Fail2ban - Versionsgeschichte

Wulf: /* Shell script fwfail2ban */

2024-10-10T14:24:34Z

Shell script fwfail2ban

← Nächstältere Version		Version vom 10. Oktober 2024, 16:24 Uhr
Zeile 58:		Zeile 58:

	=Using IP sets instead of iptables rules=		=Using IP sets instead of iptables rules=
	==Difference between iptables and IP sets==
			=== Difference between iptables and IP sets ===
	By default Fail2Ban uses iptables rules to block IP addresses. These rules are processed sequentially and can therefore result in slow response time due to a large number of entries.		By default Fail2Ban uses iptables rules to block IP addresses. These rules are processed sequentially and can therefore result in slow response time due to a large number of entries.

Zeile 89:		Zeile 90:
	Since Linux Kernel 2.6 there is an option to use so-called IP sets to hold big amount of IP addresses in the memory. This technique uses hashtables to store and search IP adresses and is therefore much more efficient than parsing sequentially through the iptables rules.		Since Linux Kernel 2.6 there is an option to use so-called IP sets to hold big amount of IP addresses in the memory. This technique uses hashtables to store and search IP adresses and is therefore much more efficient than parsing sequentially through the iptables rules.

	==Shell script fwfail2ban==		=== Shell script '''''fwfail2ban''''' ===
	The following shell script '''''fwfail2ban''''' moves IP addresses from the iptables rules to an IP set:		The following shell script '''''fwfail2ban''''' moves IP addresses from the iptables rules to an IP set:
	<syntaxhighlight lang="bash" line="1">		<syntaxhighlight lang="bash" line="1">

Wulf am 10. Oktober 2024 um 14:23 Uhr

2024-10-10T14:23:00Z

← Nächstältere Version		Version vom 10. Oktober 2024, 16:23 Uhr
Zeile 58:		Zeile 58:

	=Using IP sets instead of iptables rules=		=Using IP sets instead of iptables rules=
	By default Fail2Ban uses iptables rules to block IP addresses.		==Difference between iptables and IP sets==
			By default Fail2Ban uses iptables rules to block IP addresses. These rules are processed sequentially and can therefore result in slow response time due to a large number of entries.

	Example:		Example:
Zeile 88:		Zeile 89:
	Since Linux Kernel 2.6 there is an option to use so-called IP sets to hold big amount of IP addresses in the memory. This technique uses hashtables to store and search IP adresses and is therefore much more efficient than parsing sequentially through the iptables rules.		Since Linux Kernel 2.6 there is an option to use so-called IP sets to hold big amount of IP addresses in the memory. This technique uses hashtables to store and search IP adresses and is therefore much more efficient than parsing sequentially through the iptables rules.

			==Shell script fwfail2ban==
	The following shell script '''''fwfail2ban''''' moves IP addresses from the iptables rules to an IP set:		The following shell script '''''fwfail2ban''''' moves IP addresses from the iptables rules to an IP set:
	<syntaxhighlight lang="bash" line="1">		<syntaxhighlight lang="bash" line="1">

Wulf am 10. Oktober 2024 um 14:03 Uhr

2024-10-10T14:03:48Z

← Nächstältere Version		Version vom 10. Oktober 2024, 16:03 Uhr
Zeile 93:		Zeile 93:
	#		#
	# Author: Frank Wulf		# Author: Frank Wulf
	# Version: 1.2 (~~2020~~-04-16)		# Version: 1.3 (2022-03-01)
	#		#
	# This program moves iptables entries created by fail2ban to		# This program moves iptables entries created by fail2ban to
Zeile 106:		Zeile 106:
	# 1.2 2020-04-16 Replace "DELETE from db" logic by "fail2ban unban --all"		# 1.2 2020-04-16 Replace "DELETE from db" logic by "fail2ban unban --all"
	# 1.3 2022-03-01 Add logic to handle ipsets reaching maximum number of elements		# 1.3 2022-03-01 Add logic to handle ipsets reaching maximum number of elements
	#

	# Get program name to be used as prefix		# Get program name to be used as prefix

Wulf: /* Using IP sets instead of iptables rules */

2022-03-01T17:31:01Z

Using IP sets instead of iptables rules

@@ Zeile 105: / Zeile 105: @@
 # 1.1   2019-04-19   Add DELETE command for new database table "bips"
 # 1.2   2020-04-16   Replace "DELETE from db" logic by "fail2ban unban --all"
+#
@@ Zeile 154: / Zeile 155: @@
      fi
      if [ $sw_ipset -eq 1 ]; then
        # Add IP address to ipset
        ipset add $pfx-$chain $ipaddr timeout $timeout 1>/dev/null 2>&1

