Difference between revisions of "Fail2ban"
m (→Service hardening: spelling) |
m (→Service hardening: avoid mentioning systemctl command. Also need to restart fail2ban.) |
||
Line 76: | Line 76: | ||
</nowiki>}} | </nowiki>}} | ||
− | Finally, [[Systemd#Using_units|reload systemd]] to apply the changes of the unit | + | Finally, [[Systemd#Using_units|reload systemd]] to apply the changes of the unit and [[restart]] {{ic|fail2ban.service}}. |
− | |||
− | |||
== Configuration == | == Configuration == |
Revision as of 16:38, 20 June 2018
ro:Fail2ban
Fail2ban scans log files (e.g. /var/log/httpd/error_log
) and bans IPs that show the malicious signs like too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured.
Contents
Installation
If you want Fail2ban to send an email when someone has been banned, you have to configure SSMTP (for example).
Usage
Enable/start fail2ban.service
.
fail2ban-client
The fail2ban-client allows monitoring jails (reload, restart, status, etc.), to view all available commands:
$ fail2ban-client
To view all enabled jails:
# fail2ban-client status
To check the status of a jail, e.g. for sshd:
# fail2ban-client status sshd
Status for the jail: sshd |- Filter | |- Currently failed: 1 | |- Total failed: 9 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 0.0.0.0
Service hardening
Currently, fail2ban must be run as root. Therefore, you may wish to consider hardening the process with systemd.
Create a drop-in configuration file for fail2ban.service
:
/etc/systemd/system/fail2ban.service.d/override.conf
[Service] PrivateDevices=yes PrivateTmp=yes ProtectHome=read-only ProtectSystem=strict NoNewPrivileges=yes ReadWritePaths=-/var/run/fail2ban ReadWritePaths=-/var/lib/fail2ban ReadWritePaths=-/var/log/fail2ban ReadWritePaths=-/var/spool/postfix/maildrop CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW
The CapabilityBoundingSet
parameters CAP_DAC_READ_SEARCH
will allow fail2ban full read access to every directory and file, CAP_NET_ADMIN
and CAP_NET_RAW
allow setting of firewall rules with iptables. See capabilities(7) for more info.
By using ProtectSystem=strict
the filesystem hierarchy will only be read-only, ReadWritePaths
allows fail2ban to have write access on required paths.
Create /etc/fail2ban/fail2ban.local
with the correct logtarget
path:
/etc/fail2ban/fail2ban.local
[Definition] logtarget = /var/log/fail2ban/fail2ban.log
Finally, reload systemd to apply the changes of the unit and restart fail2ban.service
.
Configuration
Due to the possibility of the /etc/fail2ban/jail.conf
file being overwritten or improved during a distribution update, it is recommended to Create /etc/fail2ban/jail.local
file. For example to change default ban time to 1 day:
/etc/fail2ban/jail.local
[DEFAULT] bantime = 1d
Or create separate name.local files under the /etc/fail2ban/jail.d
directory, e.g. /etc/fail2ban/jail.d/ssh-iptables.local
.
Restart fail2ban.service
to apply the configuration changes.
Enabling jails
Append enabled = true
to service one want to use, e.g. to enable the OpenSSH jail:
/etc/fail2ban/jail.local
[sshd] enabled = true
Firewall and services
Most firewalls and services should work out of the box. See /etc/fail2ban/action.d/
for examples, e.g. ufw.conf.
Tips and tricks
Custom SSH jail
Edit /etc/fail2ban/jail.d/sshd.local
, add this section and update the list of trusted IP addresses in ignoreip
.
If your firewall is iptables:
[sshd] enabled = true filter = sshd action = iptables backend = systemd maxretry = 5 findtime = 1d bantime = 2w ignoreip = 127.0.0.1/8
fail2ban has IPv6 support since version 0.10. Adapt your firewall accordingly, e.g. start and enable ip6tables.service
.
iptables
with shorewall
. You can also set BLACKLIST
to ALL
in /etc/shorewall/shorewall.conf
, otherwise the rule added to ban an IP address will affect only new connections.LogLevel VERBOSE
in /etc/ssh/sshd_config
to allow full fail2ban monitoring as otherwise password failures may not be logged correctly.