Changes

From SME Server
Jump to navigationJump to search

Fail2ban (view source)

Revision as of 17:04, 5 April 2020

2,127 bytes added ,  17:04, 5 April 2020
→‎Installation sme9
Line 5: Line 5:     
== Maintainer ==
 
== Maintainer ==
−
[[User:VIP-ire|Daniel B.]]<br/>
+
[[User:VIP-ire|Daniel B.]]<br />
 
[http://www.firewall-services.com Firewall Services]<br>
 
[http://www.firewall-services.com Firewall Services]<br>
 
mailto:daniel@firewall-services.com
 
mailto:daniel@firewall-services.com
   −
Please discuss, provide feedback and share epxeriences on the forums [http://forums.contribs.org/index.php/topic,51127.0.html '''here''']
+
Please discuss, provide feedback and share experiences on the forums [http://forums.contribs.org/index.php/topic,51127.0.html '''here''']
    
== Description ==
 
== Description ==
Line 20: Line 20:     
== Requirements ==
 
== Requirements ==
−
This contrib has been developped and tested on SME Server 8 and later. It probably won't work on SME 7.
+
This contrib has been developed and tested on SME Server 8 and later.
       
{{Note box|The SME feature [http://wiki.contribs.org/AutoBlock AutoBlock SSH] should be disabled to ensure that fail2ban controls SSH traffic and not the SME build-in firewall.}}
 
{{Note box|The SME feature [http://wiki.contribs.org/AutoBlock AutoBlock SSH] should be disabled to ensure that fail2ban controls SSH traffic and not the SME build-in firewall.}}
   −
== Installation sme8 and sme9 ==
+
==Koozali SME v9==
−
Configure Firewall-Services's repository:
+
{{#smeversion: smeserver-fail2ban}}
−
 
  −
db yum_repositories set fws repository \
  −
BaseURL http://repo.firewall-services.com/centos/\$releasever \
  −
EnableGroups no GPGCheck yes \
  −
Name "Firewall Services" \
  −
GPGKey http://repo.firewall-services.com/RPM-GPG-KEY \
  −
Visible yes status disabled
  −
 
      +
== Installation sme9 ==
 
Configure EPEL's repository:
 
Configure EPEL's repository:
−
For SME 8.x,
  −
  −
/sbin/e-smith/db yum_repositories set epel repository \
  −
Name 'Epel - EL5' \
  −
BaseUrl 'http://download.fedoraproject.org/pub/epel/5/$basearch' \
  −
MirrorList 'http://mirrors.fedoraproject.org/mirrorlist?repo=epel-5&arch=$basearch' \
  −
EnableGroups no \
  −
GPGCheck yes \
  −
GPGKey http://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL \
  −
Visible no \
  −
status disabled
      
<onlyinclude>{{#ifeq:{{{transcludesection|epel9}}}|epel9|
 
<onlyinclude>{{#ifeq:{{{transcludesection|epel9}}}|epel9|
Line 66: Line 48:  
*install the rpms
 
*install the rpms
   −
  yum --enablerepo=fws --enablerepo=epel install smeserver-fail2ban
+
  yum --enablerepo=smecontribs --enablerepo=epel install smeserver-fail2ban
      Line 83: Line 65:  
{{warning box| Failing to run either of these command will completely lock network access next time iptables rules are reloaded}}
 
{{warning box| Failing to run either of these command will completely lock network access next time iptables rules are reloaded}}
 
{{warning box| The masq service must be enabled for fail2Ban to work correctly. If you disable it, Fail2ban won't ban anything}}
 
{{warning box| The masq service must be enabled for fail2Ban to work correctly. If you disable it, Fail2ban won't ban anything}}
 +
 +
== Disable SME Feature AutoBlock SME 9 or greater ==
 +
It's been noted that one of the features of fail2ban overlaps the built-in ssh AutoBlock feature of SME (https://wiki.contribs.org/AutoBlock).
 +
It is possible to disable the AutoBlock feature using the following optional steps.
 +
 +
1. View what your current settings are for the built in SME AutoBlock feature by entering the following at the cli.
 +
# config show sshd
 +
2. If AutoBlock is disabled no action is required. If AutoBlock is enabled, set it to disabled with the following commands:
 +
# config setprop sshd AutoBlock disabled
 +
# signal-event remoteaccess-update
    
==DB command==
 
==DB command==
−
there is no panel yet you can manage the contrib by the db configuration, it is quite simple
+
While there is a panel in the server-manager, you can also manage the contrib by the db configuration, it is quite simple
    
