====== Сервис Fail2ban ======
* [[https://thefragens.com/2010/11/checking-fail2ban-regex/|Checking Fail2ban regex]]
* [[https://forum.yunohost.org/t/fail2ban-high-cpu-usage/2439|Fail2ban high CPU usage]]
===== Установка =====
* [[https://help.ubuntu.com/community/Fail2ban|Fail2ban]]
* [[https://bugs.launchpad.net/ubuntu/+source/fail2ban/+bug/2055114|fail2ban is broken in 24.04 Noble]]
debian11# apt install iptables
debian12# apt install iptables rsyslog
# apt install fail2ban
ubuntu24# wget https://launchpad.net/ubuntu/+source/fail2ban/1.1.0-1/+build/28291332/+files/fail2ban_1.1.0-1_all.deb
ubuntu24# dpkg -i fail2ban_1.1.0-1_all.deb
===== Настройка =====
# cat /etc/fail2ban/jail.conf
# ls /etc/fail2ban/jail.d/
# cat /etc/fail2ban/jail.d/defaults-debian.conf
# cat /etc/fail2ban/filter.d/sshd.conf
# cat /etc/fail2ban/filter.d/asterisk.conf
# cat /etc/fail2ban/jail.local
[sshd]
maxretry = 6
#ignoreip = 192.168.X.0/24 192.168.100+X.0/24
[asterisk]
enabled = true
maxretry = 3
#bantime = 30d
#action = iptables-allports[blocktype=DROP]
#action = route[blocktype=blackhole]
===== Запуск и отладка =====
# service fail2ban reload
# tail -f /var/log/fail2ban.log
===== Мониторинг и управление =====
# fail2ban-client status
# fail2ban-client status asterisk
# fail2ban-client set asterisk unbanip 172.16.1.150
# tail -f /var/log/fail2ban.log
===== Интеграция fail2ban и cisco log =====
* Резервное копирование конфигурации
# cat /etc/fail2ban/jail.d/cisco-change-config.conf
[cisco-change-config]
enabled = true
maxretry = 1
bantime = 30
filter = cisco-change-config
logpath = /var/log/cisco.log
action = cisco-backup-config
# cat /etc/fail2ban/filter.d/cisco-change-config.conf
[Definition]
failregex = .*Configured from.*
# cat /etc/fail2ban/action.d/cisco-backup-config.conf
[Definition]
actionban = /usr/bin/sshpass -p cisco /usr/bin/scp :running-config /srv/tftp/-running-config
cd /srv/tftp/
/usr/bin/git add *
/usr/bin/git --no-optional-locks status | grep 'modified\|deleted\|new file' | /usr/bin/git commit -a -F -
===== Интеграция fail2ban и snort =====
* [[https://github.com/frankiejol/snortban|frankiejol/snortban]]
* Сервис SNORT [[Сервис SNORT#Копирование alert_unified2 в syslog]]
# cat /etc/fail2ban/jail.d/snort_jail.conf
[snort]
enabled = true
bantime = 300
filter = snort_filter
maxretry = 3
logpath = /var/log/auth.log
#action = mail-admin
#action = iptables-allports
#action = iptables-allports-forward
#action = cisco-acl
# cat /etc/fail2ban/filter.d/snort_filter.conf
[Definition]
failregex = .*snort.*Priority: 1.*} .*
# .*snort.*Priority: 2.*} .*
#failregex = .*Original Client IP: .*
==== Уведомление по email ====
# cat /etc/fail2ban/action.d/mail-admin.conf
[Definition]
actionban = printf %%b "Hi,\n
Ban this
Regards,\n
Fail2Ban"|mail -s "[Fail2Ban] Ban "
actionunban = printf %%b "Hi,\n
Unban this
Regards,\n
Fail2Ban"|mail -s "[Fail2Ban] Unban "
[Init]
name = mail-admin
dest = student
* [[#Запуск и отладка]]
==== Блокировка через iptables ====
# cp /etc/fail2ban/action.d/iptables-allports.conf /etc/fail2ban/action.d/iptables-allports-forward.conf
# cat /etc/fail2ban/action.d/iptables-allports-forward.conf
...
before = iptables-common-forward.conf
...
