Debian Jessie stable contain old version of fail2ban, i.e. fail2Ban v0.8.13 (Debian 8.6). This version has reach end of life cycle from its developer. Current version (in active) development is version 0.10. Debian Jessie in SID (unstable) has version 0.9.5-1. We are going to use this version on our production server.
Our /etc/apt/sources.list, we don't add any SID repository to our sources.
deb http://kambing.ui.ac.id/debian/ jessie maindeb-src http://kambing.ui.ac.id/debian/ jessie maindeb http://security.debian.org/ jessie/updates maindeb-src http://security.debian.org/ jessie/updates main#backportdeb http://ftp.debian.org/debian jessie-backports main
Before download and install fail2ban, install all required package from this article.
Download fail2ban 0.9.5-1 installer from SID directly from main pool
or from its mirror (choose your closest one)
Use wget to retrieve fail2ban 0.9.5-1 installer
# wget http://kambing.ui.ac.id/debian/pool/main/f/fail2ban/fail2ban_0.9.5-1_all.deb
If you are not confidence to use "unstable" version use fail2ban 0.9.3-1 from testing
Remove existing fail2ban
# apt-get --purge remove fail2ban
You can now start to install fail2ban 0.9.5-1
# dpkg -i fail2ban_0.9.5-1_all.deb(Reading database ... 109167 files and directories currently installed.)Preparing to unpack fail2ban_0.9.5-1_all.deb ...Unpacking fail2ban (0.9.5-1) over (0.9.5-1) ...dpkg: dependency problems prevent configuration of fail2ban: fail2ban depends on python3:any (>= 3.3.2-2~).dpkg: error processing package fail2ban (--install): dependency problems - leaving unconfiguredProcessing triggers for systemd (215-17+deb8u5) ...Processing triggers for man-db (2.7.0.2-5) ...Errors were encountered while processing: fail2ban
It will ask you to install python python3. It's file and safe, your default python still 2.7. Run this command to fix it.
# apt-get -f install...# python --versionPython 2.7.9
Create a new action in /etc/fail2ban/action.d/iptables-ipset-proto4-allports.conf
# Fail2Ban configuration file# Original: iptables-ipset-proto4.conf (Author: Daniel Black)# Modified: IGAM Muliarsa## Tested on: Debian 8.6# ipset version: ipset v6.23, protocol version: 6[INCLUDES]before = iptables-common.conf[Definition]# Option: actionstart# Notes.: command executed once at the start of Fail2Ban.# Values: CMD#actionstart = ipset --create f2b-<name> iphash <iptables> -I <chain> -m set --match-set f2b-<name> src -j <blocktype># Option: actionstop# Notes.: command executed once at the end of Fail2Ban# Values: CMD#actionstop = <iptables> -D <chain> -m set --match-set f2b-<name> src -j <blocktype> ipset --flush f2b-<name> ipset --destroy f2b-<name># Option: actionban# Notes.: command executed when banning an IP. Take care that the# command is executed with Fail2Ban user rights.# Tags: See jail.conf(5) man page# Values: CMD#actionban = ipset --test f2b-<name> <ip> || ipset --add f2b-<name> <ip># Option: actionunban# Notes.: command executed when unbanning an IP. Take care that the# command is executed with Fail2Ban user rights.# Tags: See jail.conf(5) man page# Values: CMD#actionunban = ipset --test f2b-<name> <ip> && ipset --del f2b-<name> <ip>[Init]
You need to enable configure /etc/fail2ban/fail.conf and enabling ipset
...# consider low maxretry and a long bantimebantime = 600...maxretry = 5...[sshd]port = sshlogpath = %(sshd_log)sbackend = %(sshd_backend)senabled = truefilter = sshdaction = iptables-ipset-proto4[name=sshd]...[sshd-ddos]# This jail corresponds to the standard configuration in Fail2ban.# The mail-whois action send a notification e-mail with a whois request# in the body.port = sshlogpath = %(sshd_log)sbackend = %(sshd_backend)senabled = truefilter = sshdaction = iptables-ipset-proto4[name=sshd-dos]...[proftpd]port = ftp,ftp-data,ftps,ftps-datalogpath = %(proftpd_log)sbackend = %(proftpd_backend)senabled = truefilter = proftpdaction = iptables-ipset-proto4-allports[name=proftpd]...[postfix]port = smtp,465,submissionlogpath = %(postfix_log)sbackend = %(postfix_backend)senabled = truefilter = postfixaction = iptables-ipset-proto4[name=postfix, port="25,465,993,995,465,143,110"]...[postfix-sasl]port = smtp,465,submission,imap3,imaps,pop3,pop3s# You might consider monitoring /var/log/mail.warn instead if you are# running postfix since it would provide the same log lines at the# "warn" level but overall at the smaller filesize.logpath = %(postfix_log)sbackend = %(postfix_backend)senabled = truefilter = postfix-saslaction = iptables-ipset-proto4[name=postfix-sasl, port="25,465,993,995,465,143,110"]...[dovecot]port = pop3,pop3s,imap,imaps,submission,465,sievelogpath = %(dovecot_log)sbackend = %(dovecot_backend)senabled = truefilter = dovecotaction = iptables-ipset-proto4[name=dovecot, port="25,465,993,995,465,143,110"]...
Note: you need to define name in iptables-ipset-proto4[] to make it work properly
after Restart your fail2ban
# /etc/init.d/fail2ban restart...# /etc/init.d/fail2ban status● fail2ban.service - Fail2Ban Service Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled) Active: active (running) since Thu 2016-10-06 12:10:29 WIB; 4min 24s ago Docs: man:fail2ban(1) Process: 24350 ExecStop=/usr/bin/fail2ban-client stop (code=exited, status=0/SUCCESS) Process: 24358 ExecStart=/usr/bin/fail2ban-client -x start (code=exited, status=0/SUCCESS) Main PID: 24361 (fail2ban-server) CGroup: /system.slice/fail2ban.service └─24361 /usr/bin/python3 /usr/bin/fail2ban-server -s /var/run/fail...Oct 06 12:10:29 mars fail2ban-client[24358]: 2016-10-06 12:10:29,293 fail2ba...5Oct 06 12:10:29 mars fail2ban-client[24358]: 2016-10-06 12:10:29,294 fail2ba...eOct 06 12:10:29 mars systemd[1]: Started Fail2Ban Service.Hint: Some lines were ellipsized, use -l to show in full.
You can enable other fail2ban service such as apache, ftp, etc.
If you need to latest version of fail2ban, download and install it from source https://github.com/fail2ban/fail2ban and manually configure its service.
I add some regex filter here if you want to use.
No comments:
Post a Comment