Changes

Jump to navigation Jump to search
3,061 bytes added ,  16:04, 5 April 2020
Line 4: Line 4:  
{{Level|Easy|The instructions on this page can be followed by a beginner.}}
 
{{Level|Easy|The instructions on this page can be followed by a beginner.}}
   −
=== Maintainer ===
+
== Maintainer ==
[[User:VIP-ire|Daniel B.]]<br/>
+
[[User:VIP-ire|Daniel B.]]<br />
 
[http://www.firewall-services.com Firewall Services]<br>
 
[http://www.firewall-services.com Firewall Services]<br>
 
mailto:daniel@firewall-services.com
 
mailto:daniel@firewall-services.com
   −
Please discuss, provide feedback and share epxeriences on the forums [http://forums.contribs.org/index.php/topic,51127.0.html '''here''']
+
Please discuss, provide feedback and share experiences on the forums [http://forums.contribs.org/index.php/topic,51127.0.html '''here''']
   −
=== Description ===
+
== Description ==
 
Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator.  
 
Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator.  
 
Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.
 
Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.
Line 19: Line 19:  
{{Tip box|fail2ban is not only a tool against brute force attack on ssh but it can be a tool useful against http protocol attacks or [http://forums.contribs.org/index.php/topic,50162.msg252195.html#msg252195 spam attacks] on your server. See the [[Fail2ban#Jail.conf |jail section]]}}
 
{{Tip box|fail2ban is not only a tool against brute force attack on ssh but it can be a tool useful against http protocol attacks or [http://forums.contribs.org/index.php/topic,50162.msg252195.html#msg252195 spam attacks] on your server. See the [[Fail2ban#Jail.conf |jail section]]}}
   −
=== Requirements ===
+
== Requirements ==
This contrib has been developped and tested on SME Server 8 and later. It probably won't work on SME 7.
+
This contrib has been developed and tested on SME Server 8 and later.
       
{{Note box|The SME feature [http://wiki.contribs.org/AutoBlock AutoBlock SSH] should be disabled to ensure that fail2ban controls SSH traffic and not the SME build-in firewall.}}
 
{{Note box|The SME feature [http://wiki.contribs.org/AutoBlock AutoBlock SSH] should be disabled to ensure that fail2ban controls SSH traffic and not the SME build-in firewall.}}
   −
=== Installation sme8 and sme9===
+
==Koozali SME v9==
Configure Firewall-Services's repository:
+
{{#smeversion: smeserver-fail2ban}}
 
  −
db yum_repositories set fws repository \
  −
BaseURL http://repo.firewall-services.com/centos/\$releasever \
  −
EnableGroups no GPGCheck yes \
  −
Name "Firewall Services" \
  −
GPGKey http://repo.firewall-services.com/RPM-GPG-KEY \
  −
Visible yes status disabled
  −
 
      +
== Installation sme9 ==
 
Configure EPEL's repository:
 
Configure EPEL's repository:
For SME 8.x,
  −
  −
/sbin/e-smith/db yum_repositories set epel repository \
  −
Name 'Epel - EL5' \
  −
BaseUrl 'http://download.fedoraproject.org/pub/epel/5/$basearch' \
  −
MirrorList 'http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=$basearch' \
  −
EnableGroups no \
  −
GPGCheck yes \
  −
GPGKey http://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL \
  −
Visible no \
  −
status disabled
      
<onlyinclude>{{#ifeq:{{{transcludesection|epel9}}}|epel9|
 
<onlyinclude>{{#ifeq:{{{transcludesection|epel9}}}|epel9|
Line 66: Line 48:  
*install the rpms
 
*install the rpms
   −
  yum --enablerepo=fws --enablerepo=epel install smeserver-fail2ban
+
  yum --enablerepo=smecontribs --enablerepo=epel install smeserver-fail2ban
      Line 72: Line 54:  
Use care to execute these three commands precisely. Failure to do so may prevent remote login via ssh.  
 
