Fail2ban - Revision history

Tgurr: /* Enable the sshd jails and fail2ban reporting via email */

2018-05-20T12:35:45Z

Enable the sshd jails and fail2ban reporting via email

← Older revision		Revision as of 14:35, 20 May 2018
Line 44:		Line 44:

	[sshd]		[sshd]
	~~enabled = true~~

	~~[sshd-ddos]~~
	enabled = true		enabled = true
	</pre>		</pre>

Tgurr: /* syslog-ng configuration */

2016-04-22T18:53:03Z

syslog-ng configuration

← Older revision		Revision as of 20:53, 22 April 2016
Line 13:		Line 13:
	{{File\|/etc/syslog-ng/syslog-ng.conf\|		{{File\|/etc/syslog-ng/syslog-ng.conf\|
	<pre>		<pre>
			source src { system(); internal(); };

	destination authlog { file("/var/log/auth.log"); };		destination authlog { file("/var/log/auth.log"); };
	filter f_authpriv { facility(auth, authpriv); };		filter f_authpriv { facility(auth, authpriv); };
	~~filter f_failed~~ { ~~match~~(~~"failed"~~); };		log { source(src); filter(f_authpriv); destination(authlog); };
	~~filter f_denied { match~~(~~"denied"~~); };

	~~log~~ { ~~source~~(~~src); filter(f_authpriv); destination(authlog~~); };		destination messages { file("/var/log/messages"); };
	</pre>		</pre>
	}}		}}

Tgurr at 16:11, 19 March 2014

2014-03-19T16:11:04Z

← Older revision		Revision as of 18:11, 19 March 2014
Line 30:		Line 30:
	== Fail2ban configuration (0.9.x) ==		== Fail2ban configuration (0.9.x) ==

	Be sure to also enable the required Kernel options for [Kernel#Fail2ban_.28iptables.29\|iptables].		Be sure to also enable the required Kernel options for [[Kernel#Fail2ban_.28iptables.29\|iptables]].

	=== Enable the sshd jails and fail2ban reporting via email ===		=== Enable the sshd jails and fail2ban reporting via email ===

Tgurr at 16:09, 19 March 2014

2014-03-19T16:09:51Z

← Older revision		Revision as of 18:09, 19 March 2014
Line 29:		Line 29:

	== Fail2ban configuration (0.9.x) ==		== Fail2ban configuration (0.9.x) ==

			Be sure to also enable the required Kernel options for [Kernel#Fail2ban_.28iptables.29\|iptables].

	=== Enable the sshd jails and fail2ban reporting via email ===		=== Enable the sshd jails and fail2ban reporting via email ===

Tgurr at 16:08, 19 March 2014

2014-03-19T16:08:06Z

← Older revision		Revision as of 18:08, 19 March 2014
Line 65:		Line 65:
	</pre>		</pre>
	}}		}}


	{{Root\|/etc/init.d/fail2ban start}}		{{Root\|/etc/init.d/fail2ban start}}

	~~[[Categorie:Software]]~~

Tgurr at 16:07, 19 March 2014

2014-03-19T16:07:35Z

@@ Line 1: / Line 1: @@
-=== Installing ===
+== Installation ==
 {{Root|emerge fail2ban}}
@@ Line 9: / Line 9: @@
 {{Root|rc-update add fail2ban default}}
-{{Kernel|Kernel .config|
+== syslog-ng configuration ==
 {{File|/etc/syslog-ng/syslog-ng.conf|
@@ Line 49: / Line 28: @@
 {{Root|/etc/init.d/syslog-ng restart}}
-{{File|/etc/fail2ban.conf|
+== Fail2ban configuration (0.9.x) ==
 <pre>
-maxfailures = 3
+[DEFAULT]
-[MAIL]
+[sshd]
 enabled = true
-[SSH]
+[sshd-ddos]
 enabled = true
 </pre>
 }}
-{{File|/etc/ssh/sshd_config|
+=== Optional: Disable the new sqlite feature ===
-{{File|/etc/syslog-ng/syslog-ng.conf|
+{{File|/etc/fail2ban/fail2ban.local|
 <pre>
-destination authlog { file("/var/log/sshd.log"); };
+[Definition]
-filter f_authpriv { facility(auth, authpriv); };
+dbfile = None
 </pre>
 }}
-{{Root|touch /var/log/sshd.log}}
+=== Optional: Set the sshd log file path (default is auth.log) ===
-{{File|/etc/fail2ban/jail.conf|
+{{File|/etc/fail2ban/paths-overrides.local|
 <pre>
-[ssh-iptables]
+[DEFAULT]
+sshd_log = /var/log/sshd.log
 </pre>
 }}
@@ Line 135: / Line 69: @@
 [[Categorie:Software]]

Tgurr at 23:21, 29 January 2014

2014-01-29T23:21:33Z

← Older revision		Revision as of 01:21, 30 January 2014
Line 135:		Line 135:

	[[Categorie:Software]]		[[Categorie:Software]]
			bantime = 86400

Tgurr at 16:53, 13 January 2011

2011-01-13T16:53:52Z

← Older revision		Revision as of 18:53, 13 January 2011
Line 134:		Line 134:
	{{Root\|/etc/init.d/fail2ban start}}		{{Root\|/etc/init.d/fail2ban start}}

	[[~~Kategorie~~:Software]]		[[Categorie:Software]]

