Fail2ban

Software k dynamickému blokování IP adres, když dělají něco, co nemají.

apt install fail2ban
 
cd /etc/fail2ban
cp jail.conf jail.local

Pro webserver jsem nastavoval, aby se zablokoval při portscanningu přístup na všechny porty, kromě 80 a 443. K tomu mi posloužil vytvoření soubor /etc/fail2ban/action

# Fail2Ban action configuration file for ufw
#
# You are required to run "ufw enable" before this will have any effect.
#
# The insert position should be appropriate to block the required traffic.
# A number after an allow rule to the application won't be of much use.
 
[Definition]
 
actionstart = 
 
actionstop = 
 
actioncheck = 
 
actionban = [ -n "<application>" ] && app="app <application>"
            ufw prepend <blocktype> from <ip> $app
            ufw prepend allow proto tcp from <ip> to <destination> port 80,443 $app
            #ufw insert <insertpos> <blocktype> from <ip> to <destination> port 80 $app
 
actionunban = [ -n "<application>" ] && app="app <application>"
              ufw delete <blocktype> from <ip> $app
              ufw delete allow proto tcp from <ip> to <destination> port 80,443 $app
              #ufw delete <blocktype> from <ip> to <destination> port 80 $app
 
[Init]
# Option: insertpos
# Notes.:  The position number in the firewall list to insert the block rule
insertpos = 1
 
# Option: blocktype
# Notes.: reject or deny
blocktype = deny
 
# Option: destination
# Notes.: The destination address to block in the ufw rule
destination = any
 
# Option: application
# Notes.: application from sudo ufw app list
application = 
 
# DEV NOTES:
# 
# Author: Guilhem Lettron
# Enhancements: Daniel Black

Tady je konfigurace k jednotlivým službám. Každá služba zapisuje do syslogu pokusy o přihlášení v různém formátu. Filtry skrz regulární výrazy ukazují, co hledat. Tím, si lze fail2ban rozšířit i na služby, pro které defaultně určen není.

