From 51b4bf56d796a4dc8a0eaa42534f233924e684d0 Mon Sep 17 00:00:00 2001 From: Frank Brehm Date: Wed, 19 Jul 2017 21:55:54 +0200 Subject: [PATCH] saving uncommitted changes in /etc prior to apt run --- .etckeeper | 2 + fail2ban/action.d/sendmail-common.conf | 52 +- fail2ban/action.d/sendmail-whois.conf | 46 +- fail2ban/action.d/sendmail.conf | 44 +- fail2ban/fail2ban.conf | 38 +- fail2ban/jail.conf | 965 ++++++++++++------ fail2ban/jail.d/postfix.conf | 11 + fail2ban/jail.d/ssh.conf | 12 + motd | 5 +- postfix/main.cf | 2 +- rc2.d/{K01fail2ban => S03fail2ban} | 0 rc3.d/{K01fail2ban => S03fail2ban} | 0 rc4.d/{K01fail2ban => S03fail2ban} | 0 rc5.d/{K01fail2ban => S03fail2ban} | 0 .../multi-user.target.wants/fail2ban.service | 1 + 15 files changed, 783 insertions(+), 395 deletions(-) create mode 100644 fail2ban/jail.d/postfix.conf create mode 100644 fail2ban/jail.d/ssh.conf rename rc2.d/{K01fail2ban => S03fail2ban} (100%) rename rc3.d/{K01fail2ban => S03fail2ban} (100%) rename rc4.d/{K01fail2ban => S03fail2ban} (100%) rename rc5.d/{K01fail2ban => S03fail2ban} (100%) create mode 120000 systemd/system/multi-user.target.wants/fail2ban.service diff --git a/.etckeeper b/.etckeeper index 5a65955..9863558 100755 --- a/.etckeeper +++ b/.etckeeper @@ -568,6 +568,8 @@ maybe chmod 0644 'fail2ban/filter.d/xinetd-fail.conf' maybe chmod 0644 'fail2ban/jail.conf' maybe chmod 0755 'fail2ban/jail.d' maybe chmod 0644 'fail2ban/jail.d/defaults-debian.conf' +maybe chmod 0644 'fail2ban/jail.d/postfix.conf' +maybe chmod 0644 'fail2ban/jail.d/ssh.conf' maybe chmod 0644 'fail2ban/jail.local' maybe chmod 0644 'fail2ban/paths-common.conf' maybe chmod 0644 'fail2ban/paths-debian.conf' diff --git a/fail2ban/action.d/sendmail-common.conf b/fail2ban/action.d/sendmail-common.conf index 1475ded..d4da4f2 100644 --- a/fail2ban/action.d/sendmail-common.conf +++ b/fail2ban/action.d/sendmail-common.conf @@ -8,56 +8,6 @@ after = sendmail-common.local -[Definition] - -# Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. -# Values: CMD -# -actionstart = printf %%b "Subject: [Fail2Ban] : started on `uname -n` - Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` - From: <> - To: \n - Hi,\n - The jail has been started successfully.\n - Regards,\n - Fail2Ban" | /usr/sbin/sendmail -f - -# Option: actionstop -# Notes.: command executed once at the end of Fail2Ban -# Values: CMD -# -actionstop = printf %%b "Subject: [Fail2Ban] : stopped on `uname -n` - Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` - From: <> - To: \n - Hi,\n - The jail has been stopped.\n - Regards,\n - Fail2Ban" | /usr/sbin/sendmail -f - -# Option: actioncheck -# Notes.: command executed once before each actionban command -# Values: CMD -# -actioncheck = - -# Option: actionban -# Notes.: command executed when banning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionban = - -# Option: actionunban -# Notes.: command executed when unbanning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionunban = - [Init] # Recipient mail address @@ -71,3 +21,5 @@ sender = fail2ban # Sender display name # sendername = Fail2Ban + +# vim: filetype=dosini diff --git a/fail2ban/action.d/sendmail-whois.conf b/fail2ban/action.d/sendmail-whois.conf index 55b80bc..2528f7a 100644 --- a/fail2ban/action.d/sendmail-whois.conf +++ b/fail2ban/action.d/sendmail-whois.conf @@ -10,6 +10,38 @@ before = sendmail-common.conf [Definition] +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = printf %%b "Subject: [Fail2Ban] : started on `uname -n` + Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + From: <> + To: \n + Hi,\n + The jail has been started successfully.\n + Regards,\n + Fail2Ban" | /usr/sbin/sendmail -f + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = printf %%b "Subject: [Fail2Ban] : stopped on `uname -n` + Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + From: <> + To: \n + Hi,\n + The jail has been stopped.\n + Regards,\n + Fail2Ban" | /usr/sbin/sendmail -f + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + # Option: actionban # Notes.: command executed when banning an IP. Take care that the # command is executed with Fail2Ban user rights. @@ -17,20 +49,30 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` + Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` From: <> To: \n Hi,\n The IP has just been banned by Fail2Ban after attempts against .\n\n - Here is more information about :\n + Here is more information about :\n `/usr/bin/whois || echo missing whois program`\n Regards,\n Fail2Ban" | /usr/sbin/sendmail -f +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = + [Init] # Default name of the chain # name = default + +# vim: filetype=dosini diff --git a/fail2ban/action.d/sendmail.conf b/fail2ban/action.d/sendmail.conf index 5f5670c..d4c5153 100644 --- a/fail2ban/action.d/sendmail.conf +++ b/fail2ban/action.d/sendmail.conf @@ -10,6 +10,38 @@ before = sendmail-common.conf [Definition] +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = printf %%b "Subject: [Fail2Ban] : started on `uname -n` + Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + From: <> + To: \n + Hi,\n + The jail has been started successfully.