Fail2Ban

(Difference between revisions)

Revision as of 03:54, 8 March 2011

Basic fail2ban installation and setup

Installation

Install EPEL Repos

• For CentOS 5 i386:

     # rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-4.noarch.rpm

• For CentOS 4:

     # rpm -Uvh http://download.fedora.redhat.com/pub/epel/4/i386/epel-release-4-10.noarch.rpm

Instal fail2ban:

     # yum install fail2ban

Setup

To work with Qmail/vpopmail, a filter and jail should be defined.

• Create a filter

     # vi /etc/fail2ban/filter.d/vpopmail-fail.conf
     [Definition]
     #Looks for failed password logins to SMTP
     failregex = vchkpw-smtp: password fail ([^)]*) [^@]*@[^:]*:<HOST>
     ignoreregex =

     # vi /etc/fail2ban/filter.d/qmail-pop3.conf 
     [Definition]
     # Option: failregex
     # Notes.: regex to match the password failures messages in the logfile. 
     # The host must be matched by a group named "host". The tag "<HOST>" can
     # be used for standard IP/hostname matching and is only an alias for
     # (?:::f{4,6}:)?(?P<host>\S+)
     # Values: TEXT
     failregex = vchkpw-pop3: vpopmail user not found .*:<HOST>
     
     # Option: ignoreregex
     # Notes.: regex to ignore. If this regex matches, the line is ignored.
     # Values: TEXT
     ignoreregex = 

• Create a jail (add these lines)

     # vi /etc/fail2ban/jail.conf  
     [vpopmail-fail]
     enabled  = true
     filter   = vpopmail-fail
     action   = iptables[name=SMTP, port=smtp, protocol=tcp]
     logpath  = /var/log/maillog
     maxretry = 1
     bantime  = 604800
     findtime = 3600

     [qmail-pop3]
     enable = true
     filter = qmail-pop3
     action = shorewall
     sendmail[name="Qmail Pop3 user fail", dest=changethis@yourdomain.com]
     logpath = /your/path/to/pop3/logs
     maxretry = 3
     bantime = 600 

• Test the filter file (Returns something like this, with n matches for the regex or 0 if no matches):

     # fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/vpopmail-fail.conf

     Failregex
     |- Regular expressions:
     |  [1] vchkpw-smtp: password fail ([^)]*) [^@]*@[^:]*:<HOST>
     |
     `- Number of matches:
       [1] 123 match(es)

• Reload config:

     # fail2ban-client stop
     # fail2ban-client start

• Check the status of a jail:

     # fail2ban-client status vpopmail-fail

     Status for the jail: vpopmail-fail
     |- filter
     |  |- File list:        /var/log/maillog
     |  |- Currently failed: 7
     |  `- Total failed:     225
     `- action
       |- Currently banned: 109
       | `- IP list: 200.207.49.13 84.79.73.123 187.35.209.243 (...) 187.6.106.201 187.63.80.134 187.52.195.234 187.4.200.17
        `- Total banned:     109

NOTE: Once its starts running and the logs have matching strings, it will create iptables rules dropping that IP. But when fail2ban reload and/or iptables restart and/or rebooting and/or the weekly logrotate, those rules are gone. bye bye! So what to do?

• Before changes, write existing iptables rules to file

     # service iptables save

• And after any change load the saved set of rules

     # service iptables restart

• Tune fail2ban to write IPs to /etc/fail2ban/ip.deny

Basic admin stuff

• Check banned IPs:
  • from fail2ban:

        # fail2ban-client status vpopmail-fail

• • from current iptables rules:

        # iptables -L -nv

• • To see IPs that fail2ban is saving for the next reload:

        # cat /etc/fail2ban/ip.deny

• How to unblock an IP:
  • Delete it from the current iptables rules:

        # iptables -D fail2ban-SMTP -s 11.22.33.44 -j DROP

• • Remove it from /etc/fail2ban/ip.deny (maybe listed several times).

• • Remove it from /etc/sysconfig/iptables (maybe listed several times).

References

[0] http://www.mail-archive.com/qmailtoaster-list@qmailtoaster.com/msg30514.html

[1] http://www.mail-archive.com/qmailtoaster-list@qmailtoaster.com/msg30551.html

[2] http://fedoraproject.org/wiki/EPEL/FAQ#howtouse

[3] http://n8wood.wordpress.com/2009/06/22/fail2ban-permanent-ssh-bans/

[4] fail2ban homepage: http://www.fail2ban.org