Use care to execute these three commands precisely. Failure to do so may prevent remote login via ssh.  
    +
db configuration setprop masq status enabled
 
  expand-template /etc/rc.d/init.d/masq
 
  expand-template /etc/rc.d/init.d/masq
 
  /etc/init.d/masq restart
 
  /etc/init.d/masq restart
 
  signal-event fail2ban-conf
 
  signal-event fail2ban-conf
 
or, as an alternative, use the following commands. They will have the same effect after rebooting.
 
or, as an alternative, use the following commands. They will have the same effect after rebooting.
 +
db configuration setprop masq status enabled
 
  signal-event post-upgrade; signal-event reboot
 
  signal-event post-upgrade; signal-event reboot
 +
    
{{warning box| Failing to run either of these command will completely lock network access next time iptables rules are reloaded}}
 
{{warning box| Failing to run either of these command will completely lock network access next time iptables rules are reloaded}}
 +
{{warning box| The masq service must be enabled for fail2Ban to work correctly. If you disable it, Fail2ban won't ban anything}}
   −
===DB command===
+
== Disable SME Feature AutoBlock SME 9 or greater ==
there is no panel yet you can manage the contrib by the db configuration, it is quite simple
+
It's been noted that one of the features of fail2ban overlaps the built-in ssh AutoBlock feature of SME (https://wiki.contribs.org/AutoBlock).
 +
It is possible to disable the AutoBlock feature using the following optional steps.
 +
 
 +
1. View what your current settings are for the built in SME AutoBlock feature by entering the following at the cli.
 +
# config show sshd
 +
2. If AutoBlock is disabled no action is required. If AutoBlock is enabled, set it to disabled with the following commands:
 +
# config setprop sshd AutoBlock disabled
 +
# signal-event remoteaccess-update
 +
 
 +
==DB command==
 +
While there is a panel in the server-manager, you can also manage the contrib by the db configuration, it is quite simple
    
  # config show fail2ban  
 
  # config show fail2ban  
Line 90: Line 86:  
Available options are below:
 
Available options are below:
   −
* '''IgnoreIP''': a comma separated list of IP or CIDR networks which will never be blocked by fail2ban. Exemple: 12.15.22.4,17.20.0.0/16. All your local networks and networks allowed to access the server-manager are already automatically whitelisted
+
* '''IgnoreIP''': a comma separated list of IP or CIDR networks which will never be blocked by fail2ban. Example: 12.15.22.4,17.20.0.0/16. All your local networks and networks allowed to access the server-manager are already automatically whitelisted
 
* '''FilterLocalNetworks''' can be enabled or disabled (default is disabled). If set to enabled, local networks won't be whitelisted, and fail2ban can also ban hosts from the internal networks. Note that networks allowed to access the server-manager are not affected (they will never be blocked)
 
* '''FilterLocalNetworks''' can be enabled or disabled (default is disabled). If set to enabled, local networks won't be whitelisted, and fail2ban can also ban hosts from the internal networks. Note that networks allowed to access the server-manager are not affected (they will never be blocked)
* '''BanTime''': Duration (in seconds) of a ban. Default to 1800
+
* '''BanTime''': Duration (in seconds) of a ban. Default to 1800 (about 30 minutes)
* '''FindTime''': The window fail2ban will check, in seconds. Default is 900. So, this mean fail2ban will only check for the number of failed login attempts in the last 15 minuts
+
* '''FindTime''': The time window fail2ban will check, in seconds. Default is 900. So, this means fail2ban will only check for the number of failed login attempts in the last 15 minutes
 
* '''MaxRetry''': Number of failed attempts in the last '''FindTime''' seconds to trigger a ban. Default is 3
 
* '''MaxRetry''': Number of failed attempts in the last '''FindTime''' seconds to trigger a ban. Default is 3
* '''Mail''': can be enabled or disabled (default is enabled). If enabled, each ban will be notified by mail
+
* '''Mail''': can be enabled or disabled (default is enabled). If enabled, each ban will notify the admin by email
 
* '''MailRecipient''': if '''Mail''' is enabled, the email address which should receive ban notifications. Default is root (the admin account will receive)
 
* '''MailRecipient''': if '''Mail''' is enabled, the email address which should receive ban notifications. Default is root (the admin account will receive)
   Line 108: Line 104:  
{{Note box|<code>signal-event fail2ban-conf</code> effectively restarts the service and clears existing bans, but a suitable 'findtime' results in a reban. Be aware that the restart delay can be unexpectedly lengthy due to the resource intensive process of scanning the logs  to reban offending addresses.}}
 
