User Tools

Site Tools


сервис_fail2ban

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Last revision Both sides next revision
сервис_fail2ban [2021/11/17 16:17]
val [Установка]
сервис_fail2ban [2024/05/11 15:47]
val [Интеграция fail2ban и snort]
Line 6: Line 6:
  
   * [[https://​help.ubuntu.com/​community/​Fail2ban|Fail2ban]]   * [[https://​help.ubuntu.com/​community/​Fail2ban|Fail2ban]]
 +  * [[https://​bugs.launchpad.net/​ubuntu/​+source/​fail2ban/​+bug/​2055114|fail2ban is broken in 24.04 Noble]]
  
 <​code>​ <​code>​
 debian11# apt install iptables debian11# apt install iptables
 +debian12# apt install iptables rsyslog
  
 # apt install fail2ban # apt install fail2ban
 +
 +ubuntu24# wget https://​launchpad.net/​ubuntu/​+source/​fail2ban/​1.1.0-1/​+build/​28291332/​+files/​fail2ban_1.1.0-1_all.deb
 +ubuntu24# dpkg -i fail2ban_1.1.0-1_all.deb ​
 </​code>​ </​code>​
  
Line 30: Line 35:
 [sshd] [sshd]
 maxretry = 6 maxretry = 6
 +#ignoreip = 192.168.X.0/​24 192.168.100+X.0/​24
  
 [asterisk] [asterisk]
 enabled = true enabled = true
 maxretry = 3 maxretry = 3
 +#bantime = 30d
 +#action = iptables-allports[blocktype=DROP]
 +#action = route[blocktype=blackhole]
 </​code>​ </​code>​
  
Line 56: Line 65:
  
 ===== Интеграция fail2ban и cisco log ===== ===== Интеграция fail2ban и cisco log =====
 +
 +  * Резервное копирование конфигурации
 +
 <​code>​ <​code>​
 # cat /​etc/​fail2ban/​jail.d/​cisco-change-config.conf # cat /​etc/​fail2ban/​jail.d/​cisco-change-config.conf
Line 85: Line 97:
  
   * [[https://​github.com/​frankiejol/​snortban|frankiejol/​snortban]]   * [[https://​github.com/​frankiejol/​snortban|frankiejol/​snortban]]
 +  * Сервис SNORT [[Сервис SNORT#​Копирование alert_unified2 в syslog]]
  
 <​code>​ <​code>​
Line 93: Line 106:
 bantime ​    = 300 bantime ​    = 300
 filter ​     = snort_filter filter ​     = snort_filter
-maxretry ​   = 1+maxretry ​   = 3
 logpath ​    = /​var/​log/​auth.log logpath ​    = /​var/​log/​auth.log
 #​action ​     = mail-admin #​action ​     = mail-admin
 +#​action ​     = iptables-allports
 #​action ​     = iptables-allports-forward #​action ​     = iptables-allports-forward
 #​action ​     = cisco-acl #​action ​     = cisco-acl
Line 105: Line 119:
 failregex = .*snort.*Priority:​ 1.*} <​HOST>​.* failregex = .*snort.*Priority:​ 1.*} <​HOST>​.*
 #        .*snort.*Priority:​ 2.*} <​HOST>​.* #        .*snort.*Priority:​ 2.*} <​HOST>​.*
 +
 +#failregex = .*Original Client IP: <​HOST>​.*
 </​code>​ </​code>​
  
Line 129: Line 145:
 dest = student dest = student
 </​code>​ </​code>​
 +
 +  * [[#​Запуск и отладка]]
  
 ==== Блокировка через iptables ==== ==== Блокировка через iptables ====
Line 150: Line 168:
 </​code>​ </​code>​
  
 +  * [[#​Запуск и отладка]]
 ==== Блокировка через cisco acl ==== ==== Блокировка через cisco acl ====
  
 <​code>​ <​code>​
 +server# rsh router show access-lists
 +</​code><​code>​
 # cat /​root/​cisco-acl-deny.sh # cat /​root/​cisco-acl-deny.sh
 </​code><​code>​ </​code><​code>​
Line 172: Line 193:
  ​permit udp any any  ​permit udp any any
  ​permit tcp any any established  ​permit tcp any any established
- ​deny ​  ip any any log+ ​deny ​  ip any any log
 end end
 </​code><​code>​ </​code><​code>​
Line 201: Line 222:
 </​code>​ </​code>​
  
 +  * [[#​Запуск и отладка]]
 ===== Отладка собственных фильтров ===== ===== Отладка собственных фильтров =====
  
сервис_fail2ban.txt · Last modified: 2024/06/23 16:45 by val