Fail2ban: Difference between revisions

From Q
Jump to navigation Jump to search
Tgurr (talk | contribs)
1,619 edits
No edit summary
 
Tgurr (talk | contribs)
1,619 edits
 
(13 intermediate revisions by the same user not shown)
Line 1: Line 1:
=== fail2ban installieren ===
== Installation ==
{{Box Code|Zu installierende Pakete|
 
<pre>
{{Root|emerge fail2ban}}
[ebuild  N    ] net-firewall/iptables-1.3.5-r4  USE="ipv6 -extensions -imq -l7filter -static" 187 kB
[ebuild  N    ] net-analyzer/fail2ban-0.6.1-r1  23 kB
</pre>
}}


{{Codeline|# emerge fail2ban}}
{{Root|/etc/init.d/iptables save}}


{{Codeline|# /etc/init.d/iptables save}}
{{Root|rc-update add iptables default}}


{{Codeline|# rc-update add iptables default}}
{{Root|rc-update add fail2ban default}}


{{Codeline|# rc-update add fail2ban default}}
== syslog-ng configuration ==


{{Box Code|Kernel .config|
{{File|/etc/syslog-ng/syslog-ng.conf|
<pre>
<pre>
Networking
source src { system(); internal(); };
Networking options --->
[*] Network packet filtering (replaces ipchains) --->
  Core Netfilter Configuration  --->
  <*> Netfilter Xtables support (required for ip_tables)
  IP: Netfilter Configuration  --->
  <*> IP tables support (required for filtering/masq/NAT)


  optional noch:
destination authlog { file("/var/log/auth.log"); };
  IPv6: Netfilter Configuration (EXPERIMENTAL) --->
filter f_authpriv { facility(auth, authpriv); };
  <*> IP6 tables support (required for filtering/masq/NAT)
log { source(src); filter(f_authpriv); destination(authlog); };
 
destination messages { file("/var/log/messages"); };
</pre>
</pre>
}}
}}


{{Root|touch /var/log/auth.log}}
{{Root|chmod 600 /var/log/auth.log}}
{{Root|/etc/init.d/syslog-ng restart}}
== Fail2ban configuration (0.9.x) ==


{{Box File|/etc/ssh/sshd_config|
Be sure to also enable the required Kernel options for [[Kernel#Fail2ban_.28iptables.29|iptables]].
 
=== Enable the sshd jails and fail2ban reporting via email ===
{{File|/etc/fail2ban/jail.local|
<pre>
<pre>
SyslogFacility AUTH
[DEFAULT]
LogLevel INFO
bantime = 86400
maxretry = 3
destemail = yourmail@domain.local
sender = fail2ban@hostname
action = %(action_mwl)s
 
[sshd]
enabled = true
</pre>
</pre>
}}
}}


=== Optional: Disable the new sqlite feature ===


{{Box File|/etc/syslog-ng/syslog-ng.conf|
{{File|/etc/fail2ban/fail2ban.local|
<pre>
<pre>
destination authlog { file("/var/log/auth.log"); };
[Definition]
filter f_authpriv { facility(auth, authpriv); };
dbfile = None
filter f_failed { match("failed"); };
filter f_denied { match("denied"); };
 
log { source(src); filter(f_authpriv); destination(authlog); };
</pre>
</pre>
}}
}}


{{Codeline|# touch /var/log/auth.log}}
=== Optional: Set the sshd log file path (default is auth.log) ===


{{Codeline|# chmod 600 /var/log/auth.log}}
{{File|/etc/fail2ban/paths-overrides.local|
 
{{Codeline|# /etc/init.d/syslog-ng restart}}
 
{{Box File|/etc/fail2ban.conf|
<pre>
<pre>
maxfailures = 3
[DEFAULT]
 
sshd_log = /var/log/sshd.log
[MAIL]
enabled = true
host = mailrelay/localhost
to = logs@domain.de
 
[SSH]
enabled = true
logfile = /var/log/auth.log
 
</pre>
</pre>
}}
}}


[[Kategorie:Programme]]
 
{{Root|/etc/init.d/fail2ban start}}

Latest revision as of 13:35, 20 May 2018

Installation

# emerge fail2ban
# /etc/init.d/iptables save
# rc-update add iptables default
# rc-update add fail2ban default

syslog-ng configuration

File: /etc/syslog-ng/syslog-ng.conf
source src { system(); internal(); };

destination authlog { file("/var/log/auth.log"); };
filter f_authpriv { facility(auth, authpriv); };
log { source(src); filter(f_authpriv); destination(authlog); };

destination messages { file("/var/log/messages"); };
# touch /var/log/auth.log
# chmod 600 /var/log/auth.log
# /etc/init.d/syslog-ng restart

Fail2ban configuration (0.9.x)

Be sure to also enable the required Kernel options for iptables.

Enable the sshd jails and fail2ban reporting via email

File: /etc/fail2ban/jail.local
[DEFAULT]
bantime = 86400
maxretry = 3
destemail = yourmail@domain.local
sender = fail2ban@hostname
action = %(action_mwl)s

[sshd]
enabled = true

Optional: Disable the new sqlite feature

File: /etc/fail2ban/fail2ban.local
[Definition]
dbfile = None

Optional: Set the sshd log file path (default is auth.log)

File: /etc/fail2ban/paths-overrides.local
[DEFAULT]
sshd_log = /var/log/sshd.log


# /etc/init.d/fail2ban start
Retrieved from "https://q-old.deltaquadrant.org/index.php?title=Fail2ban&oldid=4198"