QmailtoasterMain Page | About | Help | FAQ | Special pages | Log in

Printable version | Disclaimers | Privacy policy | Latest revision

Fail2Ban

(Difference between revisions)

(New page: == '''Basic fail2ban installation and setup''' == fail2ban homepage: http://www.fail2ban.org. Please check [0] and [1] for more details. ---- == 1. Installation. == Enable the EPEL re...)
(prettified)
Line 1: Line 1:
-
== '''Basic fail2ban installation and setup''' ==
+
'''Basic fail2ban installation and setup'''
-
 
+
-
 
+
-
fail2ban homepage: http://www.fail2ban.org.
+
-
Please check [0] and [1] for more details.
+
-
 
+
----
----
 +
== Installation ==
 +
Install EPEL Repos
 +
* For CentOS 5 i386:
 +
      # rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-4.noarch.rpm
 +
* For CentOS 4:
 +
      # rpm -Uvh http://download.fedora.redhat.com/pub/epel/4/i386/epel-release-4-10.noarch.rpm
-
== 1. Installation. ==
+
Instal fail2ban:
 +
      # yum install fail2ban
-
Enable the EPEL repos [1] and then 'yum install fail2ban'
+
== Setup ==
-
 
+
-
 
+
-
 
+
-
== 2. Setup: ==
+
To work with Qmail/vpopmail, a filter and jail should be defined.
To work with Qmail/vpopmail, a filter and jail should be defined.
-
'''a.''' # mcedit /etc/fail2ban/filter.d/vpopmail-fail.conf
+
* Create a filter
 +
      # vi /etc/fail2ban/filter.d/vpopmail-fail.conf
 +
      [Definition]
 +
      #Looks for failed password logins to SMTP
 +
      failregex = vchkpw-smtp: password fail ([^)]*) [^@]*@[^:]*:<HOST>
 +
      ignoreregex =
-
[Definition]
+
* Create a jail (add these lines)
-
#Looks for failed password logins to SMTP
+
      # vi /etc/fail2ban/jail.conf 
-
failregex = vchkpw-smtp: password fail ([^)]*) [^@]*@[^:]*:<HOST>
+
      [vpopmail-fail]
 +
      enabled  = true
 +
      filter  = vpopmail-fail
 +
      action  = iptables[name=SMTP, port=smtp, protocol=tcp]
 +
      logpath  = /var/log/maillog
 +
      maxretry = 1
 +
      bantime  = 604800
 +
      findtime = 3600
-
ignoreregex =
+
* Test the filter file (Returns something like this, with n matches for the regex or 0 if no matches):
 +
      # fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/vpopmail-fail.conf
-
'''b.''' # mcedit /etc/fail2ban/jail.conf  (add this)
+
      Failregex
 +
      |- Regular expressions:
 +
      |  [1] vchkpw-smtp: password fail ([^)]*) [^@]*@[^:]*:<HOST>
 +
      |
 +
      `- Number of matches:
 +
        [1] 123 match(es)
-
[vpopmail-fail]
+
* Reload config:
-
enabled  = true
+
      # fail2ban-client stop
-
filter  = vpopmail-fail
+
      # fail2ban-client start
-
action  = iptables[name=SMTP, port=smtp, protocol=tcp]
+
-
logpath  = /var/log/maillog
+
-
maxretry = 1
+
-
bantime  = 604800
+
-
findtime = 3600
+
-
'''c. Test the filter file:'''
+
* Check the status of a jail:
-
# fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/vpopmail-fail.conf
+
      # fail2ban-client status vpopmail-fail
-
Returns something like this, with n matches for the regex or 0 if no matches:
+
      Status for the jail: vpopmail-fail
 +
      |- filter
 +
      |  |- File list:        /var/log/maillog
 +
      |  |- Currently failed: 7
 +
      |  `- Total failed:    225
 +
      `- action
 +
        |- Currently banned: 109
 +
        | `- IP list: 200.207.49.13 84.79.73.123 187.35.209.243 (...) 187.6.106.201 187.63.80.134 187.52.195.234 187.4.200.17
 +
        `- Total banned:    109
-
Failregex
+
'''NOTE:'''
-
|- Regular expressions:
+
Once its starts running and the logs have matching strings, it will create iptables rules dropping that IP.
-
|  [1] vchkpw-smtp: password fail ([^)]*) [^@]*@[^:]*:<HOST>
+
But when fail2ban reload and/or iptables restart and/or rebooting and/or the weekly logrotate, those rules are gone. bye bye!
-
|
+
So what to do?
-
`- Number of matches:
+
* Before changes, write existing iptables rules to file
-
  [1] 123 match(es)
+
      # service iptables save
 +
* And after any change load the saved set of rules
 +
      # service iptables restart
 +
* Tune fail2ban to write IPs to /etc/fail2ban/ip.deny
-
'''d. Reload config:'''
+
== Basic admin stuff ==
-
# fail2ban-client stop/start
+
-
'''e. Check the status of a jail:'''
+
* Check banned IPs:
 +
** from fail2ban:
 +
        # fail2ban-client status vpopmail-fail
 +
** from current iptables rules:  
 +
        # iptables -L -nv
 +
** To see IPs that fail2ban is saving for the next reload:
 +
        # cat /etc/fail2ban/ip.deny
-
# fail2ban-client status vpopmail-fail
+
* How to unblock an IP:
 +
** Delete it from the current iptables rules:
 +
        # iptables -D fail2ban-SMTP -s 11.22.33.44 -j DROP
 +
** Remove it from /etc/fail2ban/ip.deny (maybe listed several times).
-
Status for the jail: vpopmail-fail
+
** Remove it from /etc/sysconfig/iptables (maybe listed several times).
-
|- filter
+
-
|  |- File list:        /var/log/maillog
+
-
|  |- Currently failed: 7
+
-
|  `- Total failed:    225
+
-
`- action
+
-
  |- Currently banned: 109
+
-
| `- IP list: 200.207.49.13 84.79.73.123 187.35.209.243 (...) 187.6.106.201 187.63.80.134 187.52.195.234 187.4.200.17
+
== References ==
 +
[0] http://www.mail-archive.com/qmailtoaster-list@qmailtoaster.com/msg30514.html
-
  `- Total banned:     109
+
[1] http://www.mail-archive.com/qmailtoaster-list@qmailtoaster.com/msg30551.html
-
'''NOTE:''' Once its starts running and the logs have matching strings, it will create iptables rules dropping that IP. But... when fail2ban reload and/or iptables restart and/or rebooting and/or the weekly logrotate, those rules are gone. bye bye!
+
[2] http://fedoraproject.org/wiki/EPEL/FAQ#howtouse
-
So... what to do?
+
-
- Before changes, do a '# service iptables save' and it will write them to a file, and after any change do '# service iptables restart' to make it load the saved set of rules;
+
[3] http://n8wood.wordpress.com/2009/06/22/fail2ban-permanent-ssh-bans/
-
- Tune fail2ban to write IPs to /etc/fail2ban/ip.deny [3].
+
-
 