  # config show fail2ban  
 
  # config show fail2ban  
Line 94: Line 86:  
Available options are below:
 
Available options are below:
   −
* '''IgnoreIP''': a comma separated list of IP or CIDR networks which will never be blocked by fail2ban. Exemple: 12.15.22.4,17.20.0.0/16. All your local networks and networks allowed to access the server-manager are already automatically whitelisted
+
* '''IgnoreIP''': a comma separated list of IP or CIDR networks which will never be blocked by fail2ban. Example: 12.15.22.4,17.20.0.0/16. All your local networks and networks allowed to access the server-manager are already automatically whitelisted
 
* '''FilterLocalNetworks''' can be enabled or disabled (default is disabled). If set to enabled, local networks won't be whitelisted, and fail2ban can also ban hosts from the internal networks. Note that networks allowed to access the server-manager are not affected (they will never be blocked)
 
* '''FilterLocalNetworks''' can be enabled or disabled (default is disabled). If set to enabled, local networks won't be whitelisted, and fail2ban can also ban hosts from the internal networks. Note that networks allowed to access the server-manager are not affected (they will never be blocked)
−
* '''BanTime''': Duration (in seconds) of a ban. Default to 1800
+
* '''BanTime''': Duration (in seconds) of a ban. Default to 1800 (about 30 minutes)
−
* '''FindTime''': The window fail2ban will check, in seconds. Default is 900. So, this mean fail2ban will only check for the number of failed login attempts in the last 15 minuts
+
* '''FindTime''': The time window fail2ban will check, in seconds. Default is 900. So, this means fail2ban will only check for the number of failed login attempts in the last 15 minutes
 
* '''MaxRetry''': Number of failed attempts in the last '''FindTime''' seconds to trigger a ban. Default is 3
 
* '''MaxRetry''': Number of failed attempts in the last '''FindTime''' seconds to trigger a ban. Default is 3
−
* '''Mail''': can be enabled or disabled (default is enabled). If enabled, each ban will be notified by mail
+
* '''Mail''': can be enabled or disabled (default is enabled). If enabled, each ban will notify the admin by email
 
* '''MailRecipient''': if '''Mail''' is enabled, the email address which should receive ban notifications. Default is root (the admin account will receive)
 
* '''MailRecipient''': if '''Mail''' is enabled, the email address which should receive ban notifications. Default is root (the admin account will receive)
   Line 154: Line 146:     
  nano /root/checklist_ban
 
  nano /root/checklist_ban
−
   
  #!/bin/bash
 
  #!/bin/bash
 
  #lancer le script en sudo  
 
  #lancer le script en sudo  
−
  JAILS=$(fail2ban-client status | grep " Jail list:" | sed 's/`- Jail list:\t\t//g' | sed 's/,//g')
+
  JAILS=$(fail2ban-client status | grep " Jail list:" | sed 's/`- Jail list://g' | sed 's/,//g')
 
  for j in $JAILS
 
  for j in $JAILS
 
  do
 
  do
 
  echo "$j $(fail2ban-client status $j | grep " Currently banned:" | sed 's/  |- Currently banned:\t//g')"
 
  echo "$j $(fail2ban-client status $j | grep " Currently banned:" | sed 's/  |- Currently banned:\t//g')"
 
  done
 
  done
 +
    
  chmod 700 /root/checklist_ban
 
  chmod 700 /root/checklist_ban
Line 167: Line 159:  
to launch the script, do the following command:
 
to launch the script, do the following command:
 
  /root/checklist_ban
 
  /root/checklist_ban
−
      
=== Unban an IP ===
 
=== Unban an IP ===
Line 293: Line 284:  
== Uninstall ==
 
== Uninstall ==
 
  yum remove smeserver-fail2ban fail2ban
 
  yum remove smeserver-fail2ban fail2ban
−
  −
  −
== Bugs ==
  −
Please raise bugs under the SME-Contribs section in [http://bugs.contribs.org/enter_bug.cgi bugzilla]
  −
and select the smeserver-fail2ban component or use {{BugzillaFileBug|product=SME%20Contribs|component=smeserver-fail2ban|title=this link}}.
  −
  −
Below is an overview of the current issues for this contrib:{{#bugzilla:columns=id,product,version,status,summary|sort=id|order=desc|component=smeserver-fail2ban|noresultsmessage=No open bugs found.}}
        Line 324: Line 308:     
===Show IPs banned by service===
 
===Show IPs banned by service===
−
 
+
====Check the fail2ban log====
 
Here is another quick script that shows you the most recent IPs banned in the logs. Note that they may have been unbanned but there is no check for this.
 
