first commit
This commit is contained in:
denis
@@ -0,0 +1,71 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
|
||||
# made active on all ports from original iptables.conf
|
||||
#
|
||||
# $Revision$
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed once at the start of Fail2Ban.
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = iptables -N fail2ban-<name>
|
||||
iptables -A fail2ban-<name> -j RETURN
|
||||
iptables -I <chain> -p <protocol> -j fail2ban-<name>
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed once at the end of Fail2Ban
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = iptables -D <chain> -p <protocol> -j fail2ban-<name>
|
||||
iptables -F fail2ban-<name>
|
||||
iptables -X fail2ban-<name>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <time> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <time> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
|
||||
|
||||
[Init]
|
||||
|
||||
# Defaut name of the chain
|
||||
#
|
||||
name = default
|
||||
|
||||
# Option: protocol
|
||||
# Notes.: internally used by config reader for interpolations.
|
||||
# Values: [ tcp | udp | icmp | all ] Default: tcp
|
||||
#
|
||||
protocol = tcp
|
||||
|
||||
# Option: chain
|
||||
# Notes specifies the iptables chain to which the fail2ban rules should be
|
||||
# added
|
||||
# Values: STRING Default: INPUT
|
||||
chain = INPUT
|
||||
|
||||
@@ -0,0 +1,82 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
# Modified by Yaroslav Halchenko for multiport banning
|
||||
# $Revision$
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: blocktype
|
||||
# Note: This is what the action does with rules. This can be any jump target
|
||||
# as per the iptables man page (section 8). Common values are DROP
|
||||
# REJECT, REJECT --reject-with icmp-port-unreachable
|
||||
# Values: STRING
|
||||
#blocktype = REJECT --reject-with icmp-port-unreachable
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed once at the start of Fail2Ban.
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = iptables -N fail2ban-<name>
|
||||
iptables -A fail2ban-<name> -j RETURN
|
||||
iptables -I <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed once at the end of Fail2Ban
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
|
||||
<iptables> -F fail2ban-<name>
|
||||
iptables -X fail2ban-<name>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
|
||||
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <time> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <time> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
|
||||
|
||||
[Init]
|
||||
|
||||
# Defaut name of the chain
|
||||
#
|
||||
name = default
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = ssh
|
||||
|
||||
# Option: protocol
|
||||
# Notes.: internally used by config reader for interpolations.
|
||||
# Values: [ tcp | udp | icmp | all ] Default: tcp
|
||||
#
|
||||
protocol = tcp
|
||||
|
||||
# Option: chain
|
||||
# Notes specifies the iptables chain to which the fail2ban rules should be
|
||||
# added
|
||||
# Values: STRING Default: INPUT
|
||||
chain = INPUT
|
||||
@@ -0,0 +1,14 @@
|
||||
# action publisher
|
||||
[Definition]
|
||||
actionstart =
|
||||
#echo "$(date '+%%Y-%%m-%%d %%T') fail2ban.actions \t\t[mqtt_publisher] start" >> /var/log/fail2ban.log
|
||||
|
||||
actioncheck =
|
||||
|
||||
actionban = /etc/fail2ban/action.d/f2b_mqtt_action_publisher.py "{\"action\":\"<action>\",\"ip\": \"<ip>\", \"time\": \"<time>\", \"name\": \"<name>\", \"port\": \"<F-DPT>\", \"bantime\": \"<bantime>\"}"
|
||||
#echo "$(date '+%%Y-%%m-%%d %%T') [mqtt-publisher] {\"action\":\"<action>\",\"ip\": \"<ip>\", \"time\": \"<time>\", \"name\": \"<name>\", \"port\": \"<F-DPT>\", \"bantime\": \"<bantime>\"}" >> /var/log/fail2ban.log
|
||||
|
||||
actionunban =
|
||||
|
||||
[Init]
|
||||
init = Mqtt publisher loaded
|
||||
@@ -0,0 +1,59 @@
|
||||
#!/usr/bin/python3
|
||||
'''
|
||||
Created on 20 mai 2020
|
||||
|
||||
@author: denis@miraceti.net
|
||||
'''
|
||||
import sys, json, uuid, datetime
|
||||
import paho.mqtt.publish as publish
|
||||
|
||||
#HOST = 'broker.emqx.io'
|
||||
#PORT = 1883
|
||||
#AUTH = dict(username='emqx', password='public')