Přidáme /etc/fail2ban/filter.d/vpnserver.conf <code bash> # Fail2Ban filter for SoftEther authentication failures # Made by quixrick and jonisc # Thanks to quixrick from Reddit! https://reddit.com/u/quixrick [INCLUDES] # Read common prefixes. If any customizations available – read them from # common.local before = common.conf #Enable multi line support. Doesn't work with versions < 0.9 [Init] maxlines = 2 # The regular expression filter follows [Definition] failregex =IP address: <HOST>.*\n.*User authentication failed.* ignoreregex= </code> Dále /etc/fail2ban/filter.d/portscan.conf: <code bash> # Fail2Ban filter for portscan # https://serverfault.com/questions/629709/trouble-with-fail2ban-ufw-portscan-filter # https://dodwell.us/security/ufw-fail2ban-portscan.html # # [Definition] failregex = .*\[UFW BLOCK\] IN=.* SRC=<HOST> ignoreregex = </code> Dále pro /etc/fail2ban/filter.d/nextcloud.conf: <code bash> [INCLUDES] before = common.conf [Definition] _groupsre = (?:(?:,?\s*„\w+“:(?:„[^“]+„|\w+))*) failregex = ^\{%(_groupsre)s,?\s*“remoteAddr„:“<HOST>„%(_groupsre)s,?\s*“message„:„Login failed: datepattern = ,?\s*“time“\s*:\s*„Y-m-d[T ]H:M:S(%%z)?“ ignoreregex = </code> Našel jsem i vlastní ssh - /etc/fail2ban/filter.d/mysshd.conf: <code bash> # Fail2Ban filter for openssh # # If you want to protect OpenSSH from being bruteforced by password # authentication then get public key authentication working before disabling # PasswordAuthentication in sshd_config. # # # „Connection from <HOST> port \d+“ requires LogLevel VERBOSE in sshd_config # [INCLUDES] # Read common prefixes. If any customizations available – read them from # common.local before = common.conf [DEFAULT] _daemon = sshd # optional prefix (logged from several ssh versions) like „error: “, „error: PAM: “ or „fatal: “ pref = (?:(?:error|fatal): (?:PAM: )?)? # optional suffix (logged from several ssh versions) like „ [preauth]“ suff = (?: \[preauth\])?\s* on_port_opt = (?: port \d+)?(?: on \S+(?: port \d+)?)? # for all possible (also future) forms of „no matching (cipher|mac|MAC|compression method|key exchange method|host key type) found“, # see ssherr.c for all possible SSH_ERR_…_ALG_MATCH errors. alg_match = (?:(?:\w+ (?!found\b)){0,2}\w+) [Definition] prefregex = ^<F-MLFID>%(prefix_line)s</F-MLFID>%(pref)s<F-CONTENT>.+</F-CONTENT>$ cmnfailre = ^[aA]uthentication (?:failure|error|failed) for <F-USER>.*</F-USER> from <HOST>( via \S+)?\s*%(suff)s$ ^User not known to the underlying authentication module for <F-USER>.*</F-USER> from <HOST>\s*%(suff)s$ ^Failed \S+ for invalid user <F-USER>(?P<cond_user>\S+)|(?:(?! from ).)*?</F-USER> from <HOST>%(on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$) ^Failed \b(?!publickey)\S+ for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>%(on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$) ^<F-USER>ROOT</F-USER> LOGIN REFUSED.* FROM <HOST>\s*%(suff)s$ ^[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> from <HOST>%(on_port_opt)s\s*$ ^User <F-USER>.+</F-USER> from <HOST> not allowed because not listed in AllowUsers\s*%(suff)s$ ^User <F-USER>.+</F-USER> from <HOST> not allowed because listed in DenyUsers\s*%(suff)s$ ^User <F-USER>.+</F-USER> from <HOST> not allowed because not in any group\s*%(suff)s$ ^Connection closed by <HOST> port \d+ \[preauth\]$ ^refused connect from \S+ \(<HOST>\)\s*%(suff)s$ ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(on_port_opt)s:\s*3: .*: Auth fail%(suff)s$ ^User <F-USER>.+</F-USER> from <HOST> not allowed because a group is listed in DenyGroups\s*%(suff)s$ ^User <F-USER>.+</F-USER> from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*%(suff)s$ ^pam_unix\(sshd:auth\):\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=<F-USER>\S*</F-USER>\s*rhost=<HOST>\s.*%(suff)s$ ^(error: )?maximum authentication attempts exceeded for <F-USER>.*</F-USER> from <HOST>%(on_port_opt)s(?: ssh\d*)?%(suff)s$ ^User <F-USER>.+</F-USER> not allowed because account is locked%(suff)s ^<F-MLFFORGET>Disconnecting</F-MLFFORGET>: Too many authentication failures(?: for <F-USER>.+?</F-USER>)?%(suff)s ^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>: 11: ^<F-NOFAIL>Connection <F-MLFFORGET>closed</F-MLFFORGET></F-NOFAIL> by <HOST>%(suff)s$ ^<F-MLFFORGET><F-NOFAIL>Accepted publickey</F-NOFAIL></F-MLFFORGET> for \S+ from <HOST>(?:\s|$) mdre-normal = mdre-ddos = ^Did not receive identification string from <HOST>%(suff)s$ ^Connection <F-MLFFORGET>reset</F-MLFFORGET> by <HOST>%(on_port_opt)s%(suff)s ^<F-NOFAIL>SSH: Server;Ltype:</F-NOFAIL> (?:Authname|Version|Kex);Remote: <HOST>-\d+;[A-Z]\w+: ^Read from socket failed: Connection <F-MLFFORGET>reset</F-MLFFORGET> by peer%(suff)s mdre-extra = ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(on_port_opt)s:\s*14: No supported authentication methods available%(suff)s$ ^Unable to negotiate with <HOST>%(on_port_opt)s: no matching <alg_match> found. ^Unable to negotiate a <alg_match>%(suff)s$ ^no matching <__alg_match> found: mdre-aggressive = %(mdre-ddos)s %(mdre-extra)s cfooterre = ^<F-NOFAIL>Connection from</F-NOFAIL> <HOST> failregex = %(cmnfailre)s <mdre-<mode» %(cfooterre)s # Parameter „mode“: normal (default), ddos, extra or aggressive (combines all) # Usage example (for jail.local): # [sshd] # mode = extra # # or another jail (rewrite filter parameters of jail): # [sshd-aggressive] # filter = sshd[mode=aggressive] # mode = normal #filter = sshd[mode=aggressive] ignoreregex = maxlines = 1 journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd datepattern = {^LN-BEG} # DEV Notes: # # „Failed \S+ for .*? from <HOST>…“ failregex uses non-greedy catch-all because # it is coming before use of <HOST> which is not hard-anchored at the end as well, # and later catch-all's could contain user-provided input, which need to be greedily # matched away first. # # Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black and Sergey Brester aka sebres # Rewritten using prefregex (and introduced „mode“ parameter) by Serg G. Brester. </code> /etc/fail2ban/filter.d/ufwban.conf**

[INCLUDES]
before = common.conf
 
[Definition]
#failregex = .*\[UFW BLOCK\] IN=.* SRC=<HOST>
failregex = UFW BLOCK.* SRC=<HOST>
ignoreregex =

fail2ban-client set vpnserver unbanip 89.24.33.115
fail2ban-client unban 89.24.33.115