{"id":107167,"date":"2020-11-02T02:07:29","date_gmt":"2020-11-01T19:07:29","guid":{"rendered":"https:\/\/www.harianaceh.co.id\/?p=107167"},"modified":"2022-10-06T04:23:45","modified_gmt":"2022-10-05T21:23:45","slug":"how-to-setup-fail2ban-intrusion-prevention-framework","status":"publish","type":"post","link":"https:\/\/www.harianaceh.co.id\/2020\/11\/02\/how-to-setup-fail2ban-intrusion-prevention-framework\/","title":{"rendered":"How to Setup Fail2ban (Intrusion Prevention Framework)"},"content":{"rendered":"

Introduction<\/h3>\n

Fail2ban<\/a> is an Intrusion Detection\/Prevention System (IDS\/IPS), a great tool that helps you keep \u201cunwanted\u201d guests at bay. It\u2019s mainly used to stop, prevent or slow down bruteforce attacks, but can be used to limit the number of requests per unit of time (backend, API,..).<\/p>\n

It scans\/monitor log files and bans IPs that show malicious signs, like too many password failures, probing, bruteforcing attempts, etc. You can specify which service and log to monitor, how many attempts per unit of time (second\/hour\u2026), define regex (regular expression) patterns, etc.<\/p>\n

Out of the box it comes with filters for various services: Apache, ssh, nginx, asterisk, proftp, mysql\u2026 Here we\u2019ll quickly go through Fail2ban setup.<\/p>\n