Wulf am 16. April 2020 um 17:53 Uhr

2020-04-16T17:53:06Z

← Nächstältere Version		Version vom 16. April 2020, 19:53 Uhr
Zeile 168:		Zeile 168:
	rm $chn 1>/dev/null 2>&1		rm $chn 1>/dev/null 2>&1

	# "Unban" all IP addresses to clear iptables rules as the entries are now in the ~~ipset~~.		# "Unban" all IP addresses to clear iptables rules as the entries are now in the IP set.
	/usr/local/bin/fail2ban-client unban --all 1>/dev/null 2>&1		/usr/local/bin/fail2ban-client unban --all 1>/dev/null 2>&1

Wulf am 16. April 2020 um 17:49 Uhr

2020-04-16T17:49:40Z

← Nächstältere Version		Version vom 16. April 2020, 19:49 Uhr
Zeile 93:		Zeile 93:
	#		#
	# Author: Frank Wulf		# Author: Frank Wulf
	# Version: 1.1 (~~2019~~-04-19)		# Version: 1.2 (2020-04-16)
	#		#
	# This program moves iptables entries created by fail2ban to		# This program moves iptables entries created by fail2ban to
Zeile 104:		Zeile 104:
	# 1.0 2017-10-04 Initial release		# 1.0 2017-10-04 Initial release
	# 1.1 2019-04-19 Add DELETE command for new database table "bips"		# 1.1 2019-04-19 Add DELETE command for new database table "bips"
			# 1.2 2020-04-16 Replace "DELETE from db" logic by "fail2ban unban --all"
	#		#

Zeile 155:		Zeile 156:
	# Add IP address to ipset		# Add IP address to ipset
	ipset add $pfx-$chain $ipaddr timeout $timeout 1>/dev/null 2>&1		ipset add $pfx-$chain $ipaddr timeout $timeout 1>/dev/null 2>&1
	~~# Remove IP address from fail2ban database, otherwise it would be restored~~
	~~# with next fail2ban start~~
	~~sqlite3 -batch $db "DELETE FROM bans WHERE jail = '$chain' AND ip = '$ipaddr'" 1>/dev/null 2>&1~~
	~~sqlite3 -batch $db "DELETE FROM bips WHERE jail = '$chain' AND ip = '$ipaddr'" 1>/dev/null 2>&1~~
	fi		fi
	done <$out		done <$out
Zeile 170:		Zeile 167:
	rm $out 1>/dev/null 2>&1		rm $out 1>/dev/null 2>&1
	rm $chn 1>/dev/null 2>&1		rm $chn 1>/dev/null 2>&1

			# "Unban" all IP addresses to clear iptables rules as the entries are now in the ipset.
			/usr/local/bin/fail2ban-client unban --all 1>/dev/null 2>&1

	# Save IP set to enable restoring after reboot		# Save IP set to enable restoring after reboot

Wulf: /* Fail2Ban Installation from GitHub */

2019-09-07T08:46:15Z

Fail2Ban Installation from GitHub

← Nächstältere Version		Version vom 7. September 2019, 10:46 Uhr
Zeile 5:		Zeile 5:
	<syntaxhighlight lang="bash">sudo service fail2ban stop</syntaxhighlight>		<syntaxhighlight lang="bash">sudo service fail2ban stop</syntaxhighlight>

	Download ~~version 0.10~~ from GitHub:		Download Fail2Ban from GitHub:
	<syntaxhighlight lang="bash">wget https://github.com/fail2ban/fail2ban/archive/~~0.10.0~~.tar.gz -O fail2ban-~~0.10.0~~.tar.gz</syntaxhighlight>		<syntaxhighlight lang="bash">export VERSION=0.10.0
			wget https://github.com/fail2ban/fail2ban/archive/"${VERSION}".tar.gz -O fail2ban-"${VERSION}".tar.gz</syntaxhighlight>

	Unpack and install:		Unpack and install:
	<syntaxhighlight lang="bash">sudo tar -zxpvf fail2ban-~~0.10.0~~.tar.gz</syntaxhighlight>		<syntaxhighlight lang="bash">sudo tar -zxpvf fail2ban-"${VERSION}".tar.gz</syntaxhighlight>
	<syntaxhighlight lang="bash">cd fail2ban-~~0.10.0~~</syntaxhighlight>		<syntaxhighlight lang="bash">cd fail2ban-"${VERSION}"</syntaxhighlight>
	<syntaxhighlight lang="bash">sudo python setup.py install</syntaxhighlight>		<syntaxhighlight lang="bash">sudo python setup.py install</syntaxhighlight>
	This will install Fail2Ban into the python library directory. The executable scripts are placed into /usr/local/bin and configuration under /etc/fail2ban.		This will install Fail2Ban into the python library directory. The executable scripts are placed into /usr/local/bin and configuration under /etc/fail2ban.