+
[4] fail2ban homepage: http://www.fail2ban.org
-
== 3.A little basic admin stuff ==
+
-
 
+
-
'''a. Check banned IPs:'''
+
-
- by fail2ban:# fail2ban-client status vpopmail-fail
+
-
- current iptables rules: # iptables -L -nv
+
-
- To see IPs that fail2ban is saving for the next reload:
+
-
# cat /etc/fail2ban/ip.deny
+
-
 
+
-
'''b. How to unblock an IP:'''
+
-
1) Delete it from the current iptables rules:
+
-
# iptables -D fail2ban-SMTP -s 11.22.33.44 -j DROP
+
-
2) remove it from /etc/fail2ban/ip.deny (maybe listed several times).
+
-
3) remove it from /etc/sysconfig/iptables (maybe listed several times).
+
-
 
+
-
 
+
-
----
+
-
 
+
-
 
+
-
== 4. References: ==
+
-
 
+
-
[0] http://www.mail-archive.com/qmailtoaster-list@qmailtoaster.com/msg30514.html
+
-
[1] http://www.mail-archive.com/qmailtoaster-list@qmailtoaster.com/msg30551.html
+
-
[2] http://fedoraproject.org/wiki/EPEL/FAQ#howtouse
+
-
[3] http://n8wood.wordpress.com/2009/06/22/fail2ban-permanent-ssh-bans/
+

Revision as of 09:16, 7 March 2011

Basic fail2ban installation and setup


Contents

Installation

Install EPEL Repos

     # rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-4.noarch.rpm
     # rpm -Uvh http://download.fedora.redhat.com/pub/epel/4/i386/epel-release-4-10.noarch.rpm

Instal fail2ban:

     # yum install fail2ban

Setup

To work with Qmail/vpopmail, a filter and jail should be defined.

     # vi /etc/fail2ban/filter.d/vpopmail-fail.conf
     [Definition]
     #Looks for failed password logins to SMTP
     failregex = vchkpw-smtp: password fail ([^)]*) [^@]*@[^:]*:<HOST>
     ignoreregex =
     # vi /etc/fail2ban/jail.conf  
     [vpopmail-fail]
     enabled  = true
     filter   = vpopmail-fail
     action   = iptables[name=SMTP, port=smtp, protocol=tcp]
     logpath  = /var/log/maillog
     maxretry = 1
     bantime  = 604800
     findtime = 3600
     # fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/vpopmail-fail.conf
     Failregex
     |- Regular expressions:
     |  [1] vchkpw-smtp: password fail ([^)]*) [^@]*@[^:]*:<HOST>
     |
     `- Number of matches:
       [1] 123 match(es)
     # fail2ban-client stop
     # fail2ban-client start
     # fail2ban-client status vpopmail-fail
     Status for the jail: vpopmail-fail
     |- filter
     |  |- File list:        /var/log/maillog
     |  |- Currently failed: 7
     |  `- Total failed:     225
     `- action
       |- Currently banned: 109
       | `- IP list: 200.207.49.13 84.79.73.123 187.35.209.243 (...) 187.6.106.201 187.63.80.134 187.52.195.234 187.4.200.17
        `- Total banned:     109

NOTE: Once its starts running and the logs have matching strings, it will create iptables rules dropping that IP. But when fail2ban reload and/or iptables restart and/or rebooting and/or the weekly logrotate, those rules are gone. bye bye! So what to do?

     # service iptables save
     # service iptables restart


Basic admin stuff

        # fail2ban-client status vpopmail-fail
        # iptables -L -nv
        # cat /etc/fail2ban/ip.deny
        # iptables -D fail2ban-SMTP -s 11.22.33.44 -j DROP

References

[0] http://www.mail-archive.com/qmailtoaster-list@qmailtoaster.com/msg30514.html

[1] http://www.mail-archive.com/qmailtoaster-list@qmailtoaster.com/msg30551.html

[2] http://fedoraproject.org/wiki/EPEL/FAQ#howtouse

[3] http://n8wood.wordpress.com/2009/06/22/fail2ban-permanent-ssh-bans/

[4] fail2ban homepage: http://www.fail2ban.org