FAIL2BAN

http://www.servermom.org/install-fail2ban-centos/1809/

https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-centos-7

https://sites.google.com/site/ghidit/how-to-2/secure-a-centos-6-mail-server-with-fail2ban

https://techarena51.com/index.php/confiigure-fail2ban-block-brute-force-ips-scanning-postfix-logs/

https://fedoraproject.org/wiki/Fail2ban_with_FirewallD

Disable IPtables

flush all IPtables rules. You can do it with the following command:

iptables -Fsystemctl stop iptables systemctl disable iptables

Next, verify IPtables rules with the following command:

iptables -L -n -v

List of Banned IP Address

# iptables -L

Delete all fail2ban bans in Ubuntu Linux

# iptables -L -n

Unbanning an IP address

#fail2ban-client set sshd unbanip IPADDR

Remove Banned IP From Fail2Ban

Now run the below command to remove the IP from the banned list. For example I would like to remove “192.168.0.5” IP from the banned list

# iptables -D f2b-NoAuthFailures -s 192.168.0.5 -j REJECT

-----------------------------------

[root@mail ~]# vi /etc/fail2ban/jail.local

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host

ignoreip = 127.0.0.1/8 192.168.1.0/24

# set a higher bantime and findtime

bantime=3600

findtime=600

banaction = iptables-multiport

backend = systemd

# set max number of attempts

maxretry = 3

# set mail receiver

destemail = at@mar-bd.com

sender = fail2ban@mar-bd.com

# enable sending mails, whois and logfile sections by choosing the "action_mwl" template,

# see jail.conf for details

mta = postfix

action = %(action_mwl)s

use_dns = no

[sshd]

enabled = true

action = iptables[name=sshd, port=ssh, protocol=tcp]

[pure-ftpd]

enabled = true

action = iptables[name=FTP, port=ftp, protocol=tcp]

maxretry = 5

[dovecot]

enabled = true

action = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps", protocol=tcp]

maxretry = 5

[postfix-sasl]

enabled = true

action = iptables-multiport[name=postfix-sasl, port="smtp,smtps,submission", protocol=tcp]

maxretry = 5

[postfix-auth]

enabled = true

filter = postfix.auth

action = iptables-multiport[name=postfix, port="http,https,smtp,submission,pop3,pop3s,imap,imaps,sieve", protocol=tcp]

logpath = /var/log/mail.log

-----------SSH-------------------

# yum update

# yum install epel-release

# systemctl start fail2ban

# systemctl enable fail2ban

# cp -pf /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# vi /etc/fail2ban/jail.local

[DEFAULT]

## WARNING: heavily refactored in 0.9.0 release. Please review and# customize settings for your setup.## Changes: in most of the cases you should not modify this# file, but provide customizations in jail.local file,# or separate .conf files under jail.d/ directory, e.g.:## HOW TO ACTIVATE JAILS:## YOU SHOULD NOT MODIFY THIS FILE.## It will probably be overwritten or improved in a distribution update.## Provide customizations in a jail.local file or a jail.d/customisation.local.# For example to change the default bantime for all jails and to enable the# ssh-iptables jail the following (uncommented) would appear in the .local file.# See man 5 jail.conf for details.## [DEFAULT]# bantime = 3600## [sshd]# enabled = true## See jail.conf(5) man page for more informationignoreip = 127.0.0.1/8# External command that will take an tagged arguments to ignore, e.g. <ip>,# and return true if the IP is to be ignored. False otherwise.#

# ignorecommand = /path/to/command <ip>

ignorecommand =

ignoreip = 127.0.0.1/8 ::1

# "bantime" is the number of seconds that a host is banned to do ssh .

bantime = 1200

# A host is banned if it has generated "maxretry" during the last "findtime"

# seconds.

findtime = 600

# "maxretry" is the number of failures before a host get banned.

maxretry = 5

Adding the Configuration File to protect the SSH

We will create a new sshd configuration file with the below command and we will add the fail2ban configuration file.

# vi /etc/fail2ban/jail.d/sshd.local

[sshd]enabled = trueport = ssh#action = firewallcmd-ipsetlogpath = %(sshd_log)smaxretry = 25bantime = 36000

# systemctl restart fail2ban

Checking the Fail2ban Status

Below is the command used to check the fail2ban status

# fail2ban-client status

Status

|- Number of jail: 2

`- Jail list: sshd

Below is the command to check the failed attempts for logging into the server using the SSH port.

