From 567c5df95fae1719463b634496afa9d18714bb93 Mon Sep 17 00:00:00 2001 From: Frank Brehm Date: Tue, 18 Jul 2017 14:09:02 +0200 Subject: [PATCH] saving uncommitted changes in /etc prior to apt run --- fail2ban/fail2ban.conf | 2 + fail2ban/jail.conf | 971 +++++++++++++++++++++++++++-------------- iptables/rules.v4 | 40 +- iptables/rules.v6 | 6 +- motd | 5 +- 5 files changed, 676 insertions(+), 348 deletions(-) diff --git a/fail2ban/fail2ban.conf b/fail2ban/fail2ban.conf index 89e2538..56bc561 100644 --- a/fail2ban/fail2ban.conf +++ b/fail2ban/fail2ban.conf @@ -67,3 +67,5 @@ dbfile = /var/lib/fail2ban/fail2ban.sqlite3 # Notes.: Sets age at which bans should be purged from the database # Values: [ SECONDS ] Default: 86400 (24hours) dbpurgeage = 86400 + +# vim: filetype=dosini diff --git a/fail2ban/jail.conf b/fail2ban/jail.conf index 57381e6..235d832 100644 --- a/fail2ban/jail.conf +++ b/fail2ban/jail.conf @@ -1,23 +1,52 @@ -# Fail2Ban configuration file. # -# This file was composed for Debian systems from the original one -# provided now under /usr/share/doc/fail2ban/examples/jail.conf -# for additional examples. +# WARNING: heavily refactored in 0.9.0 release. Please review and +# customize settings for your setup. # -# Comments: use '#' for comment lines and ';' for inline comments +# Changes: in most of the cases you should not modify this +# file, but provide customizations in jail.local file, +# or separate .conf files under jail.d/ directory, e.g.: # -# To avoid merges during upgrades DO NOT MODIFY THIS FILE -# and rather provide your changes in /etc/fail2ban/jail.local +# HOW TO ACTIVATE JAILS: # +# YOU SHOULD NOT MODIFY THIS FILE. +# +# It will probably be overwritten or improved in a distribution update. +# +# Provide customizations in a jail.local file or a jail.d/customisation.local. +# For example to change the default bantime for all jails and to enable the +# ssh-iptables jail the following (uncommented) would appear in the .local file. +# See man 5 jail.conf for details. +# +# [DEFAULT] +# bantime = 3600 +# +# [sshd] +# enabled = true +# +# See jail.conf(5) man page for more information + + + +# Comments: use '#' for comment lines and ';' (following a space) for inline comments + + +[INCLUDES] + +#before = paths-distro.conf +before = paths-debian.conf # The DEFAULT allows a global definition of the options. They can be overridden # in each jail afterwards. [DEFAULT] +# +# MISCELLANEOUS OPTIONS +# + # "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not # ban a host which matches an address in this list. Several addresses can be -# defined using space separator. +# defined using space (and/or comma) separator. ignoreip = 127.0.0.1/8 # External command that will take an tagged arguments to ignore, e.g. , @@ -31,57 +60,81 @@ bantime = 600 # A host is banned if it has generated "maxretry" during the last "findtime" # seconds. -findtime = 600 +findtime = 600 + +# "maxretry" is the number of failures before a host get banned. maxretry = 3 # "backend" specifies the backend used to get files modification. -# Available options are "pyinotify", "gamin", "polling" and "auto". +# Available options are "pyinotify", "gamin", "polling", "systemd" and "auto". # This option can be overridden in each jail as well. # # pyinotify: requires pyinotify (a file alteration monitor) to be installed. -# If pyinotify is not installed, Fail2ban will use auto. +# If pyinotify is not installed, Fail2ban will use auto. # gamin: requires Gamin (a file alteration monitor) to be installed. -# If Gamin is not installed, Fail2ban will use auto. +# If Gamin is not installed, Fail2ban will use auto. # polling: uses a polling algorithm which does not require external libraries. +# systemd: uses systemd python library to access the systemd journal. +# Specifying "logpath" is not valid for this backend. +# See "journalmatch" in the jails associated filter config # auto: will