Fail2Ban not banning?

Discussion in 'Server Operation' started by tristanlee85, Oct 14, 2008.

  1. tristanlee85

    tristanlee85 New Member

    I just installed this and configured it on my FC7 server based on the write-up on here.

    This is my jail.conf file:

    Code:
    # Fail2Ban configuration file
    #
    # Author: Cyril Jaquier
    #
    # $Revision: 617 $
    #
    
    # The DEFAULT allows a global definition of the options. They can be override
    # in each jail afterwards.
    
    [DEFAULT]
    
    # "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
    # ban a host which matches an address in this list. Several addresses can be
    # defined using space separator.
    ignoreip = 127.0.0.1 192.168.1.150 192.168.1.110 65.24.28.114
    
    # "bantime" is the number of seconds that a host is banned.
    bantime  = 600
    
    # A host is banned if it has generated "maxretry" during the last "findtime"
    # seconds.
    findtime  = 600
    
    # "maxretry" is the number of failures before a host get banned.
    maxretry = 3
    
    # "backend" specifies the backend used to get files modification. Available
    # options are "gamin", "polling" and "auto". This option can be overridden in
    # each jail too (use "gamin" for a jail and "polling" for another).
    #
    # gamin:   requires Gamin (a file alteration monitor) to be installed. If Gamin
    #          is not installed, Fail2ban will use polling.
    # polling: uses a polling algorithm which does not require external libraries.
    # auto:    will choose Gamin if available and polling otherwise.
    backend = auto
    
    
    # This jail corresponds to the standard configuration in Fail2ban 0.6.
    # The mail-whois action send a notification e-mail with a whois request
    # in the body.
    
    [ssh-iptables]
    
    enabled  = true
    filter   = sshd
    action   = iptables[name=SSH, port=ssh, protocol=tcp]
               sendmail-whois[name=SSH, dest=root, sender=fail2ban@mail.com]
    logpath  = /var/log/secure
    maxretry = 5
    
    [proftpd-iptables]
    
    enabled  = true
    filter   = proftpd
    action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
               sendmail-whois[name=ProFTPD, dest=tristanlee85@gmail.com]
    logpath  = /var/log/proftpd/proftpd.log
    maxretry = 6
    
    # This jail forces the backend to "polling".
    
    [sasl-iptables]
    
    enabled  = true
    filter   = sasl
    backend  = polling
    action   = iptables[name=sasl, port=smtp, protocol=tcp]
               sendmail-whois[name=sasl, dest=tristanlee85@gmail.com]
    logpath  = /var/log/mail.log
    
    # Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is
    # used to avoid banning the user "myuser".
    
    [ssh-tcpwrapper]
    
    enabled     = false
    filter      = sshd
    action      = hostsdeny
                  sendmail-whois[name=SSH, dest=tristanlee85@gmail.com]
    ignoreregex = for myuser from
    logpath     = /var/log/sshd.log
    
    # This jail demonstrates the use of wildcards in "logpath".
    # Moreover, it is possible to give other files on a new line.
    
    [apache-tcpwrapper]
    
    enabled  = true
    filter	 = apache-auth
    action   = hostsdeny
    logpath  = /var/log/apache*/*error.log
               /home/www/myhomepage/error.log
    maxretry = 6
    
    # The hosts.deny path can be defined with the "file" argument if it is
    # not in /etc.
    
    [postfix-tcpwrapper]
    
    enabled  = true
    filter   = postfix
    action   = hostsdeny[file=/not/a/standard/path/hosts.deny]
               sendmail[name=Postfix, dest=tristanlee85@gmail.com]
    logpath  = /var/log/postfix.log
    bantime  = 300
    
    # Do not ban anybody. Just report information about the remote host.
    # A notification is sent at most every 600 seconds (bantime).
    
    [vsftpd-notification]
    
    enabled  = true
    filter   = vsftpd
    action   = sendmail-whois[name=VSFTPD, dest=tristanlee85@gmail.com]
    logpath  = /var/log/vsftpd.log
    maxretry = 5
    bantime  = 1800
    
    # Same as above but with banning the IP address.
    
    [vsftpd-iptables]
    
    enabled  = true
    filter   = vsftpd
    action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
               sendmail-whois[name=VSFTPD, dest=tristanlee85@gmail.com]
    logpath  = /var/log/vsftpd.log
    maxretry = 5
    bantime  = 1800
    
    # Ban hosts which agent identifies spammer robots crawling the web
    # for email addresses. The mail outputs are buffered.
    
    [apache-badbots]
    
    enabled  = true
    filter   = apache-badbots
    action   = iptables-multiport[name=BadBots, port="http,https"]
               sendmail-buffered[name=BadBots, lines=5, dest=tristanlee85@gmail.com]
    logpath  = /var/www/*/logs/access_log
    bantime  = 172800
    maxretry = 1
    
    # Use shorewall instead of iptables.
    
    [apache-shorewall]
    
    enabled  = true
    filter   = apache-noscript
    action   = shorewall
               sendmail[name=Postfix, dest=tristanlee85@gmail.com]
    logpath  = /var/log/apache2/error_log
    
    # This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip"
    # option is overridden in this jail. Moreover, the action "mail-whois" defines
    # the variable "name" which contains a comma using "". The characters '' are
    # valid too.
    
    [ssh-ipfw]
    
    enabled  = true
    filter   = sshd
    action   = ipfw[localhost=192.168.0.1]
               sendmail-whois[name="SSH,IPFW", dest=tristanlee85@gmail.com]
    logpath  = /var/log/auth.log
    ignoreip = 168.192.0.1
    
    # These jails block attacks against named (bind9). By default, logging is off
    # with bind9 installation. You will need something like this:
    #
    # logging {
    #     channel security_file {
    #         file "/var/log/named/security.log" versions 3 size 30m;
    #         severity dynamic;
    #         print-time yes;
    #     };
    #     category security {
    #         security_file;
    #     };
    # }
    #
    # in your named.conf to provide proper logging.
    # This jail blocks UDP traffic for DNS requests.
    
