Fail2ban

Services Réseaux

basé sur: Fail2ban sur FreeBSD

vim /usr/local/etc/ipfw.rules
# Initial setting
/bin/sh /etc/rc.firewall open
 
# fail2ban IPs
if ! ipfw table 1 info > /dev/null 2>&1; then
  ipfw table 1 create
  ipfw table 1 flush
fi
ipfw add 1 deny ip from "table(1)" to me

sysrc firewall_enable="YES"
sysrc firewall_type="open"
sysrc firewall_script="/usr/local/etc/ipfw.rules

service ipfw restart

pkg install py36-fail2ban

vim /usr/local/etc/fail2ban/action.d/ipfw-table.local
 
# Fail2Ban configuration file
#
# Author: Nick Munger
# Modified by: Cyril Jaquier
# Modified by: Kevin Lyda
[Definition]
 
actionstart =
actionstop =
actioncheck =
actionban = ipfw table 1 add <ip>
actionunban = ipfw table 1 delete <ip>

• analyse du fichier /var/log/auth.log
• Si 3 tentatives ratées de login ou password sur une connexion ssh
  • blocage de l'adresse ip pour une durée de 1 an

vim /usr/local/etc/fail2ban/jail.local
 
[DEFAULT]
ignoreip = 127.0.0.1/8
 
# JAILS
[sshd]
enabled = true
mode = aggressive
action = ipfw-table[name=SSH,port=ssh,protocol=tcp]
logpath = /var/log/auth.log
findtime = 600
maxretry = 3
 
# banni pour 1 an
bantime = 31536000

cat /usr/local/etc/fail2ban/action.d/ipfw-table.local

service fail2ban restart

# fail2ban-client status
# fail2ban-client status [Nom du jail]
fail2ban-client status sshd

# fail2ban-client set [nom du jail] unbanip [IP concerne]
fail2ban-client set sshd unbanip 51.83.216.212

# fail2ban-client set [nom du jail] banip [IP a  bannir]
fail2ban-client set sshd banip 51.83.216.212

Services Réseaux