try to use the following backends, in order: -# pyinotify, gamin, polling. +# pyinotify, gamin, polling. +# +# Note: if systemd backend is chosen as the default but you enable a jail +# for which logs are present only in its own log files, specify some other +# backend for that jail (e.g. polling) and provide empty value for +# journalmatch. See https://github.com/fail2ban/fail2ban/issues/959#issuecomment-74901200 backend = auto # "usedns" specifies if jails should trust hostnames in logs, -# warn when reverse DNS lookups are performed, or ignore all hostnames in logs +# warn when DNS lookups are performed, or ignore all hostnames in logs # -# yes: if a hostname is encountered, a reverse DNS lookup will be performed. -# warn: if a hostname is encountered, a reverse DNS lookup will be performed, +# yes: if a hostname is encountered, a DNS lookup will be performed. +# warn: if a hostname is encountered, a DNS lookup will be performed, # but it will be logged as a warning. # no: if a hostname is encountered, will not be used for banning, # but it will be logged as info. +# raw: use raw value (no hostname), allow use it for no-host filters/actions (example user) usedns = warn +# "logencoding" specifies the encoding of the log files handled by the jail +# This is used to decode the lines from the log file. +# Typical examples: "ascii", "utf-8" # -# Destination email address used solely for the interpolations in -# jail.{conf,local} configuration files. -destemail = frank@brehm-online.com +# auto: will use the system locale setting +logencoding = utf-8 +# "enabled" enables the jails. +# By default all jails are disabled, and it should stay this way. +# Enable only relevant to your setup jails in your .local or jail.d/*.conf # -# Name of the sender for mta actions -sendername = Fail2Ban +# true: jail will be enabled and log files will get monitored for changes +# false: jail is not enabled +enabled = false + + +# "filter" defines the filter to use by the jail. +# By default jails have names matching their filter name +# +filter = %(__name__)s -# Email address of the sender -sender = fail2ban+ns1@brehm-online.com # # ACTIONS # -# Default banning action (e.g. iptables, iptables-new, -# iptables-multiport, shorewall, etc) It is used to define -# action_* variables. Can be overridden globally or per -# section within jail.local file -banaction = iptables-multiport +# Some options used for actions -# email action. Since 0.8.1 upstream fail2ban uses sendmail -# MTA for the mailing. Change mta configuration parameter to mail -# if you want to revert to conventional 'mail'. +# Destination email address used solely for the interpolations in +# jail.{conf,local,d/*} configuration files. +destemail = frank@brehm-online.com + +# Sender email address used solely for some actions +sender = fail2ban+ns1@brehm-online.com + +# E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA for the +# mailing. Change mta configuration parameter to mail if you want to +# revert to conventional 'mail'. mta = sendmail # Default protocol @@ -90,303 +143,461 @@ protocol = tcp # Specify chain where jumps would need to be added in iptables-* actions chain = INPUT +# Ports to be banned +# Usually should be overridden in a particular jail +port = 0:65535 + +# Format of user-agent https://tools.ietf.org/html/rfc7231#section-5.5.3 +fail2ban_agent = Fail2Ban/%(fail2ban_version)s + # # Action shortcuts. To be used to define action parameter +# Default banning action (e.g. iptables, iptables-new, +# iptables-multiport, shorewall, etc) It is used to define +# action_* variables. Can be overridden globally or per +# section within jail.local file +banaction = iptables-multiport +banaction_allports = iptables-allports + # The simplest action to take: ban only -action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] +action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] # ban & send an e-mail