Here is another quick script that shows you the most recent IPs banned in the logs. Note that they may have been unbanned but there is no check for this.
−
 
+
mkdir /root/bin
−
  nano -w /root/IP_list.sh
+
  nano -w /root/bin/IP_list.sh
    
and copy and paste the below code into the file:
 
and copy and paste the below code into the file:
Line 346: Line 330:     
Save the file and make it executable:
 
Save the file and make it executable:
−
  chmod 755 /root/IP_list.sh
+
  chmod 755 /root/bin/IP_list.sh
    
Usage :  
 
Usage :  
−
  /root/IP_List.sh [service] [log]
+
  IP_list.sh [service] [log]
    
e.g.
 
e.g.
−
  /root/IP_List.sh qpsmtpd /var/log/fail2ban/daemon.log
+
  IP_list.sh qpsmtpd /var/log/fail2ban/daemon.log
 +
====Check the fail2ban banned IP for all active jails ====
 +
by [[User:Unnilennium|Unnilennium]] ([[User talk:Unnilennium|talk]])
 +
mkdir /root/bin
 +
vim /root/bin/sfail2ban
 +
 
 +
paste this in it:
 +
#!/bin/bash
 +
for SERVI in $(fail2ban-client status|grep 'Jail list'|cut -d':' -f2|sed 's/, / /g'| sed -e 's/^[ \t]*//')
 +
do
 +
fail2ban-client status $SERVI |grep -E 'IP list|Status for the jail'|sed 'N;s/\n/:/'|cut -d: -f2,4
 +
done
 +
then do
 +
chmod 755 /root/bin/sfail2ban
 +
 
 +
Usage :
 +
sfail2ban
 +
output:
 +
# sfail2ban
 +
ftp:
 +
imap:
 +
pam-generic:
 +
qpsmtpd:
 +
recidive: 141.98.80.15
 +
ssh:
 +
ssh-ddos:
 +
wordpress:
 +
 
 +
====Print a summary of the fail2ban db====
 +
mkdir -p /root/bin
 +
vi /root/bin/bansummary.sh
 +
 
 +
Paste this
 +
<nowiki>#!/bin/bash
 +
      echo -e \
 +
      "IP            \t"\
 +
      "BanTime            \t"\
 +
      "UnbanTime          \t"\
 +
      "Jail"
 +
     
 +
      for ban in $(db fail2ban show |awk -F\= ' $2=="ban" {print $1}');
 +
        do
 +
          IP=$(db fail2ban getprop $ban Host)
 +
          Bantime=$(date +"%F %T" -d @$(db fail2ban getprop $ban BanTimestamp))
 +
          UnBanTime=$(date +"%F %T" -d @$(db fail2ban getprop $ban UnbanTimestamp))
 +
          LastJail=$(zgrep -H "Ban $IP" $(find /var/log/fail2ban -type f -ctime -7) |tail -1 |awk '{print $6}')
 +
     
 +
          printf "%-15s" "$IP"
 +
          echo -e "\t$Bantime\t$UnBanTime\t$LastJail"
 +
        done
 +
      </nowiki>
 +
 
 +
save, then make executable
 +
chmod 755 /root/bin/bansummary.sh
 +
 
 +
Usage:
 +
bansummary.sh
 +
Output:
 +
<nowiki>IP            BanTime            UnbanTime          Jail
 +
      46.246.39.228  2017-09-09 18:45:00 2017-09-10 18:45:00 [http-scan]
 +
      124.239.180.102 2017-09-09 12:07:32 2017-09-10 12:07:32 [http-scan]
 +
      212.237.54.93  2017-09-09 19:27:32 2017-09-10 19:27:32 [http-scan]
 +
      </nowiki>
 +
 
 +
===WordPress===
 +
Fail2Ban works with WordPress but needs some extra configuration. Please review the WordPress page, https://wiki.contribs.org/Wordpress#Fail2Ban
 +
 
 +
== Bugs ==
 +
Please raise bugs under the SME-Contribs section in [http://bugs.contribs.org/enter_bug.cgi bugzilla]
 +
and select the smeserver-fail2ban component or use {{BugzillaFileBug|product=SME%20Contribs|component=smeserver-fail2ban|title=this link}}.
 +
 
 +
Below is an overview of the current issues for this contrib:{{#bugzilla:columns=id,product,version,status,summary|sort=id|order=desc|component=smeserver-fail2ban|noresultsmessage=No open bugs found.}}
 +
 
 +
===Changelog===
 +
Only released version in smecontrib are listed here.
    +
{{#smechangelog: smeserver-fail2ban}}
 +
----
    
[[Category: Contrib]]
 
[[Category: Contrib]]
 
[[Category: Security]]
 
[[Category: Security]]
Kruhm
227

edits

Retrieved from "https://wiki.koozali.org/Special:MobileDiff/29797...38667"

Navigation menu