5-Shorewall

----------

#  vi /etc/fai2ban/jail.conf

--------

# Fail2Ban jail specifications file # # Comments: use '#' for comment lines and ';' for inline comments # # Changes:  in most of the cases you should not modify this #           file, but provide customizations in jail.local file, e.g.: # # [DEFAULT] # bantime = 3600 # # [ssh-iptables] # enabled = true #  # The DEFAULT allows a global definition of the options. They can be overridden # in each jail afterwards.  [DEFAULT]  # "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not # ban a host which matches an address in this list. Several addresses can be # defined using space separator. ignoreip = 127.0.0.1/8 202.22.192.0/24 180.234.34.0/24 192.168.0.0/24  # "bantime" is the number of seconds that a host is banned. bantime  = 3600  # A host is banned if it has generated "maxretry" during the last "findtime" # seconds. findtime  = 600  # "maxretry" is the number of failures before a host get banned. maxretry = 5  # "backend" specifies the backend used to get files modification. # Available options are "pyinotify", "gamin", "polling" and "auto". # This option can be overridden in each jail as well. # # pyinotify: requires pyinotify (a file alteration monitor) to be installed. #              If pyinotify is not installed, Fail2ban will use auto. # gamin:     requires Gamin (a file alteration monitor) to be installed. #              If Gamin is not installed, Fail2ban will use auto. # polling:   uses a polling algorithm which does not require external libraries. # auto:      will try to use the following backends, in order: #              pyinotify, gamin, polling. backend = auto  # "usedns" specifies if jails should trust hostnames in logs, #   warn when reverse DNS lookups are performed, or ignore all hostnames in logs # # yes:   if a hostname is encountered, a reverse DNS lookup will be performed. # warn:  if a hostname is encountered, a reverse DNS lookup will be performed,  #        but it will be logged as a warning. # no:    if a hostname is encountered, will not be used for banning, #        but it will be logged as info. usedns = warn   # This jail corresponds to the standard configuration in Fail2ban 0.6. # The mail-whois action send a notification e-mail with a whois request # in the body.  [ssh-iptables]  enabled  = false filter   = sshd action   = iptables[name=SSH, port=ssh, protocol=tcp]            sendmail-whois[name=SSH, dest=you@example.com, sender=fail2ban@example.com] logpath  = /var/log/sshd.log maxretry = 5  [proftpd-iptables]  enabled  = false filter   = proftpd action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]            sendmail-whois[name=ProFTPD, dest=you@example.com] logpath  = /var/log/proftpd/proftpd.log maxretry = 6  # This jail forces the backend to "polling".  [sasl-iptables]  enabled  = false filter   = sasl backend  = polling action   = iptables[name=sasl, port=smtp, protocol=tcp]            sendmail-whois[name=sasl, dest=you@example.com] logpath  = /var/log/mail.log  # Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is # used to avoid banning the user "myuser".  [ssh-tcpwrapper]  enabled     = false filter      = sshd action      = hostsdeny               sendmail-whois[name=SSH, dest=you@example.com] ignoreregex = for myuser from logpath     = /var/log/sshd.log  # This jail demonstrates the use of wildcards in "logpath". # Moreover, it is possible to give other files on a new line.  [apache-tcpwrapper]  enabled  = false filter = apache-auth action   = hostsdeny logpath  = /var/log/apache*/*error.log            /home/www/myhomepage/error.log maxretry = 6  # The hosts.deny path can be defined with the "file" argument if it is # not in /etc.  [postfix-tcpwrapper]  enabled  = true filter   = postfix action   = shorewall            sendmail[name=Postfix, dest=gazi.shamim@accesstel.net] logpath  = /var/log/maillog bantime  = 6000[squirrelmail] enabled = true filter = squirrelmail action   = shorewall            sendmail[name=Squirrelmail, dest=gazi.shamim@accesstel.net] logpath = /var/log/squirrelmail.log bantime = 6000[dovecot-pop3imap] enabled = true filter = dovecot action = shorewall sendmail[name=Dovecot, dest=gazi.shamim@accesstel.net] logpath = /var/log/maillog bantime = 6000 # Do not ban anybody. Just report information about the remote host. # A notification is sent at most every 600 seconds (bantime).  [vsftpd-notification]  enabled  = false filter   = vsftpd action   = sendmail-whois[name=VSFTPD, dest=you@example.com] logpath  = /var/log/vsftpd.log maxretry = 5 bantime  = 1800  # Same as above but with banning the IP address.  [vsftpd-iptables]  enabled  = false filter   = vsftpd action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]            sendmail-whois[name=VSFTPD, dest=you@example.com] logpath  = /var/log/vsftpd.log maxretry = 5 bantime  = 1800  # Ban hosts which agent identifies spammer robots crawling the web # for email addresses. The mail outputs are buffered.  [apache-badbots]  enabled  = false filter   = apache-badbots action   = iptables-multiport[name=BadBots, port="http,https"]            sendmail-buffered[name=BadBots, lines=5, dest=you@example.com] logpath  = /var/www/*/logs/access_log bantime  = 172800 maxretry = 1  # Use shorewall instead of iptables.  [apache-shorewall]  enabled  = false filter   = apache-noscript action   = shorewall            sendmail[name=Postfix, dest=you@example.com] logpath  = /var/log/apache2/error_log  # Ban attackers that try to use PHP's URL-fopen() functionality # through GET/POST variables. - Experimental, with more than a year # of usage in production environments.  [php-url-fopen]  enabled = false port    = http,https filter  = php-url-fopen logpath = /var/www/*/logs/access_log maxretry = 1  # A simple PHP-fastcgi jail which works with lighttpd. # If you run a lighttpd server, then you probably will # find these kinds of messages in your error_log: # ALERT – tried to register forbidden variable ‘GLOBALS’ # through GET variables (attacker '1.2.3.4', file '/var/www/default/htdocs/index.php') # This jail would block the IP 1.2.3.4.  [lighttpd-fastcgi]  enabled = false port    = http,https filter  = lighttpd-fastcgi # adapt the following two items as needed logpath = /var/log/lighttpd/error.log maxretry = 2  # Same as above for mod_auth # It catches wrong authentifications  [lighttpd-auth]  enabled = false port    = http,https filter  = lighttpd-auth # adapt the following two items as needed logpath = /var/log/lighttpd/error.log maxretry = 2  # This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip" # option is overridden in this jail. Moreover, the action "mail-whois" defines # the variable "name" which contains a comma using "". The characters '' are # valid too.  [ssh-ipfw]  enabled  = false filter   = sshd action   = ipfw[localhost=192.168.0.1]            sendmail-whois[name="SSH,IPFW", dest=you@example.com] logpath  = /var/log/auth.log ignoreip = 168.192.0.1  # These jails block attacks against named (bind9). By default, logging is off # with bind9 installation. You will need something like this: # # logging { #     channel security_file { #         file "/var/log/named/security.log" versions 3 size 30m; #         severity dynamic; #         print-time yes; #     }; #     category security { #         security_file; #     }; # }; # # in your named.conf to provide proper logging. # This jail blocks UDP traffic for DNS requests.  # !!! WARNING !!! #   Since UDP is connection-less protocol, spoofing of IP and imitation #   of illegal actions is way too simple.  Thus enabling of this filter #   might provide an easy way for implementing a DoS against a chosen #   victim. See #    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html #   Please DO NOT USE this jail unless you know what you are doing. # # [named-refused-udp] # # enabled  = false # filter   = named-refused # action   = iptables-multiport[name=Named, port="domain,953", protocol=udp] #            sendmail-whois[name=Named, dest=you@example.com] # logpath  = /var/log/named/security.log # ignoreip = 168.192.0.1  # This jail blocks TCP traffic for DNS requests.  [named-refused-tcp]  enabled  = false filter   = named-refused action   = iptables-multiport[name=Named, port="domain,953", protocol=tcp]            sendmail-whois[name=Named, dest=you@example.com] logpath  = /var/log/named/security.log ignoreip = 168.192.0.1  # Multiple jails, 1 per protocol, are necessary ATM: # see https://github.com/fail2ban/fail2ban/issues/37 [asterisk-tcp]  enabled  = false filter   = asterisk action   = iptables-multiport[name=asterisk-tcp, port="5060,5061", protocol=tcp]            sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com] logpath  = /var/log/asterisk/messages maxretry = 10  [asterisk-udp]  enabled  = false filter = asterisk action   = iptables-multiport[name=asterisk-udp, port="5060,5061", protocol=udp]            sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com] logpath  = /var/log/asterisk/messages maxretry = 10  # Jail for more extended banning of persistent abusers # !!! WARNING !!! #   Make sure that your loglevel specified in fail2ban.conf/.local #   is not at DEBUG level -- which might then cause fail2ban to fall into #   an infinite loop constantly feeding itself with non-informative lines [recidive]  enabled  = false filter   = recidive logpath  = /var/log/fail2ban.log action   = iptables-allports[name=recidive]            sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log] bantime  = 604800  ; 1 week findtime = 86400   ; 1 day maxretry = 5

--------------

----------