# cat /var/log/secure | grep ‘Failed password’

Jul 18 16:41:12 htf sshd[5487]: Failed password for root from 54.46.23.45 port 23421 ssh2

Jul 18 16:41:15 htf sshd[1254]: Failed password for root from 54.46.23.45 port 15286 ssh2

Jul 18 16:41:16 htf sshd[1254]: Failed password for root from 54.46.23.45 port 24157 ssh2

Jul 18 16:41:18 htf sshd[1254]: Failed password for root from 54.46.23.45 port 24057 ssh2

Jul 18 16:41:19 htf sshd[1254]: Failed password for root from 54.46.23.45 port 27286 ssh2

Jul 18 16:41:22 htf sshd[1254]: Failed password for root from 54.46.23.45 port

--------------------

Installing fail2ban on CentOS 7:

Connect with fail2ban-01.example.com using ssh as root user.

fail2ban is available via EPEL (Extra Packages for Enterprise Linux) yum repository. Therefore, we must install epel-release to enable access to EPEL yum repository.

[root@fail2ban-01 ~]# yum install -y epel-release

Installed:

epel-release.noarch 0:7-11

Complete!

Build cache for yum repositories.

[root@fail2ban-01 ~]# yum makecache fast

Loaded plugins: fastestmirror

Loading mirror speeds from cached hostfile

epel/x86_64/metalink | 6.3 kB 00:00

* base: mirrors.ges.net.pk

* epel: my.fedora.ipserverone.com

* extras: mirrors.ges.net.pk

* updates: centosc6.centos.org

base | 3.6 kB 00:00

extras | 3.4 kB 00:00

updates | 3.4 kB 00:00

epel/x86_64/primary_db | 6.7 MB 01:39

Metadata Cache Created

We are required to install following fail2ban packages.

fail2ban.noarch: Daemon to ban hosts that cause multiple authentication errors

fail2ban-firewalld.noarch: Firewalld support for fail2ban

fail2ban-systemd.noarch: Systemd journal configuration for fail2ban

EPEL yum repository always provides a stable release of fail2ban. However, you can download a latest experimental release from fail2ban official website.

[root@fail2ban-01 ~]# yum install -y fail2ban fail2ban-firewalld fail2ban-systemd

Complete!

Since, we are installing fail2ban on a CentOS 7 system, therefore, fail2ban-firewalld and fail2ban-systemd packages are also required for integration with Firewalld and Systemd respectively.

Enable and start fail2ban.service.

[root@fail2ban-01 ~]# systemctl enable fail2ban.service

Created symlink from /etc/systemd/system/multi-user.target.wants/fail2ban.service to /usr/lib/systemd/system/fail2ban.service.

[root@fail2ban-01 ~]# systemctl start fail2ban.service

Understanding fail2ban Configuration Files:

fail2ban configurations are exist in /etc/fail2ban/ and /etc/fail2ban/jail.d/.

fail2ban reads *.conf files first and then reads *.local files. Therefore, all settings in *.conf files are override by the settings in *.local files.

Thus, it is a best practice to create a custom jail.local file instead of editing the default jail.conf file.

fail2ban provides only a single configuration file /etc/fail2ban/jail.conf with initial configurations. This file contains sample jail configurations of common network services. Therefore, we can simply copy the required section in a jail.local file and enable the jail to apply it.

Copy the default jail.conf file as jail.local.

[root@fail2ban-01 ~]# cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Now, we can customize this file to create fail2ban jails for different Linux services. Infact, most fail2ban jails that are related to common Linux services are predefined in this file. Therefore, we are only required to enable the required fail2ban jail.

But, before enabling a fail2ban jail, we are describing some settings in the DEFAULT section. These settings are globally applicable on all fail2ban jails unless override.

ignoreip - It is an IP address, hostname or CIDR mask. fail2ban does not ban a host, if it was listed here.

bantime - It is the time (in seconds) to ban a host.

findtime - It is the time span during which fail2ban must caught maxretry failures to ban a host.

maxretry - It is the number of failures before a host gets banned.

Configure fail2ban to Secure SSH Service:

There are many predefined fail2ban jails for sshd service in jail.local. Therefore, we are enabling only one of them as follows.

[root@fail2ban-01 ~]# sed -i "/^\[sshd\]/a\\enabled=true" /etc/fail2ban/jail.local

[root@fail2ban-01 ~]# systemctl restart fail2ban.service

We also restarted fail2ban.service to reload configurations.

Now, try to connect with fail2ban-01.example.com using a ssh client with wrong password. Make 5 failed attempts and the host will be banned by fail2ban.

[root@fail2ban-tester ~]# ssh root@192.168.116.171

The authenticity of host '192.168.116.171 (192.168.116.171)' can't be established.

ECDSA key fingerprint is SHA256:kzyCimDDwGPsfsuGXxdrcBqlxVQlU8FZTsYrwbPzZHM.

ECDSA key fingerprint is MD5:b4:3f:a2:86:30:7a:b7:d7:b3:b0:10:8f:a3:3e:8a:bc.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '192.168.116.171' (ECDSA) to the list of known hosts.