Tutoriel sur l'installation et la configuration de Fail2ban

loglevel = 3
logtarget = /var/log/fail2ban.log
socket = /var/run/fail2ban/fail2ban.sock

[DEFAULT]
destemail = root@localhost

action = %(action_mw)s

action = %(action_mwl)s

[ssh]
enabled = true
port    = ssh
filter  = sshd
logpath  = /var/log/auth.log
maxretry = 6

[xinetd-fail]
enabled   = true 
filter    = xinetd-fail
port      = all
banaction = iptables-multiport-log
logpath   = /var/log/daemon.log
maxretry  = 2

[pam-generic]
enabled = true
filter  = pam-generic
port = all
banaction = iptables-allports
port     = anyport
logpath  = /var/log/auth.log
maxretry = 6

[ssh-ddos]
enabled = true
port    = ssh
filter  = sshd-ddos
logpath  = /var/log/auth.log
maxretry = 6

[apache]
enabled = true
port    = http,https
filter  = apache-auth
logpath = /var/log/apache*/*error.log
maxretry = 6

[apache-multiport]
enabled   = true
port      = http,https
filter    = apache-auth
logpath   = /var/log/apache*/*error.log
maxretry  = 6

[apache-noscript]
enabled = true 
port    = http,https
filter  = apache-noscript
logpath = /var/log/apache*/*error.log
maxretry = 6

[apache-overflows]
enabled = true 
port    = http,https
filter  = apache-overflows
logpath = /var/log/apache*/*error.log
maxretry = 2

[postfix]
enabled  = true 
port     = smtp,ssmtp
filter   = postfix
logpath  = /var/log/mail.log

[sasl]
enabled  = true 
port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter   = sasl
logpath  = /var/log/mail.log

# service fail2ban restart

[pure-ftpd]
enabled = true
port = ftp,ftp-data,ftps,ftps-data
filter = pure-ftpd
logpath = /var/log/messages
maxretry = 3
 
[dovecot-pop3imap]
enabled = true
filter = dovecot-pop3imap
action = iptables-multiport[name=dovecot-pop3imap, port="pop3,pop3s,imap,imaps", protocol=tcp]
logpath = /var/log/mail.log
maxretry = 5
 
[webmin-auth]
enabled  = true
port     = https,10000
filter   = webmin-auth
logpath  = /var/log/auth.log
maxretry = 3
 
# Plugin ''roundcube-fail2ban-plugin'' à installer
# 
[roundcube]
enabled  = true
port     = http,https
filter   = roundcube
action   = iptables-multiport[name=roundcube, port="http,https"]
           sendmail-whois[name=roundcube, dest=root@localhost, sender=fail2ban@localhost]
logpath  = /var/www/path/logs/userlogins
 
# Plugin ''squirrel_logger'' à ajouter à squirrelmail
[squirrelmail]
enabled = true
port = http,https
filter = squirrelmail
logpath = /var/www/path/squirrelmail_access_log
bantime = 6000
maxretry = 4
 
# Règle anti-Kevin...
[apache-admin]
enabled = true
port = http
filter = apache-admin
logpath = /var/log/apache*/error*.log
maxretry = 6
 
# Règle anti-boulets...
[apache-404]
enabled = true
port = http
filter = apache-404
logpath = /var/log/ispconfig/httpd/*/error*
maxretry = 10

# Fail2Ban configuration file
#
# Author: Cyril Jaquier
# Rule by : Delvit Guillaume
#
# $Revision: 728 $
#
 
[Definition]
 
# patern :      webmin[15673]: Non-existent login as toto from 86.0.6.217
#               webmin[29544]: Invalid login as root from 86.0.6.217
#
# Option:  failregex
# Notes.:  regex to match the password failure messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values:  TEXT
#
failregex = webmin.* Non-existent login as .+ from <HOST>$
            webmin.* Invalid login as .+ from <HOST>$
 
# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

[Definition]
failregex = FAILED login for .*. from <HOST>
ignoreregex =

# Fail2Ban configuration file
#
# Author: Bill Landry ((email_protected))
#
# $Revision: 510 $
 
[Definition]
 
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
#         host must be matched by a group named "host". The tag "" can
#         be used for standard IP/hostname matching and is only an alias for
#         (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
 
# Message d'erreur "Utilisateur inconnu ou mot de passe incorrect" à adapter suivant la langue utilisée par le serveur
failregex = \[LOGIN_ERROR\].*from <HOST>: Utilisateur inconnu ou mot de passe incorrect
 
# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
 
ignoreregex =

# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision: 471 $
#
 
[Definition]
 
# Option: failregex
# Notes.: regex to match the password failure messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching.
# Values: TEXT
# [client x.x.x.x] File does not exist: /home/www/admin/admin,
failregex = [[]client <HOST>[]] File does not exist: .*admin|PMA|mysql
 
#
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision: 471 $
#
 
[Definition]
 
# Option: failregex
# Notes.: regex to match the password failure messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching.
# Values: TEXT
# [client x.x.x.x] File does not exist: /home/www/admin/admin,
failregex = [[]client <HOST>[]] File does not exist: .*
#
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

logpath /var/log/ispconfig/httpd/*/error*

# /usr/bin/fail2ban-regex /var/www/path/logs/userlogins /etc/fail2ban/filter.d/roundcube.conf

Running tests
=============
 
Use regex file : /etc/fail2ban/filter.d/roundcube.conf
Use log file   : /var/www/path/logs/userlogins
 
 
Results
=======
 
Failregex
|- Regular expressions:
|  [1] FAILED login for .*. from <HOST>
|
`- Number of matches:
   [1] 1 match(es)
 
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
 
Summary
=======
 
Addresses found:
[1]
    41.xxx.xxx.xxx (Wed Dec 28 15:51:14 2011)
 
Date template hits:
0 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
2 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s): <Month/Day/Year@Hour:Minute:Second>
 
Success, the total number of match is 1
 
However, look at the above section 'Running tests' which could contain important
information.

# /usr/bin/fail2ban-client status
Status
|- Number of jail:      18
`- Jail list:           dovecot-pop3imap, pure-ftpd, roundcube, apache, ssh, dovecot, apache-overflows, apache-noscript, squirrelmail, apache-dosevasive, apache-admin, pam-generic, postfix, ssh-ddos, webmin-auth, apache-404, sasl, named-refused-tcp

# /usr/bin/fail2ban-client status apache-404
Status for the jail: apache-404
|- filter
|  |- File list:        /var/log/path/error.log /var/log/path2/error.log /var/log/path2/error.log Etc...
|  |- Currently failed: 5
|  `- Total failed:     32
`- action
   |- Currently banned: 2
   |  `- IP list:       41.xxx.xxx.xxx 84.xxx.xxx.xxx 
   `- Total banned:     2

tail -f /var/log/fail2ban.log
2011-08-08 12:27:18,730 fail2ban.actions: WARNING [apache] Ban 10.9.11.150

iptables -L
Chain fail2ban-apache (1 references)
target     prot opt source               destination         
DROP       all  --  10.9.11.150          anywhere            
RETURN     all  --  anywhere             anywhere

2011-08-08 12:37:19,585 fail2ban.actions: WARNING [apache] Unban 10.9.11.150