|
Rozmiar: 6270
Komentarz:
|
Rozmiar: 1801
Komentarz: + katalog na bazę danych sqlite
|
| Usunięcia zostały oznaczone w ten sposób. | Dodatki zostały oznaczone w ten sposób. |
| Linia 30: | Linia 30: |
| === fail2ban.conf === {{{#!diff numbers=off --- fail2ban.conf.orig 2010-02-25 15:00:00.000000000 +0100 +++ fail2ban.conf 2010-02-25 14:52:22.000000000 +0100 @@ -22,7 +22,7 @@ # Only one log target can be specified. # Values: STDOUT STDERR SYSLOG file Default: /var/log/fail2ban.log # -logtarget = /var/log/fail2ban.log +logtarget = /var/log/fail2ban/fail2ban.log # Option: socket # Notes.: Set the socket file. This is used to communicate with the daemon. Do |
=== action.d/ipfw.conf === {{{#!shell numbers=off cd /usr/local/etc/fail2ban/action.d patch -p < ~wtp/scripts/fail2ban/ipfw.conf.patch |
| Linia 45: | Linia 36: |
| === jail.conf === {{{#!diff numbers=off --- jail.conf.orig 2012-08-01 03:45:04.000000000 +0200 +++ jail.conf 2012-12-08 02:24:25.000000000 +0100 @@ -23,14 +23,14 @@ ignoreip = 127.0.0.1/8 # "bantime" is the number of seconds that a host is banned. -bantime = 600 +bantime = 1200 # A host is banned if it has generated "maxretry" during the last "findtime" # seconds. -findtime = 600 +findtime = 60 # "maxretry" is the number of failures before a host get banned. -maxretry = 3 +maxretry = 2 # "backend" specifies the backend used to get files modification. # Available options are "pyinotify", "gamin", "polling" and "auto". @@ -219,12 +219,11 @@ [ssh-ipfw] -enabled = false +enabled = true filter = sshd -action = ipfw[localhost=192.168.0.1] - sendmail-whois[name="SSH,IPFW", dest=you@example.com] +action = ipfw[localhost=37.59.20.105] logpath = /var/log/auth.log -ignoreip = 168.192.0.1 +ignoreip = 91.121.4.86 62.111.156.254 # These jails block attacks against named (bind9). By default, logging is off # with bind9 installation. You will need something like this: |
=== filter.d/ssh.conf === {{{#!shell numbers=off cd /usr/local/etc/fail2ban/filter.d cp bsd-sshd.conf sshd.conf patch -p < ~wtp/scripts/fail2ban/sshd.conf.patch |
| Linia 86: | Linia 43: |
| === action.d/ipfw.conf === {{{#!diff numbers=off --- ipfw.conf.orig 2012-08-01 03:45:04.000000000 +0200 +++ ipfw.conf 2012-12-08 02:14:46.000000000 +0100 @@ -12,14 +12,14 @@ # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = +actionstart = ipfw add 64000 deny ip from table\(22\) to any |
== Uruchomienie demona == {{{#!shell numbers=off mkdir -p /var/log/fail2ban/ /var/db/fail2ban echo 'fail2ban_enable="YES"' >> /etc/rc.conf echo 'fail2ban_flags="-x"' >> /etc/rc.conf |
| Linia 97: | Linia 49: |
| /usr/local/etc/rc.d/fail2ban start | |
| Linia 98: | Linia 51: |
| # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = +actionstop = ipfw delete 64000 # Option: actioncheck @@ -37,7 +37,7 @@ # <time> unix timestamp of the ban time # Values: CMD # -actionban = ipfw add deny tcp from <ip> to <localhost> <port> +actionban = ipfw table 22 add <ip> # Option: actionunban @@ -48,7 +48,7 @@ # <time> unix timestamp of the ban time # Values: CMD # -actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'` +actionunban = ipfw table 22 delete <ip> [Init] @@ -62,4 +62,4 @@ # Notes.: the local IP address of the network interface # Values: IP # -localhost = 127.0.0.1 +localhost = 37.59.20.105176.241.247.193 |
# powinno byc widac regule 64000 zawierajaca table(22) ipfw show |
| Linia 132: | Linia 54: |
| A następnie bsd-ipfw.conf przekopiować jako ipfw.conf === filter.d/ssh.conf === {{{#!diff numbers=off --- sshd.conf.orig 2008-05-12 10:31:56.000000000 +0200 +++ sshd.conf 2010-02-25 15:06:49.000000000 +0100 @@ -2,7 +2,7 @@ # # Author: Cyril Jaquier # -# $Revision: 663 $ +# $Revision: 728 $ # [INCLUDES] @@ -20,17 +20,20 @@ # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for -# (?:::f{4,6}:)?(?P<host>\S+) +# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Values: TEXT # -failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$ - ^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$ +failregex = ^%(__prefix_line)s(?:error: PAM: )?[A|a]uthentication (?:failure|error) for .* from <HOST>\s*$ + ^%(__prefix_line)sDid not receive identification string from <HOST>$ + ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$ + ^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$ ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$ ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$ ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$ ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$ ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$ - ^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT\s*$ + ^%(__prefix_line)sreverse mapping checking getaddrinfo for .* \[<HOST>\] .* POSSIBLE BREAK-IN ATTEMPT!$ + ^%(__prefix_line)sUser \S+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. }}} (tak naprawdę wystarczy skopiować bsd-sshd.conf jako sshd.conf). HOST |
Spis Treści
Konfiugracja fail2ban
W ports pojawił się bardzo fajny skrypt napisany w pythonie, który powoduje dopisywanie regułek blokujących dla adresów IP, które próbują atakować serwer.
Konfiguracja globalna
Konfiguracja globalna to dwa pliki (umieszczone w repozytorium CVS):
JAIL
Nie należy odnosić tego do mechanizmu jail(8). Jest to raczej sparowanie akcji oraz sposobu filtrowania wraz z ustawieniami, jaki plik logu należy przeglądać.
Akcje
Akcje (czyli co robić, jeżeli wystąpi zdarzenie) zapisane są w podkatalogu action.d/. Każda usługa (np. bsd-ipfw) jest zapisany w stosownym pliku .conf.
Filtry
Co należy filtrować (REGEXPy), których należy poszukiwać w logach, aby uruchomić akcję banowania.
Poprawki dla FreeBSD
Niestety fail2ban powstał głównie z myślą o Linuxie oraz iptables. Dlatego też trzeba odpowiednio połatać konfigurację specyficznie dla FreeBSD. Oto różnice (patche):
action.d/ipfw.conf
cd /usr/local/etc/fail2ban/action.d
patch -p < ~wtp/scripts/fail2ban/ipfw.conf.patch
filter.d/ssh.conf
cd /usr/local/etc/fail2ban/filter.d
cp bsd-sshd.conf sshd.conf
patch -p < ~wtp/scripts/fail2ban/sshd.conf.patch
Uruchomienie demona
mkdir -p /var/log/fail2ban/ /var/db/fail2ban
echo 'fail2ban_enable="YES"' >> /etc/rc.conf
echo 'fail2ban_flags="-x"' >> /etc/rc.conf
/usr/local/etc/rc.d/fail2ban start
# powinno byc widac regule 64000 zawierajaca table(22)
ipfw show