{{Note box|<code>signal-event fail2ban-conf</code> effectively restarts the service and clears existing bans, but a suitable 'findtime' results in a reban. Be aware that the restart delay can be unexpectedly lengthy due to the resource intensive process of scanning the logs  to reban offending addresses.}}
   −
===Services===
+
== Services ==
 
The following services are monitored out of the box, and fail2ban will ban client IP for '''BanTime''' if more than '''MaxRetry''' authentication failure occure in less than '''FindTime'''
 
The following services are monitored out of the box, and fail2ban will ban client IP for '''BanTime''' if more than '''MaxRetry''' authentication failure occure in less than '''FindTime'''
   Line 129: Line 125:  
  signal-event fail2ban-conf
 
  signal-event fail2ban-conf
   −
===Selective bans===
+
== Selective bans ==
 
Fail2Ban will do its best to do a selective ban. For example, if 3 auth failure against ssh are detected, only tcp port 22 (or any other port you choosed for SSH) will be blocked. Same for httpd-e-smith, SOGO, LemonLDAP::NG which will only blacklist tcp ports 80 and 443, qpsmtpd will block tcp ports 25 and 465, dovecot will block 143 and 993 etc...
 
Fail2Ban will do its best to do a selective ban. For example, if 3 auth failure against ssh are detected, only tcp port 22 (or any other port you choosed for SSH) will be blocked. Same for httpd-e-smith, SOGO, LemonLDAP::NG which will only blacklist tcp ports 80 and 443, qpsmtpd will block tcp ports 25 and 465, dovecot will block 143 and 993 etc...
   Line 136: Line 132:  
* recidive. This is a special filter. It monitors fail2Ban logs, and blacklist client IP which gets locked several time. If a client is locked out 5 times in 24 hours, it'll be completly blacklisted for one full week
 
* recidive. This is a special filter. It monitors fail2Ban logs, and blacklist client IP which gets locked several time. If a client is locked out 5 times in 24 hours, it'll be completly blacklisted for one full week
   −
===Use Fail2ban===
+
== Use Fail2ban ==
====List all jails====
+
=== List all jails ===
 
  [root@sme8 ~]# fail2ban-client status  
 
  [root@sme8 ~]# fail2ban-client status  
 
  Status
 
  Status
Line 143: Line 139:  
  `- Jail list: http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive
 
  `- Jail list: http-overflows, http-noscript, http-auth, sogo, pam-generic, ssh-ddos, http-scan, ssh, qpsmtpd, recidive
   −
====List IP banned from a specific jail====
+
=== List IP banned from a specific jail ===
 
  [root@sme8 ~]# fail2ban-client status ssh
 
  [root@sme8 ~]# fail2ban-client status ssh
 
choose the specific jail with the command above which lists the Jail-list.
 
choose the specific jail with the command above which lists the Jail-list.
   −
====Play with a script which list How many ip are banned from all jails====
+
=== Example script which list How many ip are banned from all jails ===
    
  nano /root/checklist_ban
 
  nano /root/checklist_ban
   
  #!/bin/bash
 
  #!/bin/bash
 
  #lancer le script en sudo  
 
  #lancer le script en sudo  
  JAILS=$(fail2ban-client status | grep " Jail list:" | sed 's/`- Jail list:\t\t//g' | sed 's/,//g')
+
  JAILS=$(fail2ban-client status | grep " Jail list:" | sed 's/`- Jail list://g' | sed 's/,//g')
 
  for j in $JAILS
 
  for j in $JAILS
 
  do
 
  do
 
  echo "$j $(fail2ban-client status $j | grep " Currently banned:" | sed 's/  |- Currently banned:\t//g')"
 
  echo "$j $(fail2ban-client status $j | grep " Currently banned:" | sed 's/  |- Currently banned:\t//g')"
 
  done
 
  done
 +
    
  chmod 700 /root/checklist_ban
 
  chmod 700 /root/checklist_ban
Line 164: Line 160:  
  /root/checklist_ban
 
  /root/checklist_ban
   −
 
+
=== Unban an IP ===
====Show IPs banned by service====
  −
 
  −
Here is another quick script that shows you the most recent IPs banned in the logs. Note that they may have been unbanned but there is no check for this.
  −
 
