Proteggere una macchina Linux con fail2ban - Revision history

Gabriele.vivinetto at 16:49, 19 July 2016

2016-07-19T16:49:45Z

@@ Line 60: / Line 60: @@
 * Guardare i log:
   sudo tail -f /var/log/fail2ban.log
 =Filtro customizzato per apache 404=

Gabriele.vivinetto: /* Configurazione parametri generali */

2016-07-19T15:38:01Z

Configurazione parametri generali

← Older revision		Revision as of 15:38, 19 July 2016
Line 56:		Line 56:

	* Ricaricare		* Ricaricare
	sudo ~~invoke-rc.d~~ fail2ban reload		sudo systemctl restart fail2ban reload

	* Guardare i log:		* Guardare i log:
	sudo tail -f /var/log/fail2ban.log		sudo tail -f /var/log/fail2ban.log

	=Filtro customizzato per apache 404=		=Filtro customizzato per apache 404=

Gabriele.vivinetto at 10:20, 9 July 2014

2014-07-09T10:20:01Z

@@ Line 157: / Line 157: @@
   sudo invoke-rc.d fail2ban restart
 =Riferimenti=
 *[http://guide.debianizzati.org/index.php/Fail2ban Fail2ban - Guide@Debianizzati.Org]

Gabriele.vivinetto at 12:31, 11 January 2013

2013-01-11T12:31:26Z

← Older revision		Revision as of 12:31, 11 January 2013
Line 160:		Line 160:
	*[http://guide.debianizzati.org/index.php/Fail2ban Fail2ban - Guide@Debianizzati.Org]		*[http://guide.debianizzati.org/index.php/Fail2ban Fail2ban - Guide@Debianizzati.Org]
	*[http://blog.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/ Automated Banning of Script Kiddies with fail2ban \| Barbary Codes and Data]		*[http://blog.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/ Automated Banning of Script Kiddies with fail2ban \| Barbary Codes and Data]
			*[http://www.the-art-of-web.com/system/fail2ban-log/ Monitoring the fail2ban log < System \| The Art of Web]
			*[http://whyscream.net/wiki/index.php/Fail2ban_monitoring_Fail2ban Fail2ban monitoring Fail2ban - Whyscream]

Gabriele.vivinetto at 12:30, 11 January 2013

2013-01-11T12:30:51Z

@@ Line 1: / Line 1: @@
 * Installare fail2ban
   sudo apt-get install fail2ban
@@ Line 30: / Line 31: @@
 </pre>
 * Inserire i paramteri da cambiare in
   sudoedit /etc/fail2ban/jail.local
@@ Line 36: / Line 38: @@
 * In particolare:
   ignoreip = 127.0.0.1 1.2.3.4 5.6.7.8 9.10.11.12/24
   bantime  = 300
   maxretry = 9
   destemail = recipient@example.com
 * Abilitare le sezioni interessate mettendo
   enabled = true
@@ Line 67: / Line 77: @@
 <pre>
 [apache-404]
 enabled = true
 port = http,https
@@ Line 101: / Line 112: @@
 </pre>
 =Riferimenti=
 *[http://guide.debianizzati.org/index.php/Fail2ban Fail2ban - Guide@Debianizzati.Org]
 *[http://blog.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/ Automated Banning of Script Kiddies with fail2ban | Barbary Codes and Data]

Gabriele.vivinetto: Created page with "* Installare fail2ban sudo apt-get install fail2ban * Di default crea già delle chain, in base ai pacchetti installati: sudo iptables -L -n

 Chain INPUT (policy ACCEPT) …"

2013-01-10T19:31:51Z

Created page with "* Installare fail2ban sudo apt-get install fail2ban * Di default crea già delle chain, in base ai pacchetti installati: sudo iptables -L -n <pre> Chain INPUT (policy ACCEPT) …"

New page

* Installare fail2ban
sudo apt-get install fail2ban

* Di default crea già delle chain, in base ai pacchetti installati:
sudo iptables -L -n
<pre>
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-ssh tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 22
fail2ban-pureftpd tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 21
fail2ban-dovecot-pop3imap tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 110,995,143,993

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain fail2ban-dovecot-pop3imap (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-pureftpd (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-ssh (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
</pre>

* Inserire i paramteri da cambiare in
sudoedit /etc/fail2ban/jail.local

:r /etc/fail2ban/jail.conf

* In particolare:
ignoreip = 127.0.0.1 1.2.3.4 5.6.7.8 9.10.11.12/24
bantime = 300
maxretry = 9

destemail = recipient@example.com

* Abilitare le sezioni interessate mettendo
enabled = true

* Ricaricare
sudo invoke-rc.d fail2ban reload

* Guardare i log:
sudo tail -f /var/log/fail2ban.log

=Filtro customizzato per apache 404=
* Se si vogliono bloccare anche i bot che non trovano files cercnado vulnerabilità, inserire
sudoedit /etc/fail2ban/filter.d/apache-404.conf

<pre>
[Definition]
failregex = <HOST> .* 404 [0-9]+
#(?P<HOST>[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}) .+ 404 [0-9]+.$
ignoreregex = favicon\.ico
</pre>

* Abilitarlo:
sudoedit /etc/fail2ban/jail.local

<pre>
[apache-404]
enabled = true
port = http,https
filter = apache-404
logpath = /var/log/apache*/*access.log
bantime = 300
findtime = 600
maxretry = 9
</pre>

* Testare la regola con
sudo fail2ban-regex /var/log/apache2/error.log /etc/fail2ban/filter.d/apache-404.conf

* Riavviare e testare
sudo invoke-rc.d fail2ban restart

* Se si vuol testare error.log:
#failregex = [[]client <HOST>[]] File does not exist: .*

* Per vedere quanti host sono bannati:
sudo fail2ban-client status apache-404

<pre>
Status for the jail: apache-404
|- filter
| |- File list: /var/log/apache2/other_vhosts_access.log /var/log/apache2/access.log
| |- Currently failed: 130
| `- Total failed: 412
`- action
|- Currently banned: 11
| `- IP list: 64.27.50.50 69.160.56.137 87.104.210.109 91.121.220.8 91.236.74.125 46.4.55.227 192.95.1.132 87.98.143.72 84.112.211.204 82.20.121.210 82.40.171.5
`- Total banned: 15

</pre>

=Riferimenti=
*[http://guide.debianizzati.org/index.php/Fail2ban Fail2ban - Guide@Debianizzati.Org]
*[http://blog.barbarycodes.com/2010/10/06/automated-banning-of-script-kiddies-with-fail2ban/ Automated Banning of Script Kiddies with fail2ban | Barbary Codes and Data]