Fail2Ban Setup<\/h3>\n

Install process it is relatively straightforward.<\/p>\n

RedHat (CentOS)<\/h4>\n

Update, Install with EPEL repository:<\/p>\n

yum update<\/code> yum install epel-release<\/code>\r\nyum install fail2ban<\/code><\/pre>\n
Debian (Ubuntu)<\/h4>\n
Update & install:<\/p>\n
$ apt-get update\r\n$ apt-get install fail2ban\r\n<\/pre>\n
Fail2ban Configuration Files<\/h3>\n
Relevant File2Ban Configuration files and dirs:<\/p>\n
    \n
  • \/etc\/fail2ban\/filter.d\/: Contains predefined (regex) fail2ban filters<\/li>\n
  • \/etc\/fail2ban\/jail.conf: Not recommended to be updated, use custom jails<\/li>\n
  • \/etc\/fail2ban\/jail.local: Your customized Jails (or customisation.local)<\/li>\n
  • \/etc\/fail2ban\/fail2ban.conf: Main Configuration File<\/li>\n<\/ul>\n
    Fail2ban Definitions<\/h3>\n
    Before we continue, it\u2019s probably good idea to define what\u2019s what:<\/p>\n
      \n
    • filter<\/code>: a filter defines a regular expression which must match a pattern corresponding to a log-in failure or any other expression<\/li>\n
    • action<\/code>:\u00a0an action defines several commands which are executed at different moments<\/li>\n
    • jail<\/code>:\u00a0a jail is a combination of one filter and one or several actions.\u00a0Fail2ban<\/b><\/i>\u00a0can handle several jails at the same time<\/li>\n
    • client<\/code>:\u00a0refers to the script\u00a0fail2ban-client<\/b><\/li>\n
    • server<\/code>:\u00a0refers to the script\u00a0fail2ban-server<\/b><\/li>\n<\/ul>\n
      Fail2ban Server is multi-threaded, listens on a Unix socket for commands. Knows nothing about configuration files.<\/p>\n
      -b start in background\r\n-f start in foreground\r\n-s <FILE> socket path\r\n-x force execution of the server\r\n-h, --help display this help message\r\n-V, --version print the version\r\n<\/pre>\n
      Fail2ban Client is basically the frontend, operate the servers. Reads the configuration files, or accept individual commands via interactive mode.<\/p>\n
      -c <DIR> configuration directory\r\n-s <FILE> socket path\r\n-d dump configuration. For debugging\r\n-i interactive mode\r\n-v increase verbosity\r\n-q decrease verbosity\r\n-x force execution of the server\r\n-h, --help display this help message\r\n-V, --version print the version\r\n<\/pre>\n
      Examples:<\/p>\n
      $ fail2ban-client set loglevel 1\r\n$ fail2ban-client set logtarget STDERR\r\n\r\n$ fail2ban-client status\r\n|- Number of jails: 1\r\n`- Jail list: sshd\r\n\r\n$ fail2ban-client status sshd\r\nStatus for the jail: sshd\r\n|- Filter\r\n|  |- Currently failed: 2\r\n|  |- Total failed: 42635\r\n|  |- File list: \/var\/log\/auth.log\r\n`- Actions\r\n   |- Currently banned: 0\r\n   |- Total banned: 863\r\n   |- Banned IP list:\r\n<\/pre>\n
      Fail2ban Main Configuration<\/h3>\n
        \n
      • loglevel<\/code>: The level of detail that Fail2ban\u2019s logs provide:\n
          \n
        • 1 (error)<\/li>\n
        • 2 (warn)<\/li>\n
        • 3 (info)<\/li>\n
        • 4 (debug).<\/li>\n<\/ul>\n<\/li>\n
        • logtarget<\/code>: Logs actions into a specific file. The default value of\u00a0\/var\/log\/fail2ban.log<\/code>puts all logging into the defined file. Alternately, you can change the value to:\n
            \n
          • STDOUT<\/code>: output any data<\/li>\n
          • STDERR<\/code>: output any errors<\/li>\n
          • SYSLOG<\/code>: message-based logging<\/li>\n
          • FILE<\/code>: output to a file<\/li>\n<\/ul>\n<\/li>\n
          • socket<\/code>: The location of the socket file.<\/li>\n
          • pidfile<\/code>: The location of the PID file.<\/li>\n<\/ul>\n
            Fail2ban Jail Options<\/h3>\n
              \n
            • filter<\/code>\u00a0:\u00a0ame of the filter to be used by the jail to detect matches. Each single match by a filter increments the counter within the jail<\/li>\n
            • logpath<\/code>\u00a0:\u00a0Path to the log file which is provided to the filter<\/li>\n
            • maxretry<\/code>\u00a0:\u00a0Number of matches (i.e. value of the counter) which triggers ban action on the IP.<\/li>\n
            • bantime<\/code>\u00a0:\u00a0Duration (in seconds) for IP to be banned for. Negative number for \u201cpermanent\u201d ban.<\/li>\n
            • enabled<\/code>\u00a0: True or false. Defines if filter is turned on or not<\/li>\n
            • port<\/code>: The port used by the service<\/li>\n
            • ignoreip<\/code>\u00a0: IP(s) that should be ignored by fail2ban<\/li>\n