with whois report to the destemail. -action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] - %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s", sender="%(sender)s", sendername="%(sendername)s"] +action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] + %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"] # ban & send an e-mail with whois report and relevant log lines # to the destemail. -action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] - %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"] +action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] + %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"] + +# See the IMPORTANT note in action.d/xarf-login-attack for when to use this action +# +# ban & send a xarf e-mail to abuse contact of IP address and include relevant log lines +# to the destemail. +action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] + xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"] + +# ban IP on CloudFlare & send an e-mail with whois report and relevant log lines +# to the destemail. +action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"] + %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"] + +# Report block via blocklist.de fail2ban reporting service API +# +# See the IMPORTANT note in action.d/blocklist_de.conf for when to +# use this action. Create a file jail.d/blocklist_de.local containing +# [Init] +# blocklist_de_apikey = {api key from registration] +# +action_blocklist_de = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"] + +# Report ban via badips.com, and use as blacklist +# +# See BadIPsAction docstring in config/action.d/badips.py for +# documentation for this action. +# +# NOTE: This action relies on banaction being present on start and therefore +# should be last action defined for a jail. +# +action_badips = badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"] +# +# Report ban via badips.com (uses action.d/badips.conf for reporting only) +# +action_badips_report = badips[category="%(__name__)s", agent="%(fail2ban_agent)s"] # Choose default action. To change, just override value of 'action' with the # interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local # globally (section [DEFAULT]) or per specific section action = %(action_)s + # # JAILS # -# Next jails corresponds to the standard configuration in Fail2ban 0.6 which -# was shipped in Debian. Enable any defined here jail by including -# -# [SECTION_NAME] -# enabled = true - # -# in /etc/fail2ban/jail.local. +# SSH servers # -# Optionally you may override any other parameter (e.g. banaction, -# action, port, logpath, etc) in that section within jail.local - -#[ssh] -# -#enabled = true -#port = ssh -#filter = sshd -#logpath = /var/log/auth.log -#maxretry = 6 -#[dropbear] -# -#enabled = false -#port = ssh -#filter = dropbear -#logpath = /var/log/auth.log -#maxretry = 6 +#[sshd] -# Generic filter for pam. Has to be used with action which bans all ports -# such as iptables-allports, shorewall -#[pam-generic] -# -#enabled = false -## pam-generic filter can be customized to monitor specific subset of 'tty's -#filter = pam-generic -## port actually must be irrelevant but lets leave it all for some possible uses -#port = all -#banaction = iptables-allports -#port = anyport -#logpath = /var/log/auth.log -#maxretry = 6 +#port = ssh +#logpath = %(sshd_log)s +#backend = %(sshd_backend)s -#[xinetd-fail] -# -#enabled = false -#filter = xinetd-fail -#port = all -#banaction = iptables-multiport-log -#logpath = /var/log/daemon.log -#maxretry = 2 +#[sshd-ddos] +# This jail corresponds to the standard configuration in Fail2ban. +# The mail-whois action send a notification e-mail with a whois request +# in the body. +#port = ssh +#logpath = %(sshd_log)s +#backend = %(sshd_backend)s -#[ssh-ddos] -# -#enabled = false -#port = ssh -#filter = sshd-ddos -#logpath = /var/log/auth.log -#maxretry = 