ban-client status $j | grep " Currently banned:" | sed 's/   |- Currently banned:\t//g')"
done

chmod 700 /root/checklist_ban

to launch the script, do the following command:

/root/checklist_ban

Réintégrer une IP

In certain case you would to unban an IP immediately because you don't want waste time to wait the automatic IP unban process of fail2ban. In first you you have to find the specific jail which has blocked you IP, you can refer to the mail that the admin user has received or you can list a specific jail.

fail2ban-client status qpsmtpd

Status for the jail: qpsmtpd
|- filter
|  |- File list:	/var/log/qpsmtpd/current /var/log/sqpsmtpd/current 
|  |- Currently failed:	5
|  `- Total failed:	119
`- action
   |- Currently banned:	1
   |  `- IP list:	93.17.128.20 
   `- Total banned:	1

If you want to know all you active jail, then do :

fail2ban-client status

Therefore you have to play with this command to unban your IP

fail2ban-client set qpsmtpd unbanip 93.17.128.20 

the generic command is :

fail2ban-client set JAIL unbanip MYIP

Jail.conf

The jail.conf is templated (/etc/e-smith/templates/etc/fail2ban/jail.conf) and the default file contains the configuration as below. You can add your own template of jail.conf at

/etc/e-smith/templates-custom/etc/fail2ban/jail.conf

if first time you need to create the folder for your custom template

mkdir -p  /etc/e-smith/templates-custom/etc/fail2ban/jail.conf

and do this to expland templates

expand-template /etc/rc.d/init.d/masq
/etc/init.d/masq restart
signal-event fail2ban-conf

Default jail.conf

[DEFAULT]
ignoreip = 127.0.0.0/8 192.168.XXX.XXX 192.168.XXX.0/24
bantime  = 1800
findtime  = 900
maxretry = 3
usedns = yes
backend = auto

	Note:
	Your network and your server are in the list of ignored IP by fail2ban (see IgnoreIP)

[ssh]
enabled  = true
filter   = sshd
logpath  = /var/log/sshd/current
action   = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="SSH",dest=root]

[ssh-ddos]
enabled  = true
filter   = sshd-ddos
logpath  = /var/log/sshd/current
action   = smeserver-iptables[port="22",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="SSH",dest=root]

[qpsmtpd]
enabled  = true
filter   = qpsmtpd
logpath  = /var/log/*qpsmtpd/current
maxretry = 9
action   = smeserver-iptables[port="25,465",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Qpsmtpd",dest=root]

[http-overflows]
enabled  = true
filter   = apache-overflows
logpath  = /var/log/httpd/error_log
action   = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Apache (overflows)",dest=root]

[http-noscript]
enabled  = true
filter   = apache-noscript
logpath  = /var/log/httpd/error_log
action   = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Apache (noscript)",dest=root]

[http-scan]
enabled  = true
filter   = apache-scan
logpath  = /var/log/httpd/error_log
action   = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Apache (scan)",dest=root]

[http-auth]
enabled  = true
filter   = apache-auth
logpath  = /var/log/httpd/error_log
action   = smeserver-iptables[port="80,443",protocol=tcp,bantime=1800]
          smeserver-sendmail[name="Apache (auth)",dest=root]

[pam-generic]
enabled  = true
filter   = pam-generic
logpath  = /var/log/secure
maxretry = 6
action   = smeserver-iptables[bantime=1800]
          smeserver-sendmail[name="PAM generic",dest=root]

[recidive]
enabled  = true
filter   = recidive
logpath  = /var/log/fail2ban/daemon.log
bantime  = 604800
findtime = 86400
maxretry = 5
backend  = polling
action   = smeserver-iptables[bantime=604800]
          smeserver-sendmail[name="Recidive",dest=root]

Désinstallation

yum remove smeserver-fail2ban fail2ban

Bugs

Please raise bugs under the SME-Contribs section in bugzilla and select the smeserver-fail2ban component or use this link .