Envoyé par
javacup
Je suis sur une release2 toute neuf j'ai fait l'install de fail2ban
Pour installer fail2ban sur une Release 2 OVH (Gentoo), il suffit de faire :
Après quoi, il reste à le configurer. Histoire de donner un exemple, voici mon /etc/fail2ban/jail.conf :
Code:
# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision: 552 $
#
# The DEFAULT allows a global definition of the options. They can be override
# in each jail afterwards.
[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1
# "bantime" is the number of seconds that a host is banned.
bantime = 600
# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 600
# "maxretry" is the number of failures before a host get banned.
maxretry = 3
# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto". This option can be overridden in
# each jail too (use "gamin" for a jail and "polling" for another).
#
# gamin: requires Gamin (a file alteration monitor) to be installed. If Gamin
# is not installed, Fail2ban will use polling.
# polling: uses a polling algorithm which does not require external libraries.
# auto: will choose Gamin if available and polling otherwise.
backend = auto
# This jail corresponds to the standard configuration in Fail2ban 0.6.
# The mail-whois action send a notification e-mail with a whois request
# in the body.
[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
mail-buffered[name=SSH-nomduserveur, lines=5, dest=mon@email.com]
logpath = /var/log/auth.log
maxretry = 3
[proftpd-iptables]
enabled = true
filter = proftpd
action = iptables[name=ProFTPD, port=ftp, protocol=tcp]
mail-buffered[name=ProFTPD-nomduserveur, lines=5, dest=mon@email.com]
logpath = /var/log/auth.log
maxretry = 3
# This jail forces the backend to "polling".
[sasl-iptables]
enabled = false
filter = sasl
backend = polling
action = iptables[name=sasl, port=smtp, protocol=tcp]
mail-whois[name=sasl, dest=yourmail@mail.com]
logpath = /var/log/mail.log
# Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
# used to avoid banning the user "myuser".
[ssh-tcpwrapper]
enabled = false
filter = sshd
action = hostsdeny
mail-whois[name=SSH, dest=yourmail@mail.com]
ignoreregex = for myuser from
logpath = /var/log/sshd.log
# This jail demonstrates the use of wildcards in "logpath".
# Moreover, it is possible to give other files on a new line.
[apache-tcpwrapper]
enabled = false
filter = apache-auth
action = hostsdeny
logpath = /var/log/apache*/*access.log
/home/www/myhomepage/access.log
maxretry = 6
# The hosts.deny path can be defined with the "file" argument if it is
# not in /etc.
[postfix-tcpwrapper]
enabled = false
filter = postfix
action = hostsdeny[file=/not/a/standard/path/hosts.deny]
mail[name=Postfix, dest=yourmail@mail.com]
logpath = /var/log/postfix.log
bantime = 300
# Do not ban anybody. Just report information about the remote host.
# A notification is sent at most every 600 seconds (bantime).
[vsftpd-notification]
enabled = false
filter = vsftpd
action = mail-whois[name=VSFTPD, dest=yourmail@mail.com]
logpath = /var/log/vsftpd.log
maxretry = 5
bantime = 1800
# Same as above but with banning the IP address.
[vsftpd-iptables]
enabled = false
filter = vsftpd
action = iptables[name=VSFTPD, port=ftp, protocol=tcp]
mail-whois[name=VSFTPD, dest=yourmail@mail.com]
logpath = /var/log/vsftpd.log
maxretry = 5
bantime = 1800
# Ban hosts which agent identifies spammer robots crawling the web
# for email addresses. The mail outputs are buffered.
[apache-badbots]
enabled = true
filter = apache-badbots
action = iptables-multiport[name=BadBots, port="http,https"]
mail-buffered[name=BadBots-nomduserveur, lines=5, dest=mon@email.com]
logpath = /home/log/httpd/*-access_log
bantime = 172800
maxretry = 1
# AJOUT NICO apache-noscript avec iptables
[apache-iptables]
enabled = true
filter = apache-noscript
action = iptables[name=apache, port=80, protocol=tcp]
mail-buffered[name=Apache-noscript-nomduserveur, lines=5, dest=mon@email.com]
logpath = /home/log/httpd/error_log
bantime = 3600
maxretry = 3
# Use shorewall instead of iptables.
[apache-shorewall]
enabled = false
filter = apache-noscript
action = shorewall
mail[name=Postfix, dest=yourmail@mail.com]
logpath = /var/log/apache2/error_log
# This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
# option is overridden in this jail. Moreover, the action "mail-whois" defines
# the variable "name" which contains a comma using "". The characters '' are
# valid too.
[ssh-ipfw]
enabled = false
filter = sshd
action = ipfw[localhost=192.168.0.1]
mail-whois[name="SSH,IPFW", dest=yourmail@mail.com]
logpath = /var/log/auth.log
ignoreip = 168.192.0.1
J'ai donc activé les protections sur :
- SSH
- ProFTPD
- BadBots (repère et blackliste les IP reconnues comme des bots qui se baladent sur les sites pour repérer des adresses mail)
- Apache-noscript (repère et blackliste les IP qui font des erreurs 404 louches)
J'utilise la fonction mail-buffered qui m'envoie un mail tous les 5 blacklistages (sans quoi je recevrais constamment des mails).
J'ai ajouté le "nomduserveur" dans la variable "name=". Comme j'ai installé fail2ban à l'identique sur plusieurs machines, ça me permet de savoir au premier coup d'oeil de quel serveur vient le mail.
Etant donné que j'utilise mail-buffered pour les 4 services, il est aussi nécessaire de modifier /etc/fail2ban/action.d/mail-buffered.conf :
Code:
tmpfile = /tmp/fail2ban-mail.txt
Sans quoi fail2ban bufferise tout dans le même fichier et ça déconne.
Concernant apache-noscript, il est également important de paramétrer : /etc/fail2ban/filter.d/apache-noscript.conf. Voici le mien :
Code:
failregex = [[]client []] File does not exist: .*(Admin|admin|forum|guestbook|board)
Cela a pour effet de blacklister les IP qui génèrent des erreurs 404 au niveau de l'apache et dont l'URL qui a généré l'erreur contient les expressions "Admin", "admin", "forum", "guestbook" ou "board". L'idée est de bloquer les bots qui essaient des URL au hasard dans l'espoir de tomber sur un formulaire où poster une saloperie. Ca marche aussi pour les gugusses qui cherchent PhpMyAdmin.
Et enfin il faut démarrer bouzin :
Code:
/etc/init.d/fail2ban start
A mettre au boot, en cron, etc.
Voilou, j'espère avoir remis ce tuto sur les rails
PS : Lire aussi ce topic :
http://forum.ovh.net/showthread.php?t=36534