\n + Regards,\n + Fail2Ban" | /usr/sbin/sendmail -f + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = printf %%b "Subject: [Fail2Ban] : stopped on `uname -n` + Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` + From: <> + To: \n + Hi,\n + The jail has been stopped.\n + Regards,\n + Fail2Ban" | /usr/sbin/sendmail -f + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + # Option: actionban # Notes.: command executed when banning an IP. Take care that the # command is executed with Fail2Ban user rights. @@ -17,7 +49,7 @@ before = sendmail-common.conf # Values: CMD # actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` - Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"` + Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"` From: <> To: \n Hi,\n @@ -26,9 +58,19 @@ actionban = printf %%b "Subject: [Fail2Ban] : banned from `uname -n` Regards,\n Fail2Ban" | /usr/sbin/sendmail -f +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = + [Init] # Default name of the chain # name = default + +# vim: filetype=dosini diff --git a/fail2ban/fail2ban.conf b/fail2ban/fail2ban.conf index 4acbfb5..56bc561 100644 --- a/fail2ban/fail2ban.conf +++ b/fail2ban/fail2ban.conf @@ -6,20 +6,22 @@ # file, but provide customizations in fail2ban.local file, e.g.: # # [Definition] -# loglevel = 4 +# loglevel = DEBUG # [Definition] # Option: loglevel # Notes.: Set the log level output. -# 1 = ERROR -# 2 = WARN -# 3 = INFO -# 4 = DEBUG -# Values: [ NUM ] Default: 1 +# CRITICAL +# ERROR +# WARNING +# NOTICE +# INFO +# DEBUG +# Values: [ LEVEL ] Default: ERROR # -loglevel = 3 +loglevel = INFO # Option: logtarget # Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT. @@ -30,7 +32,13 @@ loglevel = 3 # (e.g. /etc/logrotate.d/fail2ban on Debian systems) # Values: [ STDOUT | STDERR | SYSLOG | FILE ] Default: STDERR # -logtarget = SYSLOG +logtarget = /var/log/fail2ban.log + +# Option: syslogsocket +# Notes: Set the syslog socket file. Only used when logtarget is SYSLOG +# auto uses platform.system() to determine predefined paths +# Values: [ auto | FILE ] Default: auto +syslogsocket = auto # Option: socket # Notes.: Set the socket file. This is used to communicate with the daemon. Do @@ -47,3 +55,17 @@ socket = /var/run/fail2ban/fail2ban.sock # pidfile = /var/run/fail2ban/fail2ban.pid +# Options: dbfile +# Notes.: Set the file for the fail2ban persistent data to be stored. +# A value of ":memory:" means database is only stored in memory +# and data is lost when fail2ban is stopped. +# A value of "None" disables the database. +# Values: [ None :memory: FILE ] Default: /var/lib/fail2ban/fail2ban.sqlite3 +dbfile = /var/lib/fail2ban/fail2ban.sqlite3 + +# Options: dbpurgeage +# Notes.: Sets age at which bans should be purged from the database +# Values: [ SECONDS ] Default: 86400 (24hours) +dbpurgeage = 86400 + +# vim: filetype=dosini diff --git a/fail2ban/jail.conf b/fail2ban/jail.conf index 6db6aac..83809ef 100644 --- a/fail2ban/jail.conf +++ b/fail2ban/jail.conf @@ -1,23 +1,52 @@ -# Fail2Ban configuration file. # -# This file was composed for Debian systems from the original one -# provided now under /usr/share/doc/fail2ban/examples/jail.conf -# for additional examples. +# WARNING: heavily refactored in 0.9.0 release. Please review and +# customize settings for your setup. # -# Comments: use '#' for comment lines and ';' for inline comments +# Changes: in most of the cases you should not modify this +# file, but provide customizations in jail.local file, +# or separate .conf files under jail.d/ directory, e.g.: # -# To avoid merges during upgrades DO NOT MODIFY THIS FILE -# and rather provide your changes in /etc/fail2ban/jail.local +# HOW TO ACTIVATE JAILS: # +# YOU SHOULD NOT MODIFY THIS FILE. +# +# It will probably be overwritten or improved in a distribution update. +# +# Provide customizations in a jail.local file or a jail.d/customisation.local. +# For example to change the default bantime for all jails and to enable the +# ssh-iptables jail the following (uncommented) would appear in the .local file. +# See man 5 jail.conf for details. +# +# [DEFAULT] +# bantime = 3600 +# +# [sshd] +# enabled = true +# +# See jail.conf(5) man page for more information + + + +# Comments: use '#' for comment lines and ';' (following a space) for inline comments + + +[INCLUDES] + +#before = paths-distro.conf +before = paths-debian.conf # The DEFAULT allows a global definition of the options. They can be overridden # in each jail afterwards. [DEFAULT] +# +# MISCELLANEOUS OPTIONS +# + # "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not # ban a host which matches an address in this list. Several addresses can be -# defined using space separator. +# defined using space (and/or comma) separator. ignoreip = 127.0.0.1/8 # External command that will take an tagged arguments to ignore, e.g. , @@ -31,57 +60,81 @@ bantime = 600 # A host is banned if it has generated "maxretry" during the last "findtime" # seconds. -findtime = 600 +findtime = 600 + +# "maxretry" is the number of failures before a host get banned. maxretry = 3 # "backend" specifies the backend used to get files modification. -# Available options are "pyinotify", "gamin", "polling" and "auto". +# Available options are "pyinotify", "gamin", "polling", "systemd" and "auto". # This option can be overridden in each jail as well. # # pyinotify: requires pyinotify (a file alteration monitor) to be installed. -# If pyinotify is not installed, Fail2ban will use auto. +# If pyinotify is not installed, Fail2ban will use auto. # gamin: requires Gamin (a file alteration monitor) to be installed. -# If Gamin is not installed, Fail2ban will use auto. +# If Gamin is not installed, Fail2ban will use auto. # polling: uses a polling algorithm which does not require external libraries. +# systemd: uses systemd python library to access the systemd journal. +# Specifying "logpath" is not valid for this backend. +# See "journalmatch" in the jails associated filter config # auto: will try to use the following backends, in order: -# pyinotify, gamin, polling. +# pyinotify, gamin, polling. +# +# Note: if systemd backend is chosen as the default but you enable a jail +# for which logs are present only in its own log files, specify some other +# backend for that jail (e.g. polling) and provide empty value for +# journalmatch. See https://github.com/fail2ban/fail2ban/issues/959#issuecomment-74901200 backend = auto # "usedns" specifies if jails should trust hostnames in logs, -# warn when reverse DNS lookups are performed, or ignore all hostnames in logs +# warn when DNS lookups are performed, or ignore all hostnames in logs # -# yes: if a hostname is encountered, a reverse DNS lookup will be performed. -# warn: if a hostname is encountered, a reverse DNS lookup will be performed, +# yes: if a hostname is encountered, a DNS lookup will be performed. +# warn: if a hostname is encountered, a DNS lookup will be performed, # but it will be logged as a warning. # no: if a hostname is encountered, will not be used for banning, # but it will be logged as info. +# raw: use raw value (no hostname), allow use it for no-host filters/actions (example user) usedns = warn +# "logencoding" specifies the encoding of the log files handled by the jail +# This is used to decode the lines from the log file. +# Typical examples: "ascii", "utf-8" # -# Destination email address used solely for the interpolations in -# jail.{conf,local} configuration files. -destemail = root@localhost +# auto: will use the system locale setting +logencoding = utf-8 + +# "enabled" enables the jails. +# By default all jails are disabled, and it should stay this way. +# Enable only relevant to your setup jails in your .local or jail.d/*.conf +# +# true: jail will be enabled and log files will get monitored for changes +# false: jail is not enabled +enabled = false + +# "filter" defines the filter to use by the jail. +# By default jails have names matching their filter name # -# Name of the sender for mta actions -sendername = Fail2Ban +filter = %(__name__)s -# Email address of the sender -sender = fail2ban@localhost # # ACTIONS # -# Default banning action (e.g. iptables, iptables-new, -# iptables-multiport, shorewall, etc) It is used to define -# action_* variables. Can be overridden globally or per -# section within jail.local file -banaction = iptables-multiport +# Some options used for actions + +# Destination email address used solely for the interpolations in +# jail.{conf,local,d/*} configuration files. +destemail = frank@brehm-online.com + +# Sender email address used solely for some actions +sender = fail2ban+sarah@brehm-online.com -# email action. Since 0.8.1 upstream fail2ban uses sendmail -# MTA for the mailing. Change mta configuration parameter to mail -# if you want to revert to conventional 'mail'. +# E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA for the +# mailing. Change mta configuration parameter to mail if you want to +# revert to conventional 'mail'. mta = sendmail # Default protocol @@ -90,303 +143,461 @@ protocol = tcp # Specify chain where jumps would need to be added in iptables-* actions chain = INPUT +# Ports to be banned +# Usually should be overridden in a particular jail +port = 0:65535 + +# Format of user-agent https://tools.ietf.org/html/rfc7231#section-5.5.3 +fail2ban_agent = Fail2Ban/%(fail2ban_version)s + # # Action shortcuts. To be used to define action parameter +# Default banning action (e.g. iptables, iptables-new, +# iptables-multiport, shorewall, etc) It is used to define +# action_* variables. Can be overridden globally or per +# section within jail.local file +banaction = iptables-multiport +banaction_allports = iptables-allports + # The simplest action to take: ban only -action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] +action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] # ban & send an e-mail with whois report to the destemail. -action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] - %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s", sendername="%(sendername)s"] +action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] + %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"] # ban & send an e-mail with whois report and relevant log lines # to the destemail. -action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] - %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"] +action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] + %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"] + +# See the IMPORTANT note in action.d/xarf-login-attack for when to use this action +# +# ban & send a xarf e-mail to abuse contact of IP address and include relevant log lines +# to the destemail. +action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] + xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"] + +# ban IP on CloudFlare & send an e-mail with whois report and relevant log lines +# to the destemail. +action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"] + %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"] + +# Report block via blocklist.de fail2ban reporting service API +# +# See the IMPORTANT note in action.d/blocklist_de.conf for when to +# use this action. Create a file jail.d/blocklist_de.local containing +# [Init] +# blocklist_de_apikey = {api key from registration] +# +action_blocklist_de = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"] + +# Report ban via badips.com, and use as blacklist +# +# See BadIPsAction docstring in config/action.d/badips.py for +# documentation for this action. +# +# NOTE: This action relies on banaction being present on start and therefore +# should be last action defined for a jail. +# +action_badips = badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"] +# +# Report ban via badips.com (uses action.d/badips.conf for reporting only) +# +action_badips_report = badips[category="%(__name__)s", agent="%(fail2ban_agent)s"] # Choose default action. To change, just override value of 'action' with the # interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local # globally (section [DEFAULT]) or per specific section action = %(action_)s + # # JAILS # -# Next jails corresponds to the standard configuration in Fail2ban 0.6 which -# was shipped in Debian. Enable any defined here jail by including # -# [SECTION_NAME] -# enabled = true +# SSH servers +# + +#[sshd] + +#port = ssh +#logpath = %(sshd_log)s +#backend = %(sshd_backend)s + + +#[sshd-ddos] +# This jail corresponds to the standard configuration in Fail2ban. +# The mail-whois action send a notification e-mail with a whois request +# in the body. +#port = ssh +#logpath = %(sshd_log)s +#backend = %(sshd_backend)s + + +#[dropbear] + +#port = ssh +#logpath = %(dropbear_log)s +#backend = %(dropbear_backend)s + + +#[selinux-ssh] + +#port = ssh +#logpath = %(auditd_log)s + # -# in /etc/fail2ban/jail.local. +# HTTP servers # -# Optionally you may override any other parameter (e.g. banaction, -# action, port, logpath, etc) in that section within jail.local -[ssh] +#[apache-auth] -enabled = false -port = ssh -filter = sshd -logpath = /var/log/auth.log -maxretry = 6 +#port = http,https +#logpath = %(apache_error_log)s -[dropbear] -enabled = false -port = ssh -filter = dropbear -logpath = /var/log/auth.log -maxretry = 6 +#[apache-badbots] +# Ban hosts which agent identifies spammer robots crawling the web +# for email addresses. The mail outputs are buffered. +#port = http,https +#logpath = %(apache_access_log)s +#bantime = 172800 +#maxretry = 1 -# Generic filter for pam. Has to be used with action which bans all ports -# such as iptables-allports, shorewall -[pam-generic] -enabled = false -# pam-generic filter can be customized to monitor specific subset of 'tty's -filter = pam-generic -# port actually must be irrelevant but lets leave it all for some possible uses -port = all -banaction = iptables-allports -port = anyport -logpath = /var/log/auth.log -maxretry = 6 +#[apache-noscript] -[xinetd-fail] +#port = http,https +#logpath = %(apache_error_log)s -enabled = false -filter = xinetd-fail -port = all -banaction = iptables-multiport-log -logpath = /var/log/daemon.log -maxretry = 2 +#[apache-overflows] -[ssh-ddos] +#port = http,https +#logpath = %(apache_error_log)s +#maxretry = 2 -enabled = false -port = ssh -filter = sshd-ddos -logpath = /var/log/auth.log -maxretry = 6 +#[apache-nohome] -# Here we use blackhole routes for not requiring any additional kernel support -# to store large volumes of banned IPs +#port = http,https +#logpath = %(apache_error_log)s +#maxretry = 2 -[ssh-route] -enabled = false -filter = sshd -action = route -logpath = /var/log/sshd.log -maxretry = 6 +#[apache-botsearch] -# Here we use a combination of Netfilter/Iptables and IPsets -# for storing large volumes of banned IPs -# -# IPset comes in two versions. See ipset -V for which one to use -# requires the ipset package and kernel support. -[ssh-iptables-ipset4] +#port = http,https +#logpath = %(apache_error_log)s +#maxretry = 2 -enabled = false -port = ssh -filter = sshd -banaction = iptables-ipset-proto4 -logpath = /var/log/sshd.log -maxretry = 6 -[ssh-iptables-ipset6] +#[apache-fakegooglebot] -enabled = false -port = ssh -filter = sshd -banaction = iptables-ipset-proto6 -logpath = /var/log/sshd.log -maxretry = 6 +#port = http,https +#logpath = %(apache_access_log)s +#maxretry = 1 +#ignorecommand = %(ignorecommands_dir)s/apache-fakegooglebot -# -# HTTP servers -# +#[apache-modsecurity] -[apache] +#port = http,https +#logpath = %(apache_error_log)s +#maxretry = 2 -enabled = false -port = http,https -filter = apache-auth -logpath = /var/log/apache*/*error.log -maxretry = 6 -# default action is now multiport, so apache-multiport jail was left -# for compatibility with previous (<0.7.6-2) releases -[apache-multiport] +#[apache-shellshock] -enabled = false -port = http,https -filter = apache-auth -logpath = /var/log/apache*/*error.log -maxretry = 6 +#port = http,https +#logpath = %(apache_error_log)s +#maxretry = 1 -[apache-noscript] -enabled = false -port = http,https -filter = apache-noscript -logpath = /var/log/apache*/*error.log -maxretry = 6 +#[openhab-auth] -[apache-overflows] +#filter = openhab +#action = iptables-allports[name=NoAuthFailures] +#logpath = /opt/openhab/logs/request.log -enabled = false -port = http,https -filter = apache-overflows -logpath = /var/log/apache*/*error.log -maxretry = 2 -[apache-modsecurity] +#[nginx-http-auth] -enabled = false -filter = apache-modsecurity -port = http,https -logpath = /var/log/apache*/*error.log -maxretry = 2 +#port = http,https +#logpath = %(nginx_error_log)s -[apache-nohome] +# To use 'nginx-limit-req' jail you should have `ngx_http_limit_req_module` +# and define `limit_req` and `limit_req_zone` as described in nginx documentation +# http://nginx.org/en/docs/http/ngx_http_limit_req_module.html +# or for example see in 'config/filter.d/nginx-limit-req.conf' +#[nginx-limit-req] +#port = http,https +#logpath = %(nginx_error_log)s + +#[nginx-botsearch] + +#port = http,https +#logpath = %(nginx_error_log)s +#maxretry = 2 -enabled = false -filter = apache-nohome -port = http,https -logpath = /var/log/apache*/*error.log -maxretry = 2 # Ban attackers that try to use PHP's URL-fopen() functionality # through GET/POST variables. - Experimental, with more than a year # of usage in production environments. -[php-url-fopen] +#[php-url-fopen] -enabled = false -port = http,https -filter = php-url-fopen -logpath = /var/www/*/logs/access_log +#port = http,https +#logpath = %(nginx_access_log)s +# %(apache_access_log)s -# A simple PHP-fastcgi jail which works with lighttpd. -# If you run a lighttpd server, then you probably will -# find these kinds of messages in your error_log: -# ALERT – tried to register forbidden variable ‘GLOBALS’ -# through GET variables (attacker '1.2.3.4', file '/var/www/default/htdocs/index.php') -[lighttpd-fastcgi] +#[suhosin] -enabled = false -port = http,https -filter = lighttpd-fastcgi -logpath = /var/log/lighttpd/error.log +#port = http,https +#logpath = %(suhosin_log)s -# Same as above for mod_auth + +#[lighttpd-auth] +# Same as above for Apache's mod_auth # It catches wrong authentifications +#port = http,https +#logpath = %(lighttpd_error_log)s -[lighttpd-auth] -enabled = false -port = http,https -filter = suhosin -logpath = /var/log/lighttpd/error.log +# +# Webmail and groupware servers +# -[nginx-http-auth] +#[roundcube-auth] -enabled = false -filter = nginx-http-auth -port = http,https -logpath = /var/log/nginx/error.log +#port = http,https +#logpath = %(roundcube_errors_log)s -# Monitor roundcube server -[roundcube-auth] +#[openwebmail] -enabled = false -filter = roundcube-auth -port = http,https -logpath = /var/log/roundcube/userlogins +#port = http,https +#logpath = /var/log/openwebmail.log -[sogo-auth] +#[horde] -enabled = false -filter = sogo-auth -port = http, https +#port = http,https +#logpath = /var/log/horde/horde.log + + +#[groupoffice] + +#port = http,https +#logpath = /home/groupoffice/log/info.log + + +#[sogo-auth] +# Monitor SOGo groupware server # without proxy this would be: # port = 20000 -logpath = /var/log/sogo/sogo.log +#port = http,https +#logpath = /var/log/sogo/sogo.log + + +#[tine20] + +#logpath = /var/log/tine20/tine20.log +#port = http,https + + +# +# Web Applications +# +# + +#[drupal-auth] + +#port = http,https +#logpath = %(syslog_daemon)s +#backend = %(syslog_backend)s + +#[guacamole] + +#port = http,https +#logpath = /var/log/tomcat*/catalina.out + +#[monit] +#Ban clients brute-forcing the monit gui login +#port = 2812 +#logpath = /var/log/monit + + +#[webmin-auth] + +#port = 10000 +#logpath = %(syslog_authpriv)s +#backend = %(syslog_backend)s + + +#[froxlor-auth] + +#port = http,https +#logpath = %(syslog_authpriv)s +#backend = %(syslog_backend)s + + +# +# HTTP Proxy servers +# +# + +#[squid] + +#port = 80,443,3128,8080 +#logpath = /var/log/squid/access.log + + +#[3proxy] + +#port = 3128 +#logpath = /var/log/3proxy.log # # FTP servers # -[vsftpd] -enabled = false -port = ftp,ftp-data,ftps,ftps-data -filter = vsftpd -logpath = /var/log/vsftpd.log -# or overwrite it in jails.local to be -# logpath = /var/log/auth.log -# if you want to rely on PAM failed login attempts -# vsftpd's failregex should match both of those formats -maxretry = 6 +#[proftpd] +#port = ftp,ftp-data,ftps,ftps-data +#logpath = %(proftpd_log)s +#backend = %(proftpd_backend)s -[proftpd] -enabled = false -port = ftp,ftp-data,ftps,ftps-data -filter = proftpd -logpath = /var/log/proftpd/proftpd.log -maxretry = 6 +#[pure-ftpd] +#port = ftp,ftp-data,ftps,ftps-data +#logpath = %(pureftpd_log)s +#backend = %(pureftpd_backend)s -[pure-ftpd] -enabled = false -port = ftp,ftp-data,ftps,ftps-data -filter = pure-ftpd -logpath = /var/log/syslog -maxretry = 6 +#[gssftpd] +#port = ftp,ftp-data,ftps,ftps-data +#logpath = %(syslog_daemon)s +#backend = %(syslog_backend)s -[wuftpd] -enabled = false -port = ftp,ftp-data,ftps,ftps-data -filter = wuftpd -logpath = /var/log/syslog -maxretry = 6 +#[wuftpd] + +#port = ftp,ftp-data,ftps,ftps-data +#logpath = %(wuftpd_log)s +#backend = %(wuftpd_backend)s + + +#[vsftpd] +# or overwrite it in jails.local to be +# logpath = %(syslog_authpriv)s +# if you want to rely on PAM failed login attempts +# vsftpd's failregex should match both of those formats +#port = ftp,ftp-data,ftps,ftps-data +#logpath = %(vsftpd_log)s # # Mail servers # -[postfix] +# ASSP SMTP Proxy Jail +#[assp] -enabled = false -port = smtp,ssmtp,submission -filter = postfix -logpath = /var/log/mail.log +#port = smtp,465,submission +#logpath = /root/path/to/assp/logs/maillog.txt -[couriersmtp] +#[courier-smtp] -enabled = false -port = smtp,ssmtp,submission -filter = couriersmtp -logpath = /var/log/mail.log +#port = smtp,465,submission +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s + + +#[postfix] + +#port = smtp,465,submission +#logpath = %(postfix_log)s +#backend = %(postfix_backend)s + + +#[postfix-rbl] + +#port = smtp,465,submission +#logpath = %(postfix_log)s +#backend = %(postfix_backend)s +#maxretry = 1 + + +#[sendmail-auth] + +#port = submission,465,smtp +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s + + +#[sendmail-reject] + +#port = smtp,465,submission +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s + + +#[qmail-rbl] + +#filter = qmail +#port = smtp,465,submission +#logpath = /service/qmail/log/main/current + + +# dovecot defaults to logging to the mail syslog facility +# but can be set by syslog_facility in the dovecot configuration. +#[dovecot] + +#port = pop3,pop3s,imap,imaps,submission,465,sieve +#logpath = %(dovecot_log)s +#backend = %(dovecot_backend)s + + +#[sieve] + +#port = smtp,465,submission +#logpath = %(dovecot_log)s +#backend = %(dovecot_backend)s + + +#[solid-pop3d] + +#port = pop3,pop3s +#logpath = %(solidpop3d_log)s + + +#[exim] + +#port = smtp,465,submission +#logpath = %(exim_main_log)s + + +#[exim-spam] + +#port = smtp,465,submission +#logpath = %(exim_main_log)s + + +#[kerio] + +#port = imap,smtp,imaps,465 +#logpath = /opt/kerio/mailserver/store/logs/security.log # @@ -394,60 +605,55 @@ logpath = /var/log/mail.log # all relevant ports get banned # -[courierauth] +#[courier-auth] -enabled = false -port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s -filter = courierlogin -logpath = /var/log/mail.log +#port = smtp,465,submission,imap3,imaps,pop3,pop3s +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s -[sasl] +#[postfix-sasl] -enabled = false -port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s -filter = postfix-sasl +#port = smtp,465,submission,imap3,imaps,pop3,pop3s # You might consider monitoring /var/log/mail.warn instead if you are # running postfix since it would provide the same log lines at the # "warn" level but overall at the smaller filesize. -logpath = /var/log/mail.log +#logpath = %(postfix_log)s +#backend = %(postfix_backend)s -[dovecot] -enabled = false -port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s -filter = dovecot -logpath = /var/log/mail.log +#[perdition] -# To log wrong MySQL access attempts add to /etc/my.cnf: -# log-error=/var/log/mysqld.log -# log-warning = 2 -[mysqld-auth] +#port = imap3,imaps,pop3,pop3s +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s + + +#[squirrelmail] + +#port = smtp,465,submission,imap2,imap3,imaps,pop3,pop3s,http,https,socks +#logpath = /var/lib/squirrelmail/prefs/squirrelmail_access_log + + +#[cyrus-imap] + +#port = imap3,imaps +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s -enabled = false -filter = mysqld-auth -port = 3306 -logpath = /var/log/mysqld.log +#[uwimap-auth] -# DNS Servers +#port = imap3,imaps +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s -# These jails block attacks against named (bind9). By default, logging is off -# with bind9 installation. You will need something like this: # -# logging { -# channel security_file { -# file "/var/log/named/security.log" versions 3 size 30m; -# severity dynamic; -# print-time yes; -# }; -# category security { -# security_file; -# }; -# }; # -# in your named.conf to provide proper logging +# DNS servers +# + # !!! WARNING !!! # Since UDP is connection-less protocol, spoofing of IP and imitation @@ -456,97 +662,196 @@ logpath = /var/log/mysqld.log # victim. See # http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html # Please DO NOT USE this jail unless you know what you are doing. -#[named-refused-udp] # -#enabled = false +# IMPORTANT: see