Differences

This shows you the differences between two versions of the page.

--- сервис_fail2ban [2020/02/27 09:37]
val
+++ сервис_fail2ban [2024/05/11 10:54]
val [Интеграция fail2ban и snort]
@@ Line 2: / Line 2: @@
   * [[https://thefragens.com/2010/11/checking-fail2ban-regex/|Checking Fail2ban regex]]
+  * [[https://forum.yunohost.org/t/fail2ban-high-cpu-usage/2439|Fail2ban high CPU usage]]
 ===== Установка =====
-==== Debian/Ubuntu ====
   * [[https://help.ubuntu.com/community/Fail2ban|Fail2ban]]
+  * [[https://bugs.launchpad.net/ubuntu/+source/fail2ban/+bug/2055114|fail2ban is broken in 24.04 Noble]]
 <code>
+debian11# apt install iptables
+debian12# apt install iptables rsyslog
 # apt install fail2ban
-# cd /etc/fail2ban/
+ubuntu24# wget https://launchpad.net/ubuntu/+source/fail2ban/1.1.0-1/+build/28291332/+files/fail2ban_1.1.0-1_all.deb
-</code>
+ubuntu24# dpkg -i fail2ban_1.1.0-1_all.deb
-==== FreeBSD ====
-<code>
-# pkg install py27-fail2ban
-# cat /etc/rc.conf
-</code><code>
-...
-fail2ban_enable="YES"
-</code><code>
-# cd /usr/local/etc/fail2ban/
 </code>
 ===== Настройка =====
-==== Debian/Ubuntu/FreeBSD ====
 <code>
-# cat jail.conf
+# cat /etc/fail2ban/jail.conf
-# ls jail.d/
+# ls /etc/fail2ban/jail.d/
-# cat filter.d/sshd.conf
+# cat /etc/fail2ban/jail.d/defaults-debian.conf
-# cat filter.d/asterisk.conf
+# cat /etc/fail2ban/filter.d/sshd.conf
-</code>
-==== Debian/Ubuntu ====
+# cat /etc/fail2ban/filter.d/asterisk.conf
-<code>
+</code><code>
-# cat jail.local
+# cat /etc/fail2ban/jail.local
 </code><code>
 [sshd]
 maxretry = 6
+#ignoreip = 192.168.X.0/24 192.168.100+X.0/24
 [asterisk]
 enabled = true
-maxretry    = 3
+maxretry = 3
-</code>
+#bantime = 30d
+#action = iptables-allports[blocktype=DROP]
-==== FreeBSD ====
+#action = route[blocktype=blackhole]
-  * Настройка PF ([[Сервис Firewall#Конфигурация для защиты от bruteforce]])
-<code>
-# cat jail.local
-</code><code>
-[sshd]
-enabled     = true
-filter      = sshd
-action      = pf
-maxretry    = 6
-logpath     = /var/log/auth.log
-[asterisk]
-# ignoreip    = 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
-enabled     = true
-action      = pf
-maxretry    = 3
 </code>
 ===== Запуск и отладка =====
-==== Debian/Ubuntu ====
 <code>
 # service fail2ban reload
-</code>
+</code><code>
-==== FreeBSD ====
-<code>
-# service fail2ban start
-</code>
-==== Debian/Ubuntu/FreeBSD ====
-<code>
 # tail -f /var/log/fail2ban.log
 </code>
@@ Line 103: / Line 65: @@
 ===== Интеграция fail2ban и cisco log =====
+  * Резервное копирование конфигурации
 <code>
 # cat /etc/fail2ban/jail.d/cisco-change-config.conf
@@ Line 116: / Line 81: @@
 # cat /etc/fail2ban/filter.d/cisco-change-config.conf
 </code><code>
-[INCLUDES]
 [Definition]
-failregex = <HOST>.*Configured from console.*
+failregex = <HOST>.*Configured from.*
 </code><code>
 # cat /etc/fail2ban/action.d/cisco-backup-config.conf
@@ Line 127: / Line 90: @@
 actionban = /usr/bin/sshpass -p cisco /usr/bin/scp <ip>:running-config /srv/tftp/<ip>-running-config
+            cd /srv/tftp/
+            /usr/bin/git add *
+            /usr/bin/git --no-optional-locks status | grep 'modified\|deleted\|new file' | /usr/bin/git commit -a -F -
 </code>
 ===== Интеграция fail2ban и snort =====
@@ Line 134: / Line 99: @@
 <code>
-# cat jail.d/snort_jail.conf
+# cat /etc/fail2ban/jail.d/snort_jail.conf
 </code><code>
 [snort]
@@ Line 140: / Line 105: @@
 bantime     = 300
 filter      = snort_filter
-maxretry    = 1
+maxretry    = 3
 logpath     = /var/log/auth.log
+#action      = mail-admin
 #action      = iptables-allports
+#action      = iptables-allports-forward
 #action      = cisco-acl
 </code><code>
-# cat filter.d/snort_filter.conf
+# cat /etc/fail2ban/filter.d/snort_filter.conf
 </code><code>
-[INCLUDES]
 [Definition]
@@ Line 154: / Line 119: @@
 #        .*snort.*Priority: 2.*} <HOST>.*
-ignoreregex =
+#failregex = .*Original Client IP: <HOST>.*
 </code>
+==== Уведомление по email ====
+<code>
+# cat /etc/fail2ban/action.d/mail-admin.conf
+</code><code>
+[Definition]
+actionban = printf %%b "Hi,\n
+            Ban this <ip>
+            Regards,\n
+            Fail2Ban"|mail -s "[Fail2Ban] Ban <name> <ip>" <dest>
+actionunban = printf %%b "Hi,\n
+            Unban this <ip>
+            Regards,\n
+            Fail2Ban"|mail -s "[Fail2Ban] Unban <name> <ip>" <dest>
+[Init]
+name = mail-admin
+dest = student
+</code>
+  * [[#Запуск и отладка]]
 ==== Блокировка через iptables ====
 <code>
-# iptables -A FORWARD -j f2b-default
+# cp /etc/fail2ban/action.d/iptables-allports.conf /etc/fail2ban/action.d/iptables-allports-forward.conf
+# cat /etc/fail2ban/action.d/iptables-allports-forward.conf
+</code><code>
+...
+before = iptables-common-forward.conf
+...
+</code><code>
+# cp /etc/fail2ban/action.d/iptables-common.conf /etc/fail2ban/action.d/iptables-common-forward.conf
+# cat /etc/fail2ban/action.d/iptables-common-forward.conf
+</code><code>
+...
+chain = FORWARD
+...
 </code>
+  * [[#Запуск и отладка]]
 ==== Блокировка через cisco acl ====
 <code>
+server# rsh router show access-lists
+</code><code>
 # cat /root/cisco-acl-deny.sh
 </code><code>
@@ Line 181: / Line 188: @@
  permit tcp any host 192.168.X.10 eq 80
  permit tcp any host 192.168.X.10 eq 22
- permit icmp any 192.168.X.0 0.0.0.255
+ permit icmp any 192.168.0.0 0.0.255.255
  permit ip any host 172.16.1.X
  permit udp any any
  permit tcp any any established
- deny   ip any any log
+ deny   ip any any ! log
 end
 </code><code>
@@ Line 210: / Line 217: @@
 actionunban = /root/cisco-change-firewall.sh
+# if atack from DNS)
+#actionunban = echo /root/cisco-change-firewall.sh | at now + 1 min
 </code>
+  * [[#Запуск и отладка]]
 ===== Отладка собственных фильтров =====

Методические материалы Лохтурова Вячеслава

User Tools

Site Tools

Differences

Page Tools