fail2ban

Сайт fail2ban
Список команд fail2ban
https://github.com/fail2ban/fail2ban/wiki

Необходимо отключить подавление повторяющихся строк в логах:

Jan 21 16:08:01 vmls-haproxy1 haproxy[1674256]: message repeated 6 times: [ 36.93.174.103:45931 [21/Jan/2024:16:07:12.895] fe_web~ fe_web/<NOSRV> 0/-1/-1/-1/49089 429 225 - - PR-- 827/827/0/0/0 0/0 "GET https://www.example.com/ HTTP/2.0"]

Иначе пороги срабатывания будут некорректными.

sed -i 's#RepeatedMsgReduction on#RepeatedMsgReduction off#' /etc/rsyslog.conf
systemctl restart rsyslog

sudo apt-get install fail2ban -y

Пакеты: https://github.com/fail2ban/fail2ban/releases

cd /tmp
wget https://github.com/fail2ban/fail2ban/releases/download/0.11.2/fail2ban_0.11.2-1.upstream1_all.deb \
https://github.com/fail2ban/fail2ban/releases/download/0.11.2/fail2ban_0.11.2-1.upstream1_all.deb.asc
# Проверка контрольной суммы
gpg --verify fail2ban_0.11.2-1.upstream1_all.deb.asc fail2ban_0.11.2-1.upstream1_all.deb
# Описание пакета
dpkg -I fail2ban_0.11.2-1.upstream1_all.deb
 
service fail2ban stop # Остановить предыдущую работающую версию
fail2ban-client stop # Как вариант - клиентом
 
apt install nftables python3-pyinotify whois # Установить зависимости (см. описание пакета)
dpkg -i fail2ban_0.11.2-1.upstream1_all.deb # Установить пакет
apt -f install # Установить оставшиеся зависимости

https://github.com/fail2ban/fail2ban/wiki/How-to-install-or-upgrade-fail2ban-manually

nano /etc/fail2ban/filter.d/nextcloud.conf

Вставить туда следующий текст:

[INCLUDES]
before = common.conf

[Definition]
failregex = Login failed.*Remote IP.*'<HOST>'
ignoreregex =

nano /etc/fail2ban/jail.d/nextcloud.conf

Вставить туда следующий текст:

[nextcloud]
enabled = true
port    = http,https
filter  = nextcloud
logpath = /media/sdcard/cloud-data/nextcloud.log

Чтобы научить Wordpress работать с fail2ban, необходимо установить в Wordpress плагин WP Fail2Ban Redux, который перенаправляет сообщения о входах в Wordpress в стандартный файл /var/log/auth.log.

nano /etc/fail2ban/filter.d/wordpress-hard.conf

Вставить туда следующий текст:

[INCLUDES]
before = common.conf

[Definition]
_daemon = wp
failregex = ^%(__prefix_line)sAuthentication attempt for unknown user .* from <HOST>$
            ^%(__prefix_line)sBlocked authentication attempt for .* from <HOST>$
            ^%(__prefix_line)sBlocked user enumeration attempt from <HOST>$
            ^%(__prefix_line)sPingback error .* generated from <HOST>$
            ^%(__prefix_line)sSpammed comment from <HOST>$
            ^%(__prefix_line)sXML-RPC multicall authentication failure <HOST>$
ignoreregex =

nano /etc/fail2ban/filter.d/wordpress-soft.conf

Вставить туда следующий текст:

[INCLUDES]
before = common.conf

[Definition]
_daemon = wp
failregex = ^%(__prefix_line)sAuthentication failure for .* from <HOST>$
ignoreregex =

nano /etc/fail2ban/jail.d/wordpress.conf

Вставить туда следующий текст:

[wordpress-hard]
enabled = true
filter = wordpress-hard
logpath = /var/log/auth.log
maxretry = 2
port = http,https

[wordpress-soft]
enabled = true
filter = wordpress-soft
logpath = /var/log/auth.log
maxretry = 5
port = http,https

Страница плагина WP Fail2Ban Redux

Страница на Гитхабе

Защита от DoS-атак.

vi /etc/fail2ban/filter.d/haproxy-ddos.conf

[INCLUDES]
before = common.conf
 
[Definition]
failregex = ^%(__prefix_line)s<ADDR>:\d+.*?\sPR--\s.*$
ignoreregex = ^%(__prefix_line)smessage repeated

vi /etc/fail2ban/jail.local

[DEFAULT]
ignoreip = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1
banaction = nftables-multiport
banaction_allports = nftables-allports
 
[haproxy-ddos]
enabled  = true
filter   = haproxy-ddos
logpath  = /var/log/haproxy.log
bantime  = 6h
findtime = 1m
maxretry = 100

https://serverfault.com/a/853817
Simple Denial of Service DOS attack mitigation using HAProxy
Iptables Limits Connections Per IP

fail2ban-5digit-requests.sh

for ip in $(echo "show table st_per_ip_rate" |socat stdio /var/run/haproxy/admin.sock |egrep "[0-9]{5}$" |cut -d '=' -f 2 |cut -d ' ' -f 1)
do
fail2ban-client set haproxy-ddos banip $ip
done

echo "" >> /etc/crontab
echo "# fail2ban 5-digit requests IPs" >> /etc/crontab
echo "* *     * * *   root    /root/fail2ban-5digit-requests.sh" >> /etc/crontab

# Логи:
tail -f /var/log/fail2ban.log
tail -f /var/log/fail2ban.log |egrep -i "\] ban|unban"
 
# Перечитать конфиг:
fail2ban-client reload
 
# Проверить состояние jail:
fail2ban-client status nextcloud
fail2ban-client status haproxy-ddos
 
# Забанить/разбанить IP-адреса:
fail2ban-client set <jail> banip <IP address> <IP address> <IP address> ...
fail2ban-client set <jail> unbanip <IP address> <IP address> <IP address> ...

# Исходник
2023-05-22 11:00:05,449 fail2ban.actions        [820]: NOTICE  [haproxy-ddos] Ban 167.235.195.27
2023-05-22 11:00:05,640 fail2ban.actions        [820]: NOTICE  [haproxy-ddos] Ban 65.21.246.244
2023-05-22 11:00:06,289 fail2ban.actions        [820]: NOTICE  [haproxy-ddos] Ban 5.161.228.93
 
(gc 'D:\temp\2023.05.22 DDoS.txt') -replace ' fail2ban.*Ban ',';'|Convertfrom-Csv -Delimiter ';' -Header Time,IP |
select @{n='Time';e={($_.Time -replace ',','.') -as [datetime]}},IP
 
# Результат
Time                IP             
----                --             
22.05.2023 11:00:05 167.235.195.27 
22.05.2023 11:00:05 65.21.246.244  
22.05.2023 11:00:06 5.161.228.93  

Сайт fail2ban

Список команд fail2ban

Fail2Ban 0.9.x в Ubuntu 16.04