Differences

This shows you the differences between two versions of the page.

--- сервис_fail2ban [2020/03/04 10:05]
val [Интеграция fail2ban и cisco log]
+++ сервис_fail2ban [2024/05/11 10:54]
val [Интеграция fail2ban и snort]
@@ Line 2: / Line 2: @@
   * [[https://thefragens.com/2010/11/checking-fail2ban-regex/|Checking Fail2ban regex]]
+  * [[https://forum.yunohost.org/t/fail2ban-high-cpu-usage/2439|Fail2ban high CPU usage]]
 ===== Установка =====
   * [[https://help.ubuntu.com/community/Fail2ban|Fail2ban]]
+  * [[https://bugs.launchpad.net/ubuntu/+source/fail2ban/+bug/2055114|fail2ban is broken in 24.04 Noble]]
 <code>
+debian11# apt install iptables
+debian12# apt install iptables rsyslog
 # apt install fail2ban
-# cd /etc/fail2ban/
+ubuntu24# wget https://launchpad.net/ubuntu/+source/fail2ban/1.1.0-1/+build/28291332/+files/fail2ban_1.1.0-1_all.deb
+ubuntu24# dpkg -i fail2ban_1.1.0-1_all.deb
 </code>
@@ Line 15: / Line 21: @@
 <code>
-# cat jail.conf
+# cat /etc/fail2ban/jail.conf
+# ls /etc/fail2ban/jail.d/
-# ls jail.d/
+# cat /etc/fail2ban/jail.d/defaults-debian.conf
-# cat filter.d/sshd.conf
+# cat /etc/fail2ban/filter.d/sshd.conf
-# cat filter.d/asterisk.conf
+# cat /etc/fail2ban/filter.d/asterisk.conf
 </code><code>
-# cat jail.local
+# cat /etc/fail2ban/jail.local
 </code><code>
 [sshd]
 maxretry = 6
+#ignoreip = 192.168.X.0/24 192.168.100+X.0/24
 [asterisk]
 enabled = true
-maxretry    = 3
+maxretry = 3
+#bantime = 30d
+#action = iptables-allports[blocktype=DROP]
+#action = route[blocktype=blackhole]
 </code>
@@ Line 53: / Line 65: @@
 ===== Интеграция fail2ban и cisco log =====
+  * Резервное копирование конфигурации
 <code>
 # cat /etc/fail2ban/jail.d/cisco-change-config.conf
@@ Line 66: / Line 81: @@
 # cat /etc/fail2ban/filter.d/cisco-change-config.conf
 </code><code>
-[INCLUDES]
 [Definition]
-failregex = <HOST>.*Configured from console.*
+failregex = <HOST>.*Configured from.*
 </code><code>
 # cat /etc/fail2ban/action.d/cisco-backup-config.conf
@@ Line 79: / Line 92: @@
             cd /srv/tftp/
             /usr/bin/git add *
-            /usr/bin/git status | grep 'modified\|deleted\|new file' | /usr/bin/git commit -a -F -
+            /usr/bin/git --no-optional-locks status | grep 'modified\|deleted\|new file' | /usr/bin/git commit -a -F -
 </code>
 ===== Интеграция fail2ban и snort =====
@@ Line 86: / Line 99: @@
 <code>
-# cat jail.d/snort_jail.conf
+# cat /etc/fail2ban/jail.d/snort_jail.conf
 </code><code>
 [snort]
@@ Line 92: / Line 105: @@
 bantime     = 300
 filter      = snort_filter
-maxretry    = 1
+maxretry    = 3
 logpath     = /var/log/auth.log
+#action      = mail-admin
 #action      = iptables-allports
+#action      = iptables-allports-forward
 #action      = cisco-acl
 </code><code>
-# cat filter.d/snort_filter.conf
+# cat /etc/fail2ban/filter.d/snort_filter.conf
 </code><code>
-[INCLUDES]
 [Definition]
@@ Line 106: / Line 119: @@
 #        .*snort.*Priority: 2.*} <HOST>.*
-ignoreregex =
+#failregex = .*Original Client IP: <HOST>.*
 </code>
+==== Уведомление по email ====
+<code>
+# cat /etc/fail2ban/action.d/mail-admin.conf
+</code><code>
+[Definition]
+actionban = printf %%b "Hi,\n
+            Ban this <ip>
+            Regards,\n
+            Fail2Ban"|mail -s "[Fail2Ban] Ban <name> <ip>" <dest>
+actionunban = printf %%b "Hi,\n
+            Unban this <ip>
+            Regards,\n
+            Fail2Ban"|mail -s "[Fail2Ban] Unban <name> <ip>" <dest>
+[Init]
+name = mail-admin
+dest = student
+</code>
+  * [[#Запуск и отладка]]
 ==== Блокировка через iptables ====
 <code>
-# iptables -A FORWARD -j f2b-default
+# cp /etc/fail2ban/action.d/iptables-allports.conf /etc/fail2ban/action.d/iptables-allports-forward.conf
+# cat /etc/fail2ban/action.d/iptables-allports-forward.conf
+</code><code>
+...
+before = iptables-common-forward.conf
+...
+</code><code>
+# cp /etc/fail2ban/action.d/iptables-common.conf /etc/fail2ban/action.d/iptables-common-forward.conf
+# cat /etc/fail2ban/action.d/iptables-common-forward.conf
+</code><code>
+...
+chain = FORWARD
+...
 </code>
+  * [[#Запуск и отладка]]
 ==== Блокировка через cisco acl ====
 <code>
+server# rsh router show access-lists
+</code><code>
 # cat /root/cisco-acl-deny.sh
 </code><code>
@@ Line 133: / Line 188: @@
  permit tcp any host 192.168.X.10 eq 80
  permit tcp any host 192.168.X.10 eq 22
- permit icmp any 192.168.X.0 0.0.0.255
+ permit icmp any 192.168.0.0 0.0.255.255
  permit ip any host 172.16.1.X
  permit udp any any
  permit tcp any any established
- deny   ip any any log
+ deny   ip any any ! log
 end
 </code><code>
@@ Line 162: / Line 217: @@
 actionunban = /root/cisco-change-firewall.sh
+# if atack from DNS)
+#actionunban = echo /root/cisco-change-firewall.sh | at now + 1 min
 </code>
+  * [[#Запуск и отладка]]
 ===== Отладка собственных фильтров =====

Методические материалы Лохтурова Вячеслава

User Tools

Site Tools

Differences

Page Tools