Fail2ban: Difference between revisions

From Q
Jump to navigation Jump to search
← Older editNewer edit →
Tgurr (talk | contribs)
1,619 edits
No edit summary
Tgurr (talk | contribs)
1,619 edits
No edit summary
Line 1: Line 1:
=== Installing ===
== Installation ==


{{Root|emerge fail2ban}}
{{Root|emerge fail2ban}}
Line 9: Line 9:
{{Root|rc-update add fail2ban default}}
{{Root|rc-update add fail2ban default}}


{{Kernel|Kernel .config|
== syslog-ng configuration ==
<pre>
Networking
Networking options --->
[*] Network packet filtering (replaces ipchains)  --->
  Core Netfilter Configuration  --->
  <*> Netfilter Xtables support (required for ip_tables)
  IP: Netfilter Configuration  --->
  <*> IP tables support (required for filtering/masq/NAT)
 
  optional noch:
  IPv6: Netfilter Configuration (EXPERIMENTAL)  --->
  <*> IP6 tables support (required for filtering/masq/NAT)
</pre>
}}
 
{{File|/etc/ssh/sshd_config|
<pre>
SyslogFacility AUTH
LogLevel INFO
</pre>
}}


{{File|/etc/syslog-ng/syslog-ng.conf|
{{File|/etc/syslog-ng/syslog-ng.conf|
Line 49: Line 28:
{{Root|/etc/init.d/syslog-ng restart}}
{{Root|/etc/init.d/syslog-ng restart}}


{{File|/etc/fail2ban.conf|
== Fail2ban configuration (0.9.x) ==
 
=== Enable the sshd jails and fail2ban reporting via email ===
{{File|/etc/fail2ban/jail.local|
<pre>
<pre>
maxfailures = 3
[DEFAULT]
bantime = 86400
maxretry = 3
destemail = yourmail@domain.local
sender = fail2ban@hostname
action = %(action_mwl)s


[MAIL]
[sshd]
enabled = true
enabled = true
host = mailrelay/localhost
to = logs@domain.de


[SSH]
[sshd-ddos]
enabled = true
enabled = true
logfile = /var/log/auth.log
</pre>
}}
=== fail2ban installieren ===
{{Root|emerge fail2ban}}
{{Root|/etc/init.d/iptables save}}
{{Root|rc-update add iptables default}}
{{Root|rc-update add fail2ban default}}
{{Kernel|Kernel .config|
<pre>
Networking
Networking options --->
[*] Network packet filtering (replaces ipchains)  --->
  Core Netfilter Configuration  --->
  <*> Netfilter Xtables support (required for ip_tables)
  IP: Netfilter Configuration  --->
  <*> IP tables support (required for filtering/masq/NAT)
  optional noch:
  IPv6: Netfilter Configuration (EXPERIMENTAL)  --->
  <*> IP6 tables support (required for filtering/masq/NAT)
</pre>
</pre>
}}
}}


{{File|/etc/ssh/sshd_config|
=== Optional: Disable the new sqlite feature ===
<pre>
SyslogFacility AUTH
LogLevel INFO
</pre>
}}


{{File|/etc/syslog-ng/syslog-ng.conf|
{{File|/etc/fail2ban/fail2ban.local|
<pre>
<pre>
destination authlog { file("/var/log/sshd.log"); };
[Definition]
filter f_authpriv { facility(auth, authpriv); };
dbfile = None
filter f_failed { match("failed"); };
filter f_denied { match("denied"); };
 
log { source(src); filter(f_authpriv); destination(authlog); };
</pre>
</pre>
}}
}}


{{Root|touch /var/log/sshd.log}}
=== Optional: Set the sshd log file path (default is auth.log) ===
 
{{Root|chmod 600 /var/log/sshd.log}}
 
{{Root|/etc/init.d/syslog-ng restart}}


{{File|/etc/fail2ban/jail.conf|
{{File|/etc/fail2ban/paths-overrides.local|
<pre>
<pre>
[ssh-iptables]
[DEFAULT]
 
sshd_log = /var/log/sshd.log
enabled  = true
filter  = sshd
action  = iptables[name=SSH, port=ssh, protocol=tcp]
          mail-whois[name=SSH, dest=yourmail@mail.com]
logpath  = /var/log/sshd.log
maxretry = 3
bantime  = 600
 
</pre>
</pre>
}}
}}
Line 135: Line 69:


[[Categorie:Software]]
[[Categorie:Software]]
bantime  = 86400

Revision as of 17:07, 19 March 2014

Installation

# emerge fail2ban
# /etc/init.d/iptables save
# rc-update add iptables default
# rc-update add fail2ban default

syslog-ng configuration

File: /etc/syslog-ng/syslog-ng.conf
destination authlog { file("/var/log/auth.log"); };
filter f_authpriv { facility(auth, authpriv); };
filter f_failed { match("failed"); };
filter f_denied { match("denied"); };

log { source(src); filter(f_authpriv); destination(authlog); };
# touch /var/log/auth.log
# chmod 600 /var/log/auth.log
# /etc/init.d/syslog-ng restart

Fail2ban configuration (0.9.x)

Enable the sshd jails and fail2ban reporting via email

File: /etc/fail2ban/jail.local
[DEFAULT]
bantime = 86400
maxretry = 3
destemail = yourmail@domain.local
sender = fail2ban@hostname
action = %(action_mwl)s

[sshd]
enabled = true

[sshd-ddos]
enabled = true

Optional: Disable the new sqlite feature

File: /etc/fail2ban/fail2ban.local
[Definition]
dbfile = None

Optional: Set the sshd log file path (default is auth.log)

File: /etc/fail2ban/paths-overrides.local
[DEFAULT]
sshd_log = /var/log/sshd.log
# /etc/init.d/fail2ban start

Categorie:Software

Retrieved from "https://q-old.deltaquadrant.org/index.php?title=Fail2ban&oldid=3855"