    [named-refused-udp]
    
    enabled  = true
    filter   = named-refused
    action   = iptables-multiport[name=Named, port="domain,953", protocol=udp]
               sendmail-whois[name=Named, dest=tristanlee85@gmail.com]
    logpath  = /var/log/named/security.log
    ignoreip = 168.192.0.1
    
    # This jail blocks TCP traffic for DNS requests.
    
    [named-refused-tcp]
    
    enabled  = true
    filter   = named-refused
    action   = iptables-multiport[name=Named, port="domain,953", protocol=tcp]
               sendmail-whois[name=Named, dest=tristanlee85@gmail.com]
    logpath  = /var/log/named/security.log
    ignoreip = 168.192.0.1
    
    I am tailing my /var/log/messages log and i can see someone constantly trying to log into via FTP, but when I look at the fail2ban logs, I don't see anything trying to stop them.

    Code:
    [root@ns1 ~]# tail -f /var/log/fail2ban.log 
    Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
    2008-10-13 22:31:13,601 fail2ban.actions.action: INFO   Set actionStart = printf %b "Subject: [Fail2Ban] <name>: started
    From: Fail2Ban <<sender>>
    To: <dest>\n
    Hi,\n
    The jail <name> has been started successfully.\n
    Regards,\n
    Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
    2008-10-13 22:31:13,605 fail2ban.actions.action: INFO   Set actionUnban = 
    2008-10-13 22:31:13,608 fail2ban.actions.action: INFO   Set actionCheck = 
    
    Is my config not set up correctly?
     
  2. tal56

    tal56 New Member

    Pretty sure you have to change the config depending on the distro you are using. Not sure if your FC is the same as my centos 5, but my log I'm using for checking ftp connections is /var/log/secure, but you currently have it to check /var/log/proftp/proftpd.log

    I'm not saying what you have is wrong but check your logs to make sure that matches.

    The other thing to check is the proftp filter in your /etc/fail2ban directory. The actual filter may not be correct to match the log entry.
     
  3. tristanlee85

    tristanlee85 New Member

    Here is my ProFTPD reged:

    Code:
    failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[[0-9.]+\] to \S+:\S+$
                \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect password\.$
                \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\.$
                \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded$
    and here is an example from /var/log/secure:

    Code:
    Oct 15 00:35:50 ns1 proftpd[15941]: ns1.cfcoding.com (::ffff:65.24.28.114[::ffff:65.24.28.114]) - USER web3_cfcodin: no such user found from ::ffff:65.24.28.114 [::ffff:65.24.28.114] to ::ffff:192.168.1.150:21 
    Oct 15 00:35:53 ns1 proftpd[15941]: ns1.cfcoding.com (::ffff:65.24.28.114[::ffff:65.24.28.114]) - FTP session closed. 
    Oct 15 00:35:55 ns1 proftpd[15945]: ns1.cfcoding.com (::ffff:65.24.28.114[::ffff:65.24.28.114]) - USER web3_cfcodin: no such user found from ::ffff:65.24.28.114 [::ffff:65.24.28.114] to ::ffff:192.168.1.150:21 
    Oct 15 00:35:57 ns1 proftpd[15945]: ns1.cfcoding.com (::ffff:65.24.28.114[::ffff:65.24.28.114]) - FTP session closed. 
    Oct 15 00:36:00 ns1 proftpd[15946]: ns1.cfcoding.com (::ffff:65.24.28.114[::ffff:65.24.28.114]) - USER web3_cfcodin: no such user found from ::ffff:65.24.28.114 [::ffff:65.24.28.114] to ::ffff:192.168.1.150:21 
    Oct 15 00:36:03 ns1 proftpd[15946]: ns1.cfcoding.com (::ffff:65.24.28.114[::ffff:65.24.28.114]) - FTP session closed. 
    
    I tried to fail login, but it didn't block me. Here is my log for fail2ban:

    Code:
    2008-10-15 00:30:24,783 fail2ban.actions.action: INFO   Set actionCheck = 
    2008-10-15 00:30:25,706 fail2ban.actions.action: ERROR  iptables -N fail2ban-SSH
    iptables -A fail2ban-SSH -j RETURN
    iptables -I INPUT -p tcp --dport ssh -j fail2ban-SSH returned 400
    2008-10-15 00:30:25,708 fail2ban.actions.action: ERROR  iptables -N fail2ban-VSFTPD
    iptables -A fail2ban-VSFTPD -j RETURN
    iptables -I INPUT -p tcp --dport ftp -j fail2ban-VSFTPD returned 400
    2008-10-15 00:30:25,831 fail2ban.actions.action: ERROR  iptables -N fail2ban-ProFTPD
    iptables -A fail2ban-ProFTPD -j RETURN
    iptables -I INPUT -p tcp --dport ftp -j fail2ban-ProFTPD returned 400
    
     
  4. edge

    edge HowtoForge Supporter

    [off-topic]
    ColdFusion Coding, Blog, and Forum
    www.cfcoding.com
    [/off-topic]

    Finaly an other ColdFusion coder here :)
     
  5. falko

    falko Super Moderator

    Use /var/log/secure:

    Code:
    [proftpd-iptables]
    
    enabled  = true
    filter   = proftpd
    action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
               sendmail-whois[name=ProFTPD, dest=tristanlee85@gmail.com]
    logpath  = /var/log/secure
    maxretry = 6
     

Share This Page