            • findtime<\/code>\u00a0: Time range fail2ban will pay attention to when looking at the logs.<\/li>\n
            • backend<\/code>\u00a0: Defines how fail2ban monitor logs. It will try pinotify, gaming and finaly pooling.<\/li>\n
            • destemail<\/code>: Address to send email notifications to<\/li>\n
            • sendername<\/code>\u00a0: From field for notification emails<\/li>\n
            • sender<\/code>: Email address from which Fail2ban will send emails.<\/li>\n
            • mta<\/code>\u00a0: MTA used to send notification mails<\/li>\n
            • protocol<\/code>\u00a0:<\/li>\n
            • banaction<\/code>\u00a0: Action to be used when ban is triggered. Check \/etc\/fail2ban\/action.d\/<\/li>\n<\/ul>\n
              Let\u2019s explain one example:<\/p>\n
              \/etc\/fail2ban\/jail.local\r\n\r\n[sshd]\r\nenabled = true\r\nport = ssh\r\nfilter = sshd\r\naction = iptables[name=SSH, port=ssh, protocol=tcp]\r\nlogpath = \/var\/log\/secure\r\nfindtime = 120\r\nmaxretry = 5\r\nbantime = 3600\r\n<\/pre>\n
              Log path can vary, adjust it on your system (OS). Based on rules above, we\u2019re monitoring SSH log (\/var\/log\/secure), and we\u2019re banning anyone (for 1 hour, 3600 seconds) who fails to log 5 times within 2 minutes (120 seconds). Rules are pretty straight forward. We\u2019ve specified \u201csshd\u201d filter, so if you go to \/etc\/fail2ban\/filter.d\/sshd.conf, you\u2019ll se a number of failregex rules, used to match login attempts from log file.<\/p>\n
              To whitelist (ignore) an IP, add them to the\u00a0ignoreip<\/code>\u00a0line:<\/p>\n
              ignoreip = 127.0.0.1\/8<\/pre>\n
              Note: Depending on the amount of traffic specific service has (website, wordpress, etc.) fail2ban can generate CPU concerns\/load.<\/div>\n
              Custom Fail2ban PhpMyAdmin filter (Jail & Regex)<\/h3>\n
              The best way to learn is to try and write your own filters. I\u2019ll show you an example for Custom Fail2ban PhpMyAdmin filter. First, we need the jail in our jail.local file:<\/p>\n
              [phpmyadmin]\r\n\r\nenabled = true\r\nport = http,https\r\nfilter = phpmyadmin\r\naction = iptables-multiport[name=PHPMYADMIN, port=\"http,https\", protocol=tcp]\r\nlogpath = \/var\/log\/nginx\/access.log\r\nbantime = 3600\r\nfindtime = 60\r\nmaxretry = 3<\/pre>\n
              Next we need that filter. Check your web server (Apache\/nginx) logs:<\/p>\n
              \/var\/log\/nginx\/access.log.1:121.169.192.227 - - [19\/Sep\/2018:01:41:23 +0000] \"GET \/phpmyadmin\/index.php?pma_username=root&pma_password=root&server=1 HTTP\/1.1\" 200 10050 \"-\" \"Mozilla\/5.0\"\r\n\/var\/log\/nginx\/access.log.1:121.169.192.227 - - [19\/Sep\/2018:01:41:23 +0000] \"GET \/phpmyadmin\/index.php?pma_username=root&pma_password=toor&server=1 HTTP\/1.1\" 200 10050 \"-\" \"Mozilla\/5.0\"\r\n\/var\/log\/nginx\/access.log.1:121.169.192.227 - - [19\/Sep\/2018:01:41:23 +0000] \"GET \/phpmyadmin\/index.php?pma_username=root&pma_password=r00t&server=1 HTTP\/1.1\" 200 10050 \"-\" \"Mozilla\/5.0\"<\/pre>\n
              The IP\u00a0121.169.192.227<\/code>\u00a0is trying to bruteforce its way in (well known malicious IP). We\u2019ll try to make their life a bit more difficult. Make a file in your \/etc\/fail2ban\/filter.d\/phpmyadmin.conf, and insert:<\/p>\n
              [Definition]\r\nfailregex = ^<HOST> -.*\"(GET|POST).*\/phpmyadmin\/index\\.php\\?pma_username=root&pma_password=.*$\r\nignoreregex =<\/pre>\n
              The above regex is matching the lines we\u2019ve seen in the logs. This will ban anyone for 1 hour if they\u00a0fail to login more than 3x in 60 seonds. When done, restart fail2ban:<\/p>\n
              $ service fail2ban restart<\/pre>\n
              or reload:<\/p>\n
              $ fail2ban-client reload phpmyadmin<\/pre>\n
              Fail2ban testing regex<\/h3>\n
              When you finish creating some filter it\u2019s good idea to test it before activating it. For that we have\u00a0fail2ban-regex<\/code>:<\/p>\n
              $ fail2ban-regex \/var\/log\/nginx\/access.log \/etc\/fail2ban\/filter.d\/phpmyadmin.conf\r\n\r\nRunning tests\r\n=============\r\n\r\nUse   failregex filter file : phpmyadmin, basedir: \/etc\/fail2ban\r\nUse         log file : \/var\/log\/nginx\/access.log\r\nUse         encoding : UTF-8\r\n\r\n\r\nResults\r\n=======\r\n\r\nFailregex: 56 total\r\n|-  #) [# of hits] regular expression\r\n|   1) [56] ^<HOST> -.*\"(GET|POST).*\/phpmyadmin\/index\\.php\\?pma_username=root&pma_password=.*$\r\n`-\r\n\r\nIgnoreregex: 0 total\r\n\r\nDate template hits:\r\n|- [# of hits] date format\r\n|  [4078] Day(?P<_sep>[-\/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\\.Microseconds)?(?: Zone offset)?\r\n`-\r\n\r\nLines: 4078 lines, 0 ignored, 56 matched, 4022 missed [processed in 0.33 sec]\r\nMissed line(s): too many to print.  Use --print-all-missed to print all 4022 lines<\/pre>\n
