Fail2ban: Difference between revisions
imported>Rollin rob No edit summary |
m added Category:Server Category:Networking |
||
| (4 intermediate revisions by 3 users not shown) | |||
| Line 1: | Line 1: | ||
[https://www.fail2ban.org Fail2ban] is an intrusion prevention software. It scans through log files to find signs of malicious intent. In general, Fail2ban will update the firewall rules to reject the offending IP address for a set amount of time. | [https://www.fail2ban.org Fail2ban] is an intrusion prevention software. It scans through log files to find signs of malicious intent. In general, Fail2ban will update the firewall rules to reject the offending IP address for a set amount of time. | ||
Fail2Ban uses the concept of a "jail" to modularize its configuration. A jail consists of an action (such as blocking a port using iptables) that is triggered when a filter (regular expression) applied to a log file triggers/matches more than a certain number of times in a certain time period. Actions that ship with Fail2Ban are defined in < | Fail2Ban uses the concept of a "jail" to modularize its configuration. A jail consists of an action (such as blocking a port using iptables) that is triggered when a filter (regular expression) applied to a log file triggers/matches more than a certain number of times in a certain time period. Actions that ship with Fail2Ban are defined in <syntaxhighlight lang="nix" inline>/etc/fail2ban/action.d</syntaxhighlight>, while filters are defined in <syntaxhighlight lang="nix" inline>/etc/fail2ban/filter.d</syntaxhighlight>. | ||
== Basic Usage == | == Basic Usage == | ||
| Line 12: | Line 12: | ||
== Advanced Usage == | == Advanced Usage == | ||
The Fail2ban NixOS module exposes various parameters for adjusting the configuration. In the following, all options mentioned are implicitly prefixed with < | The Fail2ban NixOS module exposes various parameters for adjusting the configuration. In the following, all options mentioned are implicitly prefixed with <syntaxhighlight lang="nix" inline>services.fail2ban</syntaxhighlight> , unless specified otherwise. | ||
* The < | * The <syntaxhighlight lang="nix" inline>maxretry</syntaxhighlight> option allows you to specify how many failures are required for an IP address to be blocked. | ||
* To prevent being locked out accidentally, use < | * To prevent being locked out accidentally, use <syntaxhighlight lang="nix" inline>ignoreIP</syntaxhighlight> to whitelist IPs or IP ranges to be never cheked. In the example below, common LAN IP address ranges as well as the specific IP '8.8.8.8' and the address associated with the hostname "wiki.nixos.org" are excluded from any bans. Note that the loopback addresses "127.0.0.0/8" and "::1" are added by default. | ||
* < | * <syntaxhighlight lang="nix" inline>bantime</syntaxhighlight> specifies for how much time an IP address is blocked after reaching the maximum number of failures. Note that the bantime can be increased for every violation by setting <syntaxhighlight lang="nix" inline>bantime-increment.enable = true;</syntaxhighlight>. The bantime increment can then be customized by specifying a formula (in Python) like <syntaxhighlight lang="python" inline>ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)</syntaxhighlight> with <syntaxhighlight lang="nix" inline>bantime-increment.formula</syntaxhighlight>, the multipliers with <syntaxhighlight lang="nix" inline>bantime-increment.multipliers</syntaxhighlight>, the maximum bantime with <syntaxhighlight lang="nix" inline>bantime-increment.maxtime</syntaxhighlight> and the indication to consider the bans issued throughout multiple jails with <syntaxhighlight lang="nix" inline>bantime-increment.overalljails</syntaxhighlight> | ||
* < | * <syntaxhighlight lang="nix" inline>banaction</syntaxhighlight> specifies which of the actions in <syntaxhighlight lang="nix" inline>/etc/fail2ban/action.d</syntaxhighlight> should be the default ban action (e.g., iptables, iptables-new, iptables-multiport, iptables-ipset-proto6-allports, shorewall, etc.) | ||
* < | * <syntaxhighlight lang="nix" inline>extraPackages</syntaxhighlight> contains a list of derivations whose outputs are needed by Fail2ban actions | ||
| Line 30: | Line 30: | ||
"10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" | "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" | ||
"8.8.8.8" # whitelist a specific IP | "8.8.8.8" # whitelist a specific IP | ||
"nixos. | "wiki.nixos.org" # resolve the IP via DNS | ||
]; | ]; | ||
bantime = "24h"; # Ban IPs for one day on the first ban | bantime = "24h"; # Ban IPs for one day on the first ban | ||
| Line 61: | Line 61: | ||
== Extending Fail2ban == | == Extending Fail2ban == | ||
Fail2ban capabilities can be freely extended by adding new jails, filters, and actions; the first ones of them are already covered in the "Basic usage" section, while the other two need dedicated config files to be created in the < | Fail2ban capabilities can be freely extended by adding new jails, filters, and actions; the first ones of them are already covered in the "Basic usage" section, while the other two need dedicated config files to be created in the <syntaxhighlight lang="nix" inline>/etc/fail2ban/filter.d</syntaxhighlight> and <syntaxhighlight lang="nix" inline>/etc/fail2ban/action.d</syntaxhighlight> folders. | ||
In order to do this, you'll have to add a < | In order to do this, you'll have to add a <syntaxhighlight lang="nix" inline>environment.etc</syntaxhighlight> section to your NixOS config file and specify there the contents of your custom actions and filters: | ||
<syntaxHighlight lang=nix> | <syntaxHighlight lang=nix> | ||
| Line 83: | Line 83: | ||
The defined filters and actions can then be used in a new jail (created as seen above): | The defined filters and actions can then be used in a new jail (created as seen above): | ||
< | <syntaxhighlight lang="nix"> | ||
services.fail2ban = { | services.fail2ban = { | ||
# --- snip --- | # --- snip --- | ||
jails = { | jails = { | ||
nginx-url-probe.settings = { | |||
enabled = true; | enabled = true; | ||
filter = "nginx-url-probe"; | filter = "nginx-url-probe"; | ||
| Line 99: | Line 99: | ||
}; | }; | ||
}; | }; | ||
</ | </syntaxhighlight> | ||
For more details on how to develop Fail2ban filters please see [https://fail2ban.readthedocs.io/en/latest/filters.html the official documentation]. | For more details on how to develop Fail2ban filters please see [https://fail2ban.readthedocs.io/en/latest/filters.html the official documentation]. | ||
| Line 109: | Line 109: | ||
[[Category:Applications]] | [[Category:Applications]] | ||
[[Category:Server]] | |||
[[Category:Networking]] | |||