6 +#[dropbear] -# Here we use blackhole routes for not requiring any additional kernel support -# to store large volumes of banned IPs +#port = ssh +#logpath = %(dropbear_log)s +#backend = %(dropbear_backend)s -#[ssh-route] -# -#enabled = false -#filter = sshd -#action = route -#logpath = /var/log/sshd.log -#maxretry = 6 -# Here we use a combination of Netfilter/Iptables and IPsets -# for storing large volumes of banned IPs -# -# IPset comes in two versions. See ipset -V for which one to use -# requires the ipset package and kernel support. -#[ssh-iptables-ipset4] -# -#enabled = false -#port = ssh -#filter = sshd -#banaction = iptables-ipset-proto4 -#logpath = /var/log/sshd.log -#maxretry = 6 +#[selinux-ssh] -#[ssh-iptables-ipset6] -# -#enabled = false #port = ssh -#filter = sshd -#banaction = iptables-ipset-proto6 -#logpath = /var/log/sshd.log -#maxretry = 6 +#logpath = %(auditd_log)s # # HTTP servers # -#[apache] -# -#enabled = false +#[apache-auth] + #port = http,https -#filter = apache-auth -#logpath = /var/log/apache*/*error.log -#maxretry = 6 +#logpath = %(apache_error_log)s + + +#[apache-badbots] +# Ban hosts which agent identifies spammer robots crawling the web +# for email addresses. The mail outputs are buffered. +#port = http,https +#logpath = %(apache_access_log)s +#bantime = 172800 +#maxretry = 1 -# default action is now multiport, so apache-multiport jail was left -# for compatibility with previous (<0.7.6-2) releases -#[apache-multiport] -# -#enabled = false -#port = http,https -#filter = apache-auth -#logpath = /var/log/apache*/*error.log -#maxretry = 6 #[apache-noscript] -# -#enabled = false + #port = http,https -#filter = apache-noscript -#logpath = /var/log/apache*/*error.log -#maxretry = 6 +#logpath = %(apache_error_log)s + #[apache-overflows] -# -#enabled = false + #port = http,https -#filter = apache-overflows -#logpath = /var/log/apache*/*error.log +#logpath = %(apache_error_log)s #maxretry = 2 + +#[apache-nohome] + +#port = http,https +#logpath = %(apache_error_log)s +#maxretry = 2 + + +#[apache-botsearch] + +#port = http,https +#logpath = %(apache_error_log)s +#maxretry = 2 + + +#[apache-fakegooglebot] + +#port = http,https +#logpath = %(apache_access_log)s +#maxretry = 1 +#ignorecommand = %(ignorecommands_dir)s/apache-fakegooglebot + + #[apache-modsecurity] -# -#enabled = false -#filter = apache-modsecurity + #port = http,https -#logpath = /var/log/apache*/*error.log +#logpath = %(apache_error_log)s #maxretry = 2 -#[apache-nohome] -# -#enabled = false -#filter = apache-nohome + +#[apache-shellshock] + +#port = http,https +#logpath = %(apache_error_log)s +#maxretry = 1 + + +#[openhab-auth] + +#filter = openhab +#action = iptables-allports[name=NoAuthFailures] +#logpath = /opt/openhab/logs/request.log + + +#[nginx-http-auth] + +#port = http,https +#logpath = %(nginx_error_log)s + +# To use 'nginx-limit-req' jail you should have `ngx_http_limit_req_module` +# and define `limit_req` and `limit_req_zone` as described in nginx documentation +# http://nginx.org/en/docs/http/ngx_http_limit_req_module.html +# or for example see in 'config/filter.d/nginx-limit-req.conf' +#[nginx-limit-req] +#port = http,https +#logpath = %(nginx_error_log)s + +#[nginx-botsearch] + #port = http,https -#logpath = /var/log/apache*/*error.log +#logpath = %(nginx_error_log)s #maxretry = 2 + # Ban attackers that try to use PHP's URL-fopen() functionality # through GET/POST variables. - Experimental, with more than a year # of usage in production environments. #[php-url-fopen] -# -#enabled = false + #port = http,https -#filter = php-url-fopen -#logpath = /var/www/*/logs/access_log +#logpath = %(nginx_access_log)s +# %(apache_access_log)s -# A simple PHP-fastcgi jail which works with lighttpd. -# If you run a lighttpd server, then you probably will -# find these kinds of messages in your error_log: -# ALERT – tried to register forbidden variable ‘GLOBALS’ -# through GET variables (attacker '1.2.3.4', file '/var/www/default/htdocs/index.php') -#[lighttpd-fastcgi] -# -#enabled = false +#[suhosin] + #port = http,https -#filter = lighttpd-fastcgi -#logpath = /var/log/lighttpd/error.log +#logpath = %(suhosin_log)s -# Same as above for mod_auth -# It catches wrong authentifications #[lighttpd-auth] -# -#enabled = false +# Same as above for Apache's mod_auth +# It catches wrong authentifications #port = http,https -#filter = suhosin -#logpath = /var/log/lighttpd/error.log +#logpath = %(lighttpd_error_log)s -#[nginx-http-auth] -# -#enabled = false -#filter = nginx-http-auth -#port = http,https -#logpath = /var/log/nginx/error.log -# Monitor roundcube server +# +# Webmail and groupware servers +# #[roundcube-auth] -# -#enabled = false -#filter = roundcube-auth + #port = http,https -#logpath = /var/log/roundcube/userlogins +#logpath = %(roundcube_errors_log)s + + +#[openwebmail] + +#port = http,https +#logpath = /var/log/openwebmail.log + + +#[horde] + +#port = http,https +#logpath = /var/log/horde/horde.log + + +#[groupoffice] + +#port = http,https +#logpath = /home/groupoffice/log/info.log #[sogo-auth] -# -#enabled = false -#filter = sogo-auth -#port = http, https -## without proxy this would be: -## port = 20000 +# Monitor SOGo groupware server +# without proxy this would be: +# port = 20000 +#port = http,https #logpath = /var/log/sogo/sogo.log +#[tine20] + +#logpath = /var/log/tine20/tine20.log +#port = http,https + + +# +# Web Applications # -# FTP servers # -#[vsftpd] +#[drupal-auth] + +#port = http,https +#logpath = %(syslog_daemon)s +#backend = %(syslog_backend)s + +#[guacamole] + +#port = http,https +#logpath = /var/log/tomcat*/catalina.out + +#[monit] +#Ban clients brute-forcing the monit gui login +#port = 2812 +#logpath = /var/log/monit + + +#[webmin-auth] + +#port = 10000 +#logpath = %(syslog_authpriv)s +#backend = %(syslog_backend)s + + +#[froxlor-auth] + +#port = http,https +#logpath = %(syslog_authpriv)s +#backend = %(syslog_backend)s + + +# +# HTTP Proxy servers +# # -#enabled = false -#port = ftp,ftp-data,ftps,ftps-data -#filter = vsftpd -#logpath = /var/log/vsftpd.log -## or overwrite it in jails.local to be -## logpath = /var/log/auth.log -## if you want to rely on PAM failed login attempts -## vsftpd's failregex should match both of those formats -#maxretry = 6 +#[squid] -#[proftpd] +#port = 80,443,3128,8080 +#logpath = /var/log/squid/access.log + + +#[3proxy] + +#port = 3128 +#logpath = /var/log/3proxy.log + + +# +# FTP servers # -#enabled = false + + +#[proftpd] + #port = ftp,ftp-data,ftps,ftps-data -#filter = proftpd -#logpath = /var/log/proftpd/proftpd.log -#maxretry = 6 +#logpath = %(proftpd_log)s +#backend = %(proftpd_backend)s #[pure-ftpd] -# -#enabled = false + #port = ftp,ftp-data,ftps,ftps-data -#filter = pure-ftpd -#logpath = /var/log/syslog -#maxretry = 6 +#logpath = %(pureftpd_log)s +#backend = %(pureftpd_backend)s + + +#[gssftpd] + +#port = ftp,ftp-data,ftps,ftps-data +#logpath = %(syslog_daemon)s +#backend = %(syslog_backend)s #[wuftpd] -# -#enabled = false + #port = ftp,ftp-data,ftps,ftps-data -#filter = wuftpd -#logpath = /var/log/syslog -#maxretry = 6 +#logpath = %(wuftpd_log)s +#backend = %(wuftpd_backend)s + + +#[vsftpd] +# or overwrite it in jails.local to be +# logpath = %(syslog_authpriv)s +# if you want to rely on PAM failed login attempts +# vsftpd's failregex should match both of those formats +#port = ftp,ftp-data,ftps,ftps-data +#logpath = %(vsftpd_log)s # # Mail servers # +# ASSP SMTP Proxy Jail +#[assp] + +#port = smtp,465,submission +#logpath = /root/path/to/assp/logs/maillog.txt + + +#[courier-smtp] + +#port = smtp,465,submission +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s + + #[postfix] -# -#enabled = false -#port = smtp,ssmtp,submission -#filter = postfix -#logpath = /var/log/mail.log +#port = smtp,465,submission +#logpath = %(postfix_log)s +#backend = %(postfix_backend)s + + +#[postfix-rbl] + +#port = smtp,465,submission +#logpath = %(postfix_log)s +#backend = %(postfix_backend)s +#maxretry = 1 -#[couriersmtp] -# -#enabled = false -#port = smtp,ssmtp,submission -#filter = couriersmtp -#logpath = /var/log/mail.log + +#[sendmail-auth] + +#port = submission,465,smtp +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s + + +#[sendmail-reject] + +#port = smtp,465,submission +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s + + +#[qmail-rbl] + +#filter = qmail +#port = smtp,465,submission +#logpath = /service/qmail/log/main/current + + +# dovecot defaults to logging to the mail syslog facility +# but can be set by syslog_facility in the dovecot configuration. +#[dovecot] + +#port = pop3,pop3s,imap,imaps,submission,465,sieve +#logpath = %(dovecot_log)s +#backend = %(dovecot_backend)s + + +#[sieve] + +#port = smtp,465,submission +#logpath = %(dovecot_log)s +#backend = %(dovecot_backend)s + + +#[solid-pop3d] + +#port = pop3,pop3s +#logpath = %(solidpop3d_log)s + + +#[exim] + +#port = smtp,465,submission +#logpath = %(exim_main_log)s + + +#[exim-spam] + +#port = smtp,465,submission +#logpath = %(exim_main_log)s + + +#[kerio] + +#port = imap,smtp,imaps,465 +#logpath = /opt/kerio/mailserver/store/logs/security.log # @@ -394,60 +605,55 @@ action = %(action_)s # all relevant ports get banned # -#[courierauth] -# -#enabled = false -#port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s -#filter = courierlogin -#logpath = /var/log/mail.log +#[courier-auth] +#port = smtp,465,submission,imap3,imaps,pop3,pop3s +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s -#[sasl] -# -#enabled = false -#port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s -#filter = postfix-sasl -## You might consider monitoring /var/log/mail.warn instead if you are -## running postfix since it would provide the same log lines at the -## "warn" level but overall at the smaller filesize. -#logpath = /var/log/mail.log -#[dovecot] -# -#enabled = false -#port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s -#filter = dovecot -#logpath = /var/log/mail.log +#[postfix-sasl] -# To log wrong MySQL access attempts add to /etc/my.cnf: -# log-error=/var/log/mysqld.log -# log-warning = 2 -#[mysqld-auth] -# -#enabled = false -#filter = mysqld-auth -#port = 3306 -#logpath = /var/log/mysqld.log +#port = smtp,465,submission,imap3,imaps,pop3,pop3s +# You might consider monitoring /var/log/mail.warn instead if you are +# running postfix since it would provide the same log lines at the +# "warn" level but overall at the smaller filesize. +#logpath = %(postfix_log)s +#backend = %(postfix_backend)s + + +#[perdition] + +#port = imap3,imaps,pop3,pop3s +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s + + +#[squirrelmail] +#port = smtp,465,submission,imap2,imap3,imaps,pop3,pop3s,http,https,socks +#logpath = /var/lib/squirrelmail/prefs/squirrelmail_access_log -# DNS Servers + +#[cyrus-imap] + +#port = imap3,imaps +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s + + +#[uwimap-auth] + +#port = imap3,imaps +#logpath = %(syslog_mail)s +#backend = %(syslog_backend)s -# These jails block attacks against named (bind9). By default, logging is off -# with bind9 installation. You will need something like this: # -# logging { -# channel security_file { -# file "/var/log/named/security.log" versions 3 size 30m; -# severity dynamic; -# print-time yes; -# }; -# category security { -# security_file; -# }; -# }; # -# in your named.conf to provide proper logging +# DNS servers +# + # !!! WARNING !!! # Since UDP is connection-less protocol, spoofing of IP and imitation @@ -456,99 +662,196 @@ action = %(action_)s # victim. See # http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html # Please DO NOT USE this jail unless you know what you are doing. -#[named-refused-udp] # -#enabled = false +# IMPORTANT: see filter.d/named-refused for