  −
nano -w /root/IP_list.sh
  −
 
  −
and copy and paste the below code into the file:
  −
 
  −
#!/bin/sh
  −
# Set CLI vars to something we can read
  −
TYPE=$1
  −
LOG=$2
  −
  −
# Set main grep string
  −
SEARCH="Ban ((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])"
  −
  −
# Add the search term
  −
SEARCH="\[$TYPE]\ $SEARCH"
  −
  −
# Now search the log
  −
grep -oE "\[$TYPE\] Ban ((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])" $LOG
  −
 
  −
Save the file and make it executable:
  −
chmod 755 /root/IP_list.sh
  −
 
  −
Usage :
  −
/root/IP_List.sh [service] [log]
  −
 
  −
e.g.
  −
/root/IP_List.sh qpsmtpd /var/log/fail2ban/daemon.log
  −
 
  −
==== Unban an IP ====
   
In certain case you would to unban an IP immediately because you don't want waste time to wait the  automatic IP unban process of fail2ban.
 
In certain case you would to unban an IP immediately because you don't want waste time to wait the  automatic IP unban process of fail2ban.
 
In first you you have to find the specific jail which has blocked you IP, you can refer to the mail that the admin user has received or you can list a specific jail.
 
In first you you have to find the specific jail which has blocked you IP, you can refer to the mail that the admin user has received or you can list a specific jail.
Line 235: Line 199:  
  /etc/init.d/masq restart
 
  /etc/init.d/masq restart
 
  signal-event fail2ban-conf
 
  signal-event fail2ban-conf
 +
 +
 
====default jail.conf====
 
====default jail.conf====
 
  [DEFAULT]
 
  [DEFAULT]
Line 316: Line 282:       −
=== Uninstall ===
+
== Uninstall ==
 
  yum remove smeserver-fail2ban fail2ban
 
  yum remove smeserver-fail2ban fail2ban
   −
=== Bugs ===
+
 
 +
==User contributions==
 +
=== Testing new regex ===
 +
You can test new regex - notes from here http://bugs.contribs.org/show_bug.cgi?id=8955
 +
 
 +
fail2ban-regex [LOG] [REGEX]
 +
 
 +
You can also test the actual conf files as follows
 +
 
 +
fail2ban-regex /var/log/qpsmtpd/current /etc/fail2ban/filter.d/qpsmtpd.conf
 +
 
 +
Note that some characters such as ` may need escaping on the command line like this \` but do not need escaping in the conf files
 +
 
 +
e.g From qpsmptd.conf file this works in the conf file
 +
 
 +
^\s*\d+\s*logging::logterse plugin \(deny\): ` <HOST>\s*.*90\d.*msg denied before queued$
 +
 
 +
However, on the command line it needs writing like this
 +
 
 +
^\s*\d+\s*logging::logterse plugin \(deny\): \` <HOST>\s*.*90\d.*msg denied before queued$
 +
 
 +
 
 +
===Show IPs banned by service===
 +
====Check the fail2ban log====
 +
Here is another quick script that shows you the most recent IPs banned in the logs. Note that they may have been unbanned but there is no check for this.
 +
mkdir /root/bin
 +
nano -w /root/bin/IP_list.sh
 +
 
 +
and copy and paste the below code into the file:
 +
 
 +
#!/bin/sh
 +
# Set CLI vars to something we can read
 +
TYPE=$1
 +
LOG=$2
 +
 +
# Set main grep string
 +
SEARCH="Ban ((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])"
 +
 +
# Add the search term
 +
SEARCH="\[$TYPE]\ $SEARCH"
 +
 +
# Now search the log
 +
grep -oE "\[$TYPE\] Ban ((1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9][0-9]?|2[0-4][0-9]|25[0-5])" $LOG
 +
 
 +
Save the file and make it executable:
 +
chmod 755 /root/bin/IP_list.sh
 +
 
 +
Usage :
 +
IP_list.sh [service] [log]
 +
 
 +
e.g.
 +
IP_list.sh qpsmtpd /var/log/fail2ban/daemon.log
 +
====Check the fail2ban banned IP for all active jails ====
 +
by [[User:Unnilennium|Unnilennium]] ([[User talk:Unnilennium|talk]])
 +
mkdir /root/bin
 +
vim /root/bin/sfail2ban
 +
 