|
||||
|
||||
HOST = "127.0.0.1"
|
||||
PORT = 1883
|
||||
AUTH = dict(username='fail2ban', password='banishing')
|
||||
|
||||
LOG_FILE = '/var/log/fail2ban.log'
|
||||
|
||||
nodeid = uuid.getnode()
|
||||
node_type = 'fail2ban'
|
||||
base_topic = '%s/%s' % (node_type, nodeid, )
|
||||
mqtt_publish_params = dict(
|
||||
qos=0,
|
||||
retain=False,
|
||||
hostname=HOST,
|
||||
port=PORT,
|
||||
keepalive=60,
|
||||
auth=AUTH,
|
||||
client_id='%s_%s'% (node_type, nodeid),
|
||||
)
|
||||
|
||||
|
||||
def print_message(message):
|
||||
try:
|
||||
with open(LOG_FILE, 'a') as f:
|
||||
f.write('{} [MQTT PUBLISHER] {}'.format(datetime.datetime.now(), message))
|
||||
except Exception as e:
|
||||
print("fai2ban mqtt error", e)
|
||||
|
||||
|
||||
def publish_message(topic, **payload):
|
||||
try:
|
||||
message = json.dumps(payload)
|
||||
publish.single(base_topic + topic, message, **mqtt_publish_params)
|
||||
except Exception as e:
|
||||
print_message("publish_message error {}".format(e))
|
||||
|
||||
|
||||
def main():
|
||||
try:
|
||||
payload = json.loads(sys.argv[1])
|
||||
publish_message('/jail', node=nodeid, **payload)
|
||||
except Exception as e:
|
||||
print_message("main error %s".format(e))
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Nicolargo
|
||||
#
|
||||
[Definition]
|
||||
|
||||
# Option: failregex
|
||||
# Filter Ban in the fail2ban.log
|
||||
|
||||
failregex = .*\ Ban\ <HOST>
|
||||
|
||||
# Option: ignoreregex
|
||||
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
||||
# Values: TEXT
|
||||
#
|
||||
ignoreregex =
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Nicolargo
|
||||
#
|
||||
[Definition]
|
||||
|
||||
# Option: failregex
|
||||
# Filter multi-ban in the fail2ban.log
|
||||
|
||||
failregex = .*\[multi-ban\]\ Ban\ <HOST>
|
||||
|
||||
# Option: ignoreregex
|
||||
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
||||
# Values: TEXT
|
||||
#
|
||||
ignoreregex =
|
||||
@@ -0,0 +1,26 @@
|
||||
[INCLUDES]
|
||||
[Definition]
|
||||
#stop portscanning
|
||||
#
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failures messages in the logfile. The
|
||||
# host must be matched by a group named "host". The tag "<HOST>" can
|
||||
# be used for standard IP/hostname matching and is only an alias for
|
||||
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
|
||||
# Notes: Looks for attempts on ports not open in your firewall. Expects the
|
||||
# iptables logging utility to be used. Add the following to your iptables
|
||||
# config, as the last item before you DROP or REJECT:
|
||||
# -A <chain_name> -j LOG --log-prefix "[IPTABLES DROP] : " --log-level 5 --log-ip-options --log-tcp-options --log-tcp-sequence
|
||||
# This will place a notice in /var/log/messages about any attempt on a port that isn't open.
|
||||
#
|
||||
#Sep 7 03:28:39 orion kernel: [IPTABLES DROP] : IN=eth0 OUT= MAC=e8:40:f2:ec:d7:6d:6c:9c:ed:ba:ec:40:08:00
|
||||
#SRC=171.34.9.13 DST=142.4.213.118 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=51120 DF PROTO=TCP SPT=1682 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0
|
||||
#
|
||||
failregex = .* \[IPTABLES DROP\] .* SRC=<HOST> DST=<F-DST>\S+</F-DST> .* SPT=<F-SPT>\S+</F-SPT> DPT=<F-DPT>\d+</F-DPT> .*
|
||||
|
||||
# Option: ignoreregex
|
||||
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
||||
# Values: TEXT
|
||||
#
|
||||
ignoreregex =
|
||||
|
||||
@@ -0,0 +1,29 @@
|
||||
#
|
||||
[DEFAULT]
|
||||
ignoreip = 127.0.0.0/8 10.8.10.0/24
|
||||
findtime = 2m
|
||||
bantime = 10m
|
||||
maxretry = 3
|
||||
destemail = admin@miraceti.net
|
||||
mta = mail
|
||||
action = %(action_)s
|
||||
banaction = f2b-iptables-multiport
|
||||
f2b-mqtt-action-publisher[action=NOTICE]
|
||||
banaction_allports = f2b-iptables-allports
|
||||
f2b-mqtt-action-publisher[action=NOTICE]
|
||||
|
||||
# JAILS
|
||||
|
||||
[portscan]
|
||||
enabled = false
|
||||
filter = portscan
|
||||
logpath = /var/log/messages
|
||||
action = f2b-iptables-multiport
|
||||
f2b-mqtt-action-publisher[action=INFO]
|
||||
findtime = 2m
|
||||
bantime = 30
|
||||
maxretry = 1
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user