Tgurr at 16:53, 13 January 2011

2011-01-13T16:53:37Z

← Older revision		Revision as of 18:53, 13 January 2011
Line 134:		Line 134:
	{{Root\|/etc/init.d/fail2ban start}}		{{Root\|/etc/init.d/fail2ban start}}

	[[Kategorie:~~Programme~~]]		[[Kategorie:Software]]

Tgurr at 16:53, 13 January 2011

2011-01-13T16:53:09Z

← Older revision		Revision as of 18:53, 13 January 2011
Line 1:		Line 1:
	=== ~~fail2ban installieren~~ ===		=== Installing ===
	~~{{Box Code\|Zu installierende Pakete\|~~
	~~<pre>~~
	~~[ebuild N ] net-firewall/iptables-1.3.7 USE="ipv6 -extensions -imq -l7filter -static" 192 kB~~
	~~[ebuild N ] net-analyzer/fail2ban-0.7.8 54 kB~~
	~~</pre>~~
	}}

	{{~~Codeline~~\|# emerge fail2ban}}		{{Root\|emerge fail2ban}}

	{{~~Codeline~~\|# /etc/init.d/iptables save}}		{{Root\|/etc/init.d/iptables save}}

	{{~~Codeline~~\|# rc-update add iptables default}}		{{Root\|rc-update add iptables default}}

	{{~~Codeline~~\|# rc-update add fail2ban default}}		{{Root\|rc-update add fail2ban default}}

	{{Kernel\|Kernel .config\|		{{Kernel\|Kernel .config\|
Line 31:		Line 25:
	}}		}}

			{{File\|/etc/ssh/sshd_config\|
	{{~~Box~~ File\|/etc/ssh/sshd_config\|
	<pre>		<pre>
	SyslogFacility AUTH		SyslogFacility AUTH
Line 39:		Line 32:
	}}		}}

			{{File\|/etc/syslog-ng/syslog-ng.conf\|
	{{~~Box~~ File\|/etc/syslog-ng/syslog-ng.conf\|
	<pre>		<pre>
	destination authlog { file("/var/log/auth.log"); };		destination authlog { file("/var/log/auth.log"); };
Line 51:		Line 43:
	}}		}}

	{{~~Codeline~~\|# touch /var/log/auth.log}}		{{Root\|touch /var/log/auth.log}}

	{{~~Codeline~~\|# chmod 600 /var/log/auth.log}}		{{Root\|chmod 600 /var/log/auth.log}}

	{{~~Codeline~~\|# /etc/init.d/syslog-ng restart}}		{{Root\|/etc/init.d/syslog-ng restart}}

	{{~~Box~~ File\|/etc/fail2ban.conf\|		{{File\|/etc/fail2ban.conf\|
	<pre>		<pre>
	maxfailures = 3		maxfailures = 3
Line 76:		Line 68:

	=== fail2ban installieren ===		=== fail2ban installieren ===
	~~{{Box Code\|Zu installierende Pakete\|~~
	~~<pre>~~
	~~[ebuild N ] net-firewall/iptables-1.3.6-r1 USE="ipv6 -extensions -imq -l7filter -static" 181 kB~~
	~~[ebuild N ] net-analyzer/fail2ban-0.7.2 28 kB~~
	~~</pre>~~
	}}

	{{~~Codeline~~\|# emerge fail2ban}}		{{Root\|emerge fail2ban}}

	{{~~Codeline~~\|# /etc/init.d/iptables save}}		{{Root\|/etc/init.d/iptables save}}

	{{~~Codeline~~\|# rc-update add iptables default}}		{{Root\|rc-update add iptables default}}

	{{~~Codeline~~\|# rc-update add fail2ban default}}		{{Root\|rc-update add fail2ban default}}

	{{~~Box Code~~\|Kernel .config\|		{{Kernel\|Kernel .config\|
	<pre>		<pre>
	Networking		Networking
Line 107:		Line 93:
	}}		}}

			{{File\|/etc/ssh/sshd_config\|
	{{~~Box~~ File\|/etc/ssh/sshd_config\|
	<pre>		<pre>
	SyslogFacility AUTH		SyslogFacility AUTH
Line 115:		Line 100:
	}}		}}

			{{File\|/etc/syslog-ng/syslog-ng.conf\|
	{{~~Box~~ File\|/etc/syslog-ng/syslog-ng.conf\|
	<pre>		<pre>
	destination authlog { file("/var/log/sshd.log"); };		destination authlog { file("/var/log/sshd.log"); };
Line 127:		Line 111:
	}}		}}

	{{~~Codeline~~\|# touch ~~/var/log/sshd.log}}~~		{{Root\|touch /var/log/sshd.log}}

	~~{{Codeline\|# chmod 600~~ /var/log/sshd.log}}

	{{~~Codeline~~\|# /~~etc~~/~~init~~.~~d/syslog-ng restart~~}}		{{Root\|chmod 600 /var/log/sshd.log}}

			{{Root\|/etc/init.d/syslog-ng restart}}

	{{~~Box~~ File\|/etc/fail2ban/jail.conf\|		{{File\|/etc/fail2ban/jail.conf\|
	<pre>		<pre>
	[ssh-iptables]		[ssh-iptables]
Line 149:		Line 132:
	}}		}}

	{{~~Codeline~~\|# /etc/init.d/fail2ban start}}		{{Root\|/etc/init.d/fail2ban start}}

	[[Kategorie:Programme]]		[[Kategorie:Programme]]