 +
paste this in it:
 +
#!/bin/bash
 +
for SERVI in $(fail2ban-client status|grep 'Jail list'|cut -d':' -f2|sed 's/, / /g'| sed -e 's/^[ \t]*//')
 +
do
 +
fail2ban-client status $SERVI |grep -E 'IP list|Status for the jail'|sed 'N;s/\n/:/'|cut -d: -f2,4
 +
done
 +
then do
 +
chmod 755 /root/bin/sfail2ban
 +
 
 +
Usage :
 +
sfail2ban
 +
output:
 +
# sfail2ban
 +
ftp:
 +
imap:
 +
pam-generic:
 +
qpsmtpd:
 +
recidive: 141.98.80.15
 +
ssh:
 +
ssh-ddos:
 +
wordpress:
 +
 
 +
====Print a summary of the fail2ban db====
 +
mkdir -p /root/bin
 +
vi /root/bin/bansummary.sh
 +
 
 +
Paste this
 +
<nowiki>#!/bin/bash
 +
      echo -e \
 +
      "IP            \t"\
 +
      "BanTime            \t"\
 +
      "UnbanTime          \t"\
 +
      "Jail"
 +
     
 +
      for ban in $(db fail2ban show |awk -F\= ' $2=="ban" {print $1}');
 +
        do
 +
          IP=$(db fail2ban getprop $ban Host)
 +
          Bantime=$(date +"%F %T" -d @$(db fail2ban getprop $ban BanTimestamp))
 +
          UnBanTime=$(date +"%F %T" -d @$(db fail2ban getprop $ban UnbanTimestamp))
 +
          LastJail=$(zgrep -H "Ban $IP" $(find /var/log/fail2ban -type f -ctime -7) |tail -1 |awk '{print $6}')
 +
     
 +
          printf "%-15s" "$IP"
 +
          echo -e "\t$Bantime\t$UnBanTime\t$LastJail"
 +
        done
 +
      </nowiki>
 +
 
 +
save, then make executable
 +
chmod 755 /root/bin/bansummary.sh
 +
 
 +
Usage:
 +
bansummary.sh
 +
Output:
 +
<nowiki>IP            BanTime            UnbanTime          Jail
 +
      46.246.39.228  2017-09-09 18:45:00 2017-09-10 18:45:00 [http-scan]
 +
      124.239.180.102 2017-09-09 12:07:32 2017-09-10 12:07:32 [http-scan]
 +
      212.237.54.93  2017-09-09 19:27:32 2017-09-10 19:27:32 [http-scan]
 +
      </nowiki>
 +
 
 +
===WordPress===
 +
Fail2Ban works with WordPress but needs some extra configuration. Please review the WordPress page, https://wiki.contribs.org/Wordpress#Fail2Ban
 +
 
 +
== Bugs ==
 
Please raise bugs under the SME-Contribs section in [http://bugs.contribs.org/enter_bug.cgi bugzilla]
 
Please raise bugs under the SME-Contribs section in [http://bugs.contribs.org/enter_bug.cgi bugzilla]
 
and select the smeserver-fail2ban component or use {{BugzillaFileBug|product=SME%20Contribs|component=smeserver-fail2ban|title=this link}}.  
 
and select the smeserver-fail2ban component or use {{BugzillaFileBug|product=SME%20Contribs|component=smeserver-fail2ban|title=this link}}.  
    
Below is an overview of the current issues for this contrib:{{#bugzilla:columns=id,product,version,status,summary|sort=id|order=desc|component=smeserver-fail2ban|noresultsmessage=No open bugs found.}}  
 
Below is an overview of the current issues for this contrib:{{#bugzilla:columns=id,product,version,status,summary|sort=id|order=desc|component=smeserver-fail2ban|noresultsmessage=No open bugs found.}}  
 +
 +
===Changelog===
 +
Only released version in smecontrib are listed here.
 +
 +
{{#smechangelog: smeserver-fail2ban}}
 +
----
    
[[Category: Contrib]]
 
[[Category: Contrib]]
 
[[Category: Security]]
 
[[Category: Security]]
227

edits

Navigation menu