# cp /etc/fail2ban/action.d/iptables-common.conf /etc/fail2ban/action.d/iptables-common-forward.conf
# cat /etc/fail2ban/action.d/iptables-common-forward.conf
...
chain = FORWARD
...
* [[#Запуск и отладка]]
==== Блокировка через cisco acl ====
server# rsh router show access-lists
# cat /root/cisco-acl-deny.sh
#!/bin/sh
fail2ban-client status snort | grep Banned | cut -d':' -f2 | tr -s ' ' | tr " " "\n" |
while read ip
do
test -z "$ip" && continue
echo " deny ip host $ip any"
done
# cat /root/cisco-acl-permit.txt
permit tcp any host 192.168.X.10 eq 80
permit tcp any host 192.168.X.10 eq 22
permit icmp any 192.168.0.0 0.0.255.255
permit ip any host 172.16.1.X
permit udp any any
permit tcp any any established
deny ip any any ! log
end
# cat /root/cisco-change-firewall.sh
#!/bin/sh
cat > /srv/tftp/firewall.acl <> /srv/tftp/firewall.acl
cat /root/cisco-acl-permit.txt >> /srv/tftp/firewall.acl
#/usr/bin/rcp /srv/tftp/firewall.acl router:running-config
#/usr/bin/snmpset -c write -v2c router .1.3.6.1.4.1.9.2.1.53.192.168.X.10 string "firewall.acl"
# cat /etc/fail2ban/action.d/cisco-acl.conf
[Definition]
actionban = /root/cisco-change-firewall.sh
actionunban = /root/cisco-change-firewall.sh
# if atack from DNS)
#actionunban = echo /root/cisco-change-firewall.sh | at now + 1 min
* [[#Запуск и отладка]]
===== Отладка собственных фильтров =====
# fail2ban-regex /var/log/tmp_file.log /etc/fail2ban/filter.d/tmp_file_filter.conf
# cat action.d/tmp_file_action.conf
[Definition]
actionban = echo "`date` f2ban detect ip: " >> /tmp/file_action.log
===== Дополнительные материалы =====
==== Asterisk logs only the local IP ====
* [[http://www.tutorials.makkugasho.com/2014/02/21/asterisk-11-5-fail2ban/|Asterisk 11.5 + Fail2Ban]]
==== Аsterisk failregex от Владимира Блинова ====
# less filter.d/asterisk.conf
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf
[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for ':.*' - Wrong password
NOTICE.* .*: Registration from '.*' failed for ':.*' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for ':.*' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for ':.*' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for ':.*' - Device does not match ACL
NOTICE.* .*: Registration from '.*' failed for ':.*' - Peer is not supposed to register
NOTICE.* .*: Registration from '.*' failed for ':.*' - ACL error (permit/deny)
NOTICE.* .*: Registration from '.*' failed for ':.*' - Device does not match ACL
NOTICE.* .*: Registration from '\".*\".*' failed for ':.*' - No matching peer found
NOTICE.* .*: Registration from '\".*\".*' failed for ':.*' - Wrong password
NOTICE.* failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' \(from \)
NOTICE.* .*: Host failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@.*
NOTICE.* .*: failed to authenticate as '.*'
NOTICE.* .*: tried to authenticate with nonexistent user '.*'
VERBOSE.*SIP/-.*Received incoming SIP connection from unknown peer
NOTICE.* .*: Sending fake auth rejection for device.* \(:.*\)
NOTICE.* .*: Sending fake auth rejection for device .*\;tag=.* \(:.*\)
NOTICE.* .*: Failed to authenticate device .*\;tag=.* \(:.*\)
NOTICE.* .*: Sending fake auth rejection for device.* \(:.*\)
NOTICE.* .*: Sending fake auth rejection for device .*\;tag=.* \(:.*\)
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
==== Аsterisk failregex от Стрельникова Романа ====
failregex = SECURITY.* SecurityEvent="FailedACL".*RemoteAddress=".+?/.+?//.+?".*
SECURITY.* SecurityEvent="InvalidAccountID".*RemoteAddress=".+?/.+?//.+?".*
SECURITY.* SecurityEvent="ChallengeResponseFailed".*RemoteAddress=".+?/.+?//.+?".*
SECURITY.* SecurityEvent="InvalidPassword".*RemoteAddress=".+?/.+?//.+?".*