View source for SAC:fail2ban


Fail2ban blocks attacks on ssh, postfix, proftp, apache etc.

= General management =

Installation:
  apt-get install fail2ban
  update-rc.d fail2ban defaults
  /etc/init.d/fail2ban start

Check current state:
  fail2ban-client status
  Status
  |- Number of jail:      1
  `- Jail list:           ssh

= Configuration =

Configuration is under /etc/fail2ban. On some systems it is kept in a git repository.

A filter is called "jail". To add more jails:
  vim /etc/fail2ban/jail.conf
  # activate several filters: 
  [ssh-ddos]
  --> set "true"
 
  [proftpd]
  --> set "true"
 
  [postfix]
  --> set "true"
 
  [apache]
  --> set "true"

'''Note: Add own new jails to jail.local!'''

Now restart the daemon (resets blacklist in iptables):
  /etc/init.d/fail2ban restart
Or (same effect):
  fail2ban-client reload

Verify that it runs
  iptables -nvL

See in action (Debian):
  tail -f /var/log/fail2ban.log

== OSGeo jails ==

It is recommended to put OSGeo jail in files with 'osgeo' prefix under the '/etc/fail2ban/filter.d/' directory,
and reference them from '/etc/fail2ban/jail.local'

== Example jails ==

'''Extra''': block "w00tw00t" scans:
<pre>
# generate configuration file (not included in fail2ban package):

echo "# Get rid of w00tw00t scans
[Definition]
# Option: failregex
# Notes.: regex to match the w00tw00t scan messages in the logfile.
# Values: TEXT
##FAILS - failregex = ^.*\[client \].*w00tw00t\.at\.ISC\.SANS\.DFind.*
# from http://kevin.deldycke.com/2011/06/configuring-fail2ban-debian-squeeze/ - used error.log
#failregex = ^.*\[client <HOST>\].*w00tw00t\.at\.ISC\.SANS\.*
failregex = ^.*\[client <HOST>\].*w00tw00t\.at\.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
ignoreregex = " > /etc/fail2ban/filter.d/apache-w00tw00t.conf
</pre>

Now edit the configuration of fail2ban and register this new "w00tw00t" jail:
  vim /etc/fail2ban/jail.local

add in the file (perhaps close to the existing apache definitions):
<pre>
[apache-w00tw00t]
enabled = true
filter = apache-w00tw00t
action = iptables-allports
logpath = /var/log/apache*/*error.log
maxretry = 1
</pre>

Test the regex:
 # Debian
 fail2ban-regex /var/log/apache2/error.log /etc/fail2ban/filter.d/apache-w00tw00t.conf

Restart the daemon (resets blacklist in iptables)
 /etc/init.d/fail2ban restart

See in action
 tail -f /var/log/fail2ban.log

Create similar jail for other bots just changing the failregex:

 For:
 [Sat Feb 01 12:58:27 2014] [error] [client yy.xx.154.80] script not found or unable to stat: /var/www/cgi-bin/php
 [Sat Feb 01 12:58:28 2014] [error] [client yy.xx.154.80] script not found or unable to stat: /var/www/cgi-bin/php5
 [Sat Feb 01 12:58:28 2014] [error] [client yy.xx.154.80] script not found or unable to stat: /var/www/cgi-bin/php-cgi
 [Sat Feb 01 12:58:30 2014] [error] [client yy.xx.154.80] script not found or unable to stat: /var/www/cgi-bin/php.cgi
 [Sat Feb 01 12:58:36 2014] [error] [client yy.xx.154.80] script not found or unable to stat: /var/www/cgi-bin/php4
 Regex:
 failregex = ^.*\[client <HOST>\].*\\/var\\/www\\/cgi-bin\\/php*

 For:
 [Mon Feb 24 12:11:19 2014] [error] [client yy.xx.182.60] File does not exist: /var/www/phpTest
 Regex:
 failregex = ^.*\[client <HOST>\].*\\/var\\/www\\/phpTest* 

 For:
 [Mon Feb 24 12:11:19 2014] [error] [client yy.xx.182.60] File does not exist: /var/www/phpMyAdmin
 Regex:
 failregex = ^.*\[client <HOST>\].*\\/var\\/www\\/phpMyAdmin*

 For:
 [Mon Feb 24 12:11:20 2014] [error] [client yy.xx.182.60] File does not exist: /var/www/pma
 Regex:
 failregex = ^.*\[client <HOST>\].*\\/var\\/www\\/pma* 

 For:
 [Mon Feb 24 12:11:21 2014] [error] [client yy.xx.182.60] File does not exist: /var/www/myadmin
 Regex:
 failregex = ^.*\[client <HOST>\].*\\/var\\/www\\/myadmin*

 For:
 [Sun Mar 02 10:44:49 2014] [error] [client yy.xx.8.82] File does not exist: /var/www/mysqladmin
 Regex:
 failregex = ^.*\[client <HOST>\].*\\/var\\/www\\/mysqladmin*

'''Protect wordpress:'''

Add in:
 /etc/fail2ban/jail.local
<pre>
# http://www.galiator.de/wordpress/fail2ban-fuer-wordpress
## note: whitelist own server IP
### /etc/fail2ban/jail.conf
### [DEFAULT]
### "ignoreip" can be an IP address, a CIDR mask or a DNS host
### ignoreip = 127.0.0.1/8 88.198.75.114
[apache-wp-login]
enabled  = true
port     = http,https
# action   = iptables[name=wplogin, port=http, protocol=tcp]
filter   = apache-wp-login
logpath  = /var/log/apache2/other_vhosts_access.log
maxretry = 10
findtime = 3600   # within of 1h in seconds
# bantime  = 43200  # block for 12h in seconds instead of 600s
</pre>

and

 /etc/fail2ban/filter.d/apache-wp-login.conf
<pre>
[Definition]
# Option:  failregex
# Notes.:  Regexp to catch Apache dictionary attacks on Wordpress wp-login
# Values:  TEXT
#
# http://www.galiator.de/wordpress/fail2ban-fuer-wordpress
failregex = <HOST>.*] \"POST \/wp-login.php
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
ignoreregex =
</pre>

Test the regex:
 # Debian
 fail2ban-regex /var/log/apache2/error.log /etc/fail2ban/filter.d/apache-wp-login.conf


Restart the daemon (resets blacklist in iptables)
 /etc/init.d/fail2ban restart

See in action
 tail -f /var/log/fail2ban.log

'''Shellshock - bash hell''':

/etc/fail2ban/jail.local
<pre>
# MN 2014
[shellshock]
enabled = true
filter = shellshock
action = iptables-allports
logpath = /var/log/apache*/*error?log
maxretry = 1
</pre>

/etc/fail2ban/filter.d/shellshock.conf
<pre>
# attempt to get rid of bash shellshock probing
[Definition]
failregex = ^.*\[client <HOST>\].*\(\s*\)\s*\{[^"]*\}\s*\;[^"]+
ignoreregex =
</pre>

== Whitelisting IPs ==

Especially for SAC admins it might be needed to whitelist their IPs in order to not get blacklisted while modifying trac pages:

  # add IPs here:
  /etc/fail2ban/jail.local
  ...
  ignoreip = ...


[[Category: Infrastructure]]