Wulf am 19. April 2019 um 21:37 Uhr

2019-04-19T21:37:26Z

← Nächstältere Version		Version vom 19. April 2019, 23:37 Uhr
Zeile 22:		Zeile 22:
	=Changes in configuration=		=Changes in configuration=
	Avoid banning IPs from local network (file /etc/fail2ban/jail.conf)		Avoid banning IPs from local network (file /etc/fail2ban/jail.conf)
	<syntaxhighlight lang="bash"># "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban		<syntaxhighlight lang="bash" highlight="5-7"># "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
	# will not ban a host which matches an address in this list. Several addresses		# will not ban a host which matches an address in this list. Several addresses
	# can be defined using space (and/or comma) separator.		# can be defined using space (and/or comma) separator.
Zeile 31:		Zeile 31:

	Adjust regular expression for SSH rules (file /etc/fail2ban/filter.d/sshd.conf)		Adjust regular expression for SSH rules (file /etc/fail2ban/filter.d/sshd.conf)
	<syntaxhighlight lang="bash">cmnfailre = ^[aA]uthentication (?:failure\|error\|failed) for <F-USER>.*</F-USER> from <HOST>( via \S+)?%(__suff)s$		<syntaxhighlight lang="bash" highlight="22-24">cmnfailre = ^[aA]uthentication (?:failure\|error\|failed) for <F-USER>.*</F-USER> from <HOST>( via \S+)?%(__suff)s$
	^User not known to the underlying authentication module for <F-USER>.*</F-USER> from <HOST>%(__suff)s$		^User not known to the underlying authentication module for <F-USER>.*</F-USER> from <HOST>%(__suff)s$
	^Failed publickey for invalid user <F-USER>(?P<cond_user>\S+)\|(?:(?! from ).)?</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d)?(?(cond_user): \|(?:(?:(?! from ).)*)$)		^Failed publickey for invalid user <F-USER>(?P<cond_user>\S+)\|(?:(?! from ).)?</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d)?(?(cond_user): \|(?:(?:(?! from ).)*)$)

Wulf am 19. April 2019 um 21:02 Uhr

2019-04-19T21:02:38Z

@@ Zeile 1: / Zeile 1: @@
 __FORCETOC__
-=Fail2Ban Installation from GitHub (EN)=
+=Fail2Ban Installation from GitHub=
 In case an existing Fail2Ban server is running:
@@ Zeile 20: / Zeile 20: @@
 <syntaxhighlight lang="bash">sudo service fail2ban start</syntaxhighlight>
-=Using IP sets instead of iptables rules (EN)=
+=Changes in configuration=
 By default Fail2Ban uses iptables rules to block IP addresses.

Wulf am 19. April 2019 um 20:46 Uhr

2019-04-19T20:46:47Z

← Nächstältere Version		Version vom 19. April 2019, 22:46 Uhr
Zeile 52:		Zeile 52:

	The following shell script '''''fwfail2ban''''' moves IP addresses from the iptables rules to an IP set:		The following shell script '''''fwfail2ban''''' moves IP addresses from the iptables rules to an IP set:
	<syntaxhighlight lang="bash" line="">		<syntaxhighlight lang="bash" line="1">
	#!/bin/bash		#!/bin/bash
	#		#
	# Author: Frank Wulf		# Author: Frank Wulf
	# Version: 1.0 (~~2017~~-10-04)		# Version: 1.1 (2019-04-19)
	#		#
	# This program moves iptables entries created by fail2ban to		# This program moves iptables entries created by fail2ban to
Zeile 66:		Zeile 66:
	# Version history:		# Version history:
	# 1.0 2017-10-04 Initial release		# 1.0 2017-10-04 Initial release
			# 1.1 2019-04-19 Add DELETE command for new database table "bips"
	#		#

Zeile 120:		Zeile 121:
	# with next fail2ban start		# with next fail2ban start
	sqlite3 -batch $db "DELETE FROM bans WHERE jail = '$chain' AND ip = '$ipaddr'" 1>/dev/null 2>&1		sqlite3 -batch $db "DELETE FROM bans WHERE jail = '$chain' AND ip = '$ipaddr'" 1>/dev/null 2>&1
			sqlite3 -batch $db "DELETE FROM bips WHERE jail = '$chain' AND ip = '$ipaddr'" 1>/dev/null 2>&1
	fi		fi
	done <$out		done <$out
Zeile 137:		Zeile 139:
	# Save iptables to enable restoring after reboot, the entries created		# Save iptables to enable restoring after reboot, the entries created
	# by fail2ban are filtered, those will be restored by fail2ban itself.		# by fail2ban are filtered, those will be restored by fail2ban itself.
	iptables-save \| grep -v "^\-A.*f2b-~~sshd~~" >/etc/iptables/rules.v4		iptables-save \| grep -v "^\-A.*f2b-" >/etc/iptables/rules.v4
	</syntaxhighlight>		</syntaxhighlight>