Fail2ban: Difference between revisions

From Q
Jump to navigation Jump to search
← Older edit
Tgurr (talk | contribs)
1,619 edits
No edit summary
Tgurr (talk | contribs)
1,619 edits
 
(5 intermediate revisions by the same user not shown)
Line 1: Line 1:
=== Installing ===
== Installation ==


{{Root|emerge fail2ban}}
{{Root|emerge fail2ban}}
Line 9: Line 9:
{{Root|rc-update add fail2ban default}}
{{Root|rc-update add fail2ban default}}


{{Kernel|Kernel .config|
== syslog-ng configuration ==
<pre>
Networking
Networking options --->
[*] Network packet filtering (replaces ipchains)  --->
  Core Netfilter Configuration  --->
  <*> Netfilter Xtables support (required for ip_tables)
  IP: Netfilter Configuration  --->
  <*> IP tables support (required for filtering/masq/NAT)


  optional noch:
{{File|/etc/syslog-ng/syslog-ng.conf|
  IPv6: Netfilter Configuration (EXPERIMENTAL)  --->
  <*> IP6 tables support (required for filtering/masq/NAT)
</pre>
}}
 
{{File|/etc/ssh/sshd_config|
<pre>
<pre>
SyslogFacility AUTH
source src { system(); internal(); };
LogLevel INFO
</pre>
}}


{{File|/etc/syslog-ng/syslog-ng.conf|
<pre>
destination authlog { file("/var/log/auth.log"); };
destination authlog { file("/var/log/auth.log"); };
filter f_authpriv { facility(auth, authpriv); };
filter f_authpriv { facility(auth, authpriv); };
filter f_failed { match("failed"); };
log { source(src); filter(f_authpriv); destination(authlog); };
filter f_denied { match("denied"); };


log { source(src); filter(f_authpriv); destination(authlog); };
destination messages { file("/var/log/messages"); };
</pre>
</pre>
}}
}}
Line 49: Line 29:
{{Root|/etc/init.d/syslog-ng restart}}
{{Root|/etc/init.d/syslog-ng restart}}


{{File|/etc/fail2ban.conf|
== Fail2ban configuration (0.9.x) ==
 
Be sure to also enable the required Kernel options for [[Kernel#Fail2ban_.28iptables.29|iptables]].
 
=== Enable the sshd jails and fail2ban reporting via email ===
{{File|/etc/fail2ban/jail.local|
<pre>
<pre>
maxfailures = 3
[DEFAULT]
 
bantime = 86400
[MAIL]
maxretry = 3
enabled = true
destemail = yourmail@domain.local
host = mailrelay/localhost
sender = fail2ban@hostname
to = logs@domain.de
action = %(action_mwl)s


[SSH]
[sshd]
enabled = true
enabled = true
logfile = /var/log/auth.log
</pre>
</pre>
}}
}}


=== Optional: Disable the new sqlite feature ===


 
{{File|/etc/fail2ban/fail2ban.local|
=== fail2ban installieren ===
 
{{Root|emerge fail2ban}}
 
{{Root|/etc/init.d/iptables save}}
 
{{Root|rc-update add iptables default}}
 
{{Root|rc-update add fail2ban default}}
 
{{Kernel|Kernel .config|
<pre>
<pre>
Networking
[Definition]
Networking options --->
dbfile = None
[*] Network packet filtering (replaces ipchains)  --->
  Core Netfilter Configuration  --->
  <*> Netfilter Xtables support (required for ip_tables)
  IP: Netfilter Configuration  --->
  <*> IP tables support (required for filtering/masq/NAT)
 
  optional noch:
  IPv6: Netfilter Configuration (EXPERIMENTAL)  --->
  <*> IP6 tables support (required for filtering/masq/NAT)
</pre>
</pre>
}}
}}


{{File|/etc/ssh/sshd_config|
=== Optional: Set the sshd log file path (default is auth.log) ===
<pre>
SyslogFacility AUTH
LogLevel INFO
</pre>
}}


{{File|/etc/syslog-ng/syslog-ng.conf|
{{File|/etc/fail2ban/paths-overrides.local|
<pre>
<pre>
destination authlog { file("/var/log/sshd.log"); };
[DEFAULT]
filter f_authpriv { facility(auth, authpriv); };
sshd_log = /var/log/sshd.log
filter f_failed { match("failed"); };
filter f_denied { match("denied"); };
 
log { source(src); filter(f_authpriv); destination(authlog); };
</pre>
</pre>
}}
}}


{{Root|touch /var/log/sshd.log}}
{{Root|chmod 600 /var/log/sshd.log}}
{{Root|/etc/init.d/syslog-ng restart}}
{{File|/etc/fail2ban/jail.conf|
<pre>
[ssh-iptables]
enabled  = true
filter  = sshd
action  = iptables[name=SSH, port=ssh, protocol=tcp]
          mail-whois[name=SSH, dest=yourmail@mail.com]
logpath  = /var/log/sshd.log
maxretry = 3
bantime  = 600
</pre>
}}


{{Root|/etc/init.d/fail2ban start}}
{{Root|/etc/init.d/fail2ban start}}
[[Categorie:Software]]
bantime  = 86400

Latest revision as of 13:35, 20 May 2018

Installation

# emerge fail2ban
# /etc/init.d/iptables save
# rc-update add iptables default
# rc-update add fail2ban default

syslog-ng configuration

File: /etc/syslog-ng/syslog-ng.conf
source src { system(); internal(); };

destination authlog { file("/var/log/auth.log"); };
filter f_authpriv { facility(auth, authpriv); };
log { source(src); filter(f_authpriv); destination(authlog); };

destination messages { file("/var/log/messages"); };
# touch /var/log/auth.log
# chmod 600 /var/log/auth.log
# /etc/init.d/syslog-ng restart

Fail2ban configuration (0.9.x)

Be sure to also enable the required Kernel options for iptables.

Enable the sshd jails and fail2ban reporting via email

File: /etc/fail2ban/jail.local
[DEFAULT]
bantime = 86400
maxretry = 3
destemail = yourmail@domain.local
sender = fail2ban@hostname
action = %(action_mwl)s

[sshd]
enabled = true

Optional: Disable the new sqlite feature

File: /etc/fail2ban/fail2ban.local
[Definition]
dbfile = None

Optional: Set the sshd log file path (default is auth.log)

File: /etc/fail2ban/paths-overrides.local
[DEFAULT]
sshd_log = /var/log/sshd.log


# /etc/init.d/fail2ban start
Retrieved from "https://q-old.deltaquadrant.org/index.php?title=Fail2ban&oldid=4198"