Skip to content

fail2ban

Image Description

fail2ban

I'm using fail2ban to block script kiddies. Here is one line what you will find in your auth.log

May 11 05:32:14 srv01 sshd[79609]: Invalid user postgres from 37.49.226.178 port 46504

This description can help you how to install and configure fail2ban I will update this post with new infos.

Installation - Ubuntu / Debian

sudo apt-get update
sudo apt-get upgrade
sudo apt-get install fail2ban

Installation FreeBSD

sudo pkg install py37-fail2ban

Configuration

Configuration Ubuntu / Devian

cd /etc/fail2ban
sudo vi jail.local

This configuration is for the sshd daemon. If a user fails to connect three times (maxretry = 3) within 24 hours (findtime = 24h) to login via ssh, he will get banned indefinitely (bantime = -1).

#
# SSH servers
#

[sshd]
enabled = true
filter = sshd
# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
mode   = aggressive
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
banaction = iptables-multiport
bantime = -1
maxretry = 3
findtime = 24h

Configuration FreeBSD

in /usr/local/etc/fail2ban/jail.d/bsd-sshd.conf

Slightly different configuration. Here I use a bantime of 24h (86400s)

[bsd-ssh-pf]
enabled = true
filter = bsd-sshd
port = ssh
logpath = /var/log/auth.log
findtime = 24h
maxretry = 3

bantime  = 86400

Usage

List banned IPs

Via fail2ban-client

sudo fail2ban-client status <jail name>

sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 2
|  |- Total failed: 5
|  `- File list:    /var/log/auth.log
`- Actions
   |- Currently banned: 2
   |- Total banned: 2
   `- Banned IP list:   89.208.197.76 92.222.88.254

via iptables

sudo iptables --list --line-numbers --numeric

sudo iptables --list --line-numbers --numeric
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    f2b-sshd   tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain f2b-sshd (1 references)
num  target     prot opt source               destination
1    REJECT     all  --  92.222.88.254        0.0.0.0/0            reject-with icmp-port-unreachable
2    REJECT     all  --  89.208.197.76        0.0.0.0/0            reject-with icmp-port-unreachable
3    RETURN     all  --  0.0.0.0/0            0.0.0.0/0

with 'pfctl' - FreeBSD

sudo pfctl -a "f2b/bsd-ssh-pf" -t f2b-bsd-ssh-pf -Ts
   118.27.6.66
   165.227.30.198
   209.141.55.11

Ban and unban manually

Ban

sudo fail2ban-client set <JAIL> banip <IP>

Unban

sudo fail2ban-client unban <IP>

Test the filter

fail2ban-regex <logfile> <failregex> <ignoreregex>

I had some trouble with banning IPs. Therefore I've greped the IP and put it into a file. (The problem was not fail2ban but the firewall configuration ;-) )

Example with a positive test

sudo grep 92.222.88.254 auth.log > /tmp/test.log

And test it with

sudo fail2ban-regex /tmp/test.log /etc/fail2ban/filter.d/sshd.conf

Running tests
=============

Use   failregex filter file : sshd, basedir: /etc/fail2ban
Use         maxlines : 1
Use      datepattern : Default Detectors
Use         log file : /tmp/test.log
Use         encoding : UTF-8


Results
=======

Failregex: 53 total
|-  #) [# of hits] regular expression
|   8) [53] ^User <F-USER>.+</F-USER> from <HOST> not allowed because listed in DenyUsers\s*(?: \[preauth\])?\s*$
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [222] {^LN-BEG}(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
`-

Lines: 222 lines, 0 ignored, 53 matched, 169 missed
[processed in 1.53 sec]

Missed line(s): too many to print.  Use --print-all-missed to print all 169 lines

The Failregex: 53 total is the relevant line.

Example with a negative test

Here is an example with an IP that wasn't recognized by the filter

sudo grep 222.186.30.218 /var/log/auth.log > /tmp/test1.log

sudo fail2ban-regex /tmp/test1.log /etc/fail2ban/filter.d/sshd.conf

Running tests
=============

Use   failregex filter file : sshd, basedir: /etc/fail2ban
Use         maxlines : 1
Use      datepattern : Default Detectors
Use         log file : /tmp/test1.log
Use         encoding : UTF-8


Results
=======

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [3] {^LN-BEG}(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
`-

Lines: 3 lines, 0 ignored, 0 matched, 3 missed
[processed in 0.12 sec]

|- Missed line(s):
|  Apr 22 16:01:02 raspberrypi sshd[14285]: Received disconnect from 222.186.30.218 port 63194:11:  [preauth]
|  Apr 22 16:01:02 raspberrypi sshd[14285]: Disconnected from 222.186.30.218 port 63194 [preauth]