              We have a match. In case filter\/regex is wrong, we\u2019ll probably end up with no matches:<\/p>\n
              Lines: 3315 lines, 0 ignored, 0 matched, 3315 missed [processed in 0.23 sec]\r\nMissed line(s): too many to print. Use --print-all-missed to print all 3315 lines<\/pre>\n
              Fail2ban Email Alerts<\/h3>\n
              I didn\u2019t experiment with this much, but its probably worth mentioning that you have Email Alert option. Adjust email setings:<\/p>\n
                \n
              • destemail<\/code>: Destination Email address, where you would like to receive the emails.<\/li>\n
              • sendername<\/code>: Name under which the email will shows up.<\/li>\n
              • sender<\/code>: Email address from which Fail2ban will send emails.<\/li>\n<\/ul>\n
                Use fail2ban predefined actions.d\/sendmail-whois:<\/p>\n
                [sendmail]\r\nenabled = true\r\nfilter = sendmail\r\naction = iptables-multiport[name=sendmail, port=\"pop3,imap,smtp,pop3s,imaps,smtps\", protocol=tcp]\r\nsendmail-whois[name=sendmail, dest=user@domain.com]\r\nlogpath = \/var\/log\/maillog<\/pre>\n
                Another example:<\/p>\n
                [ssh]\r\nenabled  = true\r\nport     = ssh\r\nfilter   = sshd\r\naction   = iptables-multiport[name=ssh,port=[\"ssh\"|\u201d22,4422\u201d],protocol=tcp]\r\n         mail[name=SSH,dest=dstEmail@domain.com,sender=\"info@domain.com\"]\r\nlogpath  = \/var\/log\/auth.log\r\nmaxretry = 3\r\nbantime = 600<\/pre>\n
                Conclusion<\/h3>\n
                I hope we managed to clarify more than a few things with this Fail2ban setup tutorial. Fail2ban is a great IDS\/IPS tool, doing its job well. Depending on the traffic and\u00a0findtime<\/code>\u00a0span it can cause significant load on CPU. Personally I didn\u2019t experiance significant problems. If CPU load increases, try changing the\u00a0backend<\/code>\u00a0parameter to to pooling or similar. Experiment. Since fail2ban relies on log file parsing, it doesn\u2019t do anything to \u201cprevent\u201d initial attack, it only responds to predefined conditions and rules. It\u2019s actively maintaned and we\u2019re definitely recomending you to try it out.<\/p>\n","protected":false},"excerpt":{"rendered":"
                Fail2ban is an Intrusion Detection\/Prevention System (IDS\/IPS), a great tool that helps you keep \u201cunwanted\u201d guests at bay. It\u2019s mainly used to stop, prevent or slow down bruteforce attacks<\/p>\n","protected":false},"author":1,"featured_media":107175,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_disable_autopaging":true},"categories":[61,98452],"tags":[71190,92189,94048,94049,94783],"series":[],"class_list":["post-107167","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-teknologi","category-tutorial","tag-how-to","tag-tips","tag-fail2ban","tag-how-to-setup-fail2ban","tag-monitoring-system"],"_links":{"self":[{"href":"https:\/\/www.harianaceh.co.id\/aplikasi-api\/wp\/v2\/posts\/107167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.harianaceh.co.id\/aplikasi-api\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.harianaceh.co.id\/aplikasi-api\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.harianaceh.co.id\/aplikasi-api\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.harianaceh.co.id\/aplikasi-api\/wp\/v2\/comments?post=107167"}],"version-history":[{"count":0,"href":"https:\/\/www.harianaceh.co.id\/aplikasi-api\/wp\/v2\/posts\/107167\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.harianaceh.co.id\/aplikasi-api\/wp\/v2\/media\/107175"}],"wp:attachment":[{"href":"https:\/\/www.harianaceh.co.id\/aplikasi-api\/wp\/v2\/media?parent=107167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.harianaceh.co.id\/aplikasi-api\/wp\/v2\/categories?post=107167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.harianaceh.co.id\/aplikasi-api\/wp\/v2\/tags?post=107167"},{"taxonomy":"series","embeddable":true,"href":"https:\/\/www.harianaceh.co.id\/aplikasi-api\/wp\/v2\/series?post=107167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}