instructions to enable logging +# This jail blocks UDP traffic for DNS requests. +# [named-refused-udp] +# +# filter = named-refused +# port = domain,953 +# protocol = udp +# logpath = /var/log/named/security.log + +# IMPORTANT: see filter.d/named-refused for instructions to enable logging +# This jail blocks TCP traffic for DNS requests. + +#[named-refused] + #port = domain,953 -#protocol = udp -#filter = named-refused #logpath = /var/log/named/security.log -#[named-refused-tcp] + +#[nsd] + +#port = 53 +#action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] +# %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] +#logpath = /var/log/nsd.log + + # -#enabled = false -#port = domain,953 -#protocol = tcp -#filter = named-refused -#logpath = /var/log/named/security.log +# Miscellaneous +# + +#[asterisk] + +#port = 5060,5061 +#action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] +# %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] +# %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"] +#logpath = /var/log/asterisk/messages +#maxretry = 10 + #[freeswitch] -# -#enabled = false -#filter = freeswitch + +#port = 5060,5061 +#action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] +# %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] +# %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"] #logpath = /var/log/freeswitch.log #maxretry = 10 -#action = iptables-multiport[name=freeswitch-tcp, port="5060,5061,5080,5081", protocol=tcp] -# iptables-multiport[name=freeswitch-udp, port="5060,5061,5080,5081", protocol=udp] -#[ejabberd-auth] + +# To log wrong MySQL access attempts add to /etc/my.cnf in [mysqld] or +# equivalent section: +# log-warning = 2 +# +# for syslog (daemon facility) +# [mysqld_safe] +# syslog # -#enabled = false -#filter = ejabberd-auth -#port = xmpp-client -#protocol = tcp -#logpath = /var/log/ejabberd/ejabberd.log +# for own logfile +# [mysqld] +# log-error=/var/log/mysqld.log +#[mysqld-auth] +#port = 3306 +#logpath = %(mysql_log)s +#backend = %(mysql_backend)s -# Multiple jails, 1 per protocol, are necessary ATM: -# see https://github.com/fail2ban/fail2ban/issues/37 -#[asterisk-tcp] -# -#enabled = false -#filter = asterisk -#port = 5060,5061 -#protocol = tcp -#logpath = /var/log/asterisk/messages -#[asterisk-udp] -# -#enabled = false -#filter = asterisk -#port = 5060,5061 -#protocol = udp -#logpath = /var/log/asterisk/messages +# Log wrong MongoDB auth (for details see filter 'filter.d/mongodb-auth.conf') +#[mongodb-auth] +# change port when running with "--shardsvr" or "--configsvr" runtime operation +#port = 27017 +#logpath = /var/log/mongodb/mongodb.log # Jail for more extended banning of persistent abusers -# !!! WARNING !!! -# Make sure that your loglevel specified in fail2ban.conf/.local -# is not at DEBUG level -- which might then cause fail2ban to fall into -# an infinite loop constantly feeding itself with non-informative lines +# !!! WARNINGS !!! +# 1. Make sure that your loglevel specified in fail2ban.conf/.local +# is not at DEBUG level -- which might then cause fail2ban to fall into +# an infinite loop constantly feeding itself with non-informative lines +# 2. Increase dbpurgeage defined in fail2ban.conf to e.g. 648000 (7.5 days) +# to maintain entries for failed logins for sufficient amount of time #[recidive] -# -#enabled = false -#filter = recidive + #logpath = /var/log/fail2ban.log -#action = iptables-allports[name=recidive] -# sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log] +#banaction = %(banaction_allports)s #bantime = 604800 ; 1 week #findtime = 86400 ; 1 day -#maxretry = 5 -# See the IMPORTANT note in action.d/blocklist_de.conf for when to -# use this action -# -# Report block via blocklist.de fail2ban reporting service API -# See action.d/blocklist_de.conf for more information -#[ssh-blocklist] -# -#enabled = false -#filter = sshd -#action = iptables[name=SSH, port=ssh, protocol=