filter.d/named-refused for instructions to enable logging +# This jail blocks UDP traffic for DNS requests. +# [named-refused-udp] +# +# filter = named-refused +# port = domain,953 +# protocol = udp +# logpath = /var/log/named/security.log + +# IMPORTANT: see filter.d/named-refused for instructions to enable logging +# This jail blocks TCP traffic for DNS requests. + +#[named-refused] + #port = domain,953 -#protocol = udp -#filter = named-refused #logpath = /var/log/named/security.log -[named-refused-tcp] -enabled = false -port = domain,953 -protocol = tcp -filter = named-refused -logpath = /var/log/named/security.log +#[nsd] -[freeswitch] +#port = 53 +#action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] +# %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] +#logpath = /var/log/nsd.log -enabled = false -filter = freeswitch -logpath = /var/log/freeswitch.log -maxretry = 10 -action = iptables-multiport[name=freeswitch-tcp, port="5060,5061,5080,5081", protocol=tcp] - iptables-multiport[name=freeswitch-udp, port="5060,5061,5080,5081", protocol=udp] -[ejabberd-auth] +# +# Miscellaneous +# -enabled = false -filter = ejabberd-auth -port = xmpp-client -protocol = tcp -logpath = /var/log/ejabberd/ejabberd.log +#[asterisk] +#port = 5060,5061 +#action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] +# %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] +# %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"] +#logpath = /var/log/asterisk/messages +#maxretry = 10 -# Multiple jails, 1 per protocol, are necessary ATM: -# see https://github.com/fail2ban/fail2ban/issues/37 -[asterisk-tcp] -enabled = false -filter = asterisk -port = 5060,5061 -protocol = tcp -logpath = /var/log/asterisk/messages +#[freeswitch] -[asterisk-udp] +#port = 5060,5061 +#action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] +# %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] +# %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"] +#logpath = /var/log/freeswitch.log +#maxretry = 10 + + +# To log wrong MySQL access attempts add to /etc/my.cnf in [mysqld] or +# equivalent section: +# log-warning = 2 +# +# for syslog (daemon facility) +# [mysqld_safe] +# syslog +# +# for own logfile +# [mysqld] +# log-error=/var/log/mysqld.log +#[mysqld-auth] + +#port = 3306 +#logpath = %(mysql_log)s +#backend = %(mysql_backend)s -enabled = false -filter = asterisk -port = 5060,5061 -protocol = udp -logpath = /var/log/asterisk/messages + +# Log wrong MongoDB auth (for details see filter 'filter.d/mongodb-auth.conf') +#[mongodb-auth] +# change port when running with "--shardsvr" or "--configsvr" runtime operation +#port = 27017 +#logpath = /var/log/mongodb/mongodb.log # Jail for more extended banning of persistent abusers -# !!! WARNING !!! -# Make sure that your loglevel specified in fail2ban.conf/.local -# is not at DEBUG level -- which might then cause fail2ban to fall into -# an infinite loop constantly feeding itself with non-informative lines -[recidive] +# !!! WARNINGS !!! +# 1. Make sure that your loglevel specified in fail2ban.conf/.local +# is not at DEBUG level -- which might then cause fail2ban to fall into +# an infinite loop constantly feeding itself with non-informative lines +# 2. Increase dbpurgeage defined in fail2ban.conf to e.g. 648000 (7.5 days) +# to maintain entries for failed logins for sufficient amount of time +#[recidive] -enabled = false -filter = recidive -logpath = /var/log/fail2ban.log -action = iptables-allports[name=recidive] - sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log] -bantime = 604800 ; 1 week -findtime = 86400 ; 1 day -maxretry = 5 +#logpath = /var/log/fail2ban.log +#banaction = %(banaction_allports)s +#bantime = 604800 ; 1 week +#findtime = 86400 ; 1 day -# See the IMPORTANT note in action.d/blocklist_de.conf for when to -# use this action -# -# Report block via blocklist.de fail2ban reporting service API -# See action.d/blocklist_de.conf for more information -[ssh-blocklist] -enabled = false -filter = sshd -action = iptables[name=SSH, port=ssh, protocol=tcp] - sendmail-whois[name=SSH, dest="%(destemail)s", sender="%(sender)s", sendername="%(sendername)s"] - blocklist_de[email="%(sender)s", apikey="xxxxxx", service="%(filter)s"] -logpath = /var/log/sshd.log -maxretry = 20 +# Generic filter for PAM. Has to be used with action which bans all +# ports such as iptables-allports, shorewall +#[pam-generic] +# pam-generic filter can be customized to monitor specific subset of 'tty's +#banaction = %(banaction_allports)s +#logpath = %(syslog_authpriv)s +#backend = %(syslog_backend)s + + +#[xinetd-fail] + +#banaction = iptables-multiport-log +#logpath = %(syslog_daemon)s +#backend = %(syslog_backend)s +#maxretry = 2 + + +# stunnel - need to set port for this +#[stunnel] + +#logpath = /var/log/stunnel4/stunnel.log + + +#[ejabberd-auth] + +#port = 5222 +#logpath = /var/log/ejabberd/ejabberd.log + + +#[counter-strike] + +#logpath = /opt/cstrike/logs/L[0-9]*.log +# Firewall: http://www.cstrike-planet.com/faq/6 +#tcpport = 27030,27031,27032,27033,27034,27035,27036,27037,27038,27039 +#udpport = 1200,27000,27001,27002,27003,27004,27005,27006,27007,27008,27009,27010,27011,27012,27013,27014,27015 +#action = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] +# %(banaction)s[name=%(__name__)s-udp, port="%(udpport)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] # consider low maxretry and a long bantime # nobody except your own Nagios server should ever probe nrpe -[nagios] -enabled = false -filter = nagios -action = iptables[name=Nagios, port=5666, protocol=tcp] - sendmail-whois[name=Nagios, dest="%(destemail)s", sender="%(sender)s", sendername="%(sendername)s"] -logpath = /var/log/messages ; nrpe.cfg may define a different log_facility -maxretry = 1 +#[nagios] + +#logpath = %(syslog_daemon)s ; nrpe.cfg may define a different log_facility +#backend = %(syslog_backend)s +#maxretry = 1 + + +#[oracleims] +# see "oracleims" filter file for configuration requirement for Oracle IMS v6 and above +#logpath = /opt/sun/comms/messaging64/log/mail.log_current +#banaction = %(banaction_allports)s + +#[directadmin] +#logpath = /var/log/directadmin/login.log +#port = 2222 + +#[portsentry] +#logpath = /var/lib/portsentry/portsentry.history +#maxretry = 1 + +#[pass2allow-ftp] +# this pass2allow example allows FTP traffic after successful HTTP authentication +#port = ftp,ftp-data,ftps,ftps-data +# knocking_url variable must be overridden to some secret value in jail.local +#knocking_url = /knocking/ +#filter = apache-pass[knocking_url="%(knocking_url)s"] +# access log of the website with HTTP auth +#logpath = %(apache_access_log)s +#blocktype = RETURN +#returntype = DROP +#bantime = 3600 +#maxretry = 1 +#findtime = 1 + + +#[murmur] +# AKA mumble-server +#port = 64738 +#action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol=tcp, chain="%(chain)s", actname=%(banaction)s-tcp] +# %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol=udp, chain="%(chain)s", actname=%(banaction)s-udp] +#logpath = /var/log/mumble-server/mumble-server.log + + +#[screensharingd] +# For Mac OS Screen Sharing Service (VNC) +#logpath = /var/log/system.log +#logencoding = utf-8 + +#[haproxy-http-auth] +# HAProxy by default doesn't log to file you'll need to set it up to forward +# logs to a syslog server which would then write them to disk. +# See "haproxy-http-auth" filter for a brief cautionary note when setting +# maxretry and findtime. +#logpath = /var/log/haproxy.log + +#[slapd] +#port = ldap,ldaps +#filter = slapd +#logpath = /var/log/slapd.log + +# vim: filetype=dosini diff --git a/fail2ban/jail.d/postfix.conf b/fail2ban/jail.d/postfix.conf new file mode 100644 index 0000000..3b1751a --- /dev/null +++ b/fail2ban/jail.d/postfix.conf @@ -0,0 +1,11 @@ + +[postfix] + +enabled = true +port = smtp,ssmtp,submission +filter = postfix +logpath = /var/log/syslog.d/mail.log +action = %(action_mw)s + + +# vim: filetype=dosini diff --git a/fail2ban/jail.d/ssh.conf b/fail2ban/jail.d/ssh.conf new file mode 100644 index 0000000..3bd8c6a --- /dev/null +++ b/fail2ban/jail.d/ssh.conf @@ -0,0 +1,12 @@ + +[ssh] + +enabled = true +port = ssh +filter = sshd +logpath = /var/log/syslog.d/auth.log +action = %(action_)s +maxretry = 6 + + +# vim: filetype=dosini diff --git a/motd b/motd index 758f7c0..acbfa5c 100644 --- a/motd +++ b/motd @@ -1,4 +1,3 @@ -Linux sarah 4.9.0-0.bpo.2-amd64 #1 SMP Debian 4.9.18-1~bpo8+1 (2017-04-10) x86_64 GNU/Linux Debian GNU/Linux 9.0 (stretch) ____ _ / ___| __ _ _ __ __ _| |__ @@ -7,8 +6,8 @@ Debian GNU/Linux 9.0 (stretch) |____/ \__,_|_| \__,_|_| |_| -Ich gehe jetzt in den Birkenwald, -denn meine Pillen wirken bald. +Wenn wir zusammenhalten, werden wir den Teufel aus der Hölle schlagen. + -- Otto von Bismarck Today is Setting Orange, the 54th day of Confusion in the YOLD 3183 diff --git a/postfix/main.cf b/postfix/main.cf index 319d0d5..2f33a63 100644 --- a/postfix/main.cf +++ b/postfix/main.cf @@ -10,7 +10,7 @@ command_directory = /usr/sbin # location of all Postfix daemon programs (i.e. programs listed in the # master.cf file). This directory must be owned by root. # Default is /usr/libexec/postfix -daemon_directory = /usr/lib/postfix +#daemon_directory = /usr/lib/postfix # location of Postfix-writable data files (caches, random numbers). # This directory must be owned by the mail_owner account (see below). diff --git a/rc2.d/K01fail2ban b/rc2.d/S03fail2ban similarity index 100% rename from rc2.d/K01fail2ban rename to rc2.d/S03fail2ban diff --git a/rc3.d/K01fail2ban b/rc3.d/S03fail2ban similarity index 100% rename from rc3.d/K01fail2ban rename to rc3.d/S03fail2ban diff --git a/rc4.d/K01fail2ban b/rc4.d/S03fail2ban similarity index 100% rename from rc4.d/K01fail2ban rename to rc4.d/S03fail2ban diff --git a/rc5.d/K01fail2ban b/rc5.d/S03fail2ban similarity index 100% rename from rc5.d/K01fail2ban rename to rc5.d/S03fail2ban diff --git a/systemd/system/multi-user.target.wants/fail2ban.service b/systemd/system/multi-user.target.wants/fail2ban.service new file mode 120000 index 0000000..8eb44c2 --- /dev/null +++ b/systemd/system/multi-user.target.wants/fail2ban.service @@ -0,0 +1 @@ +/lib/systemd/system/fail2ban.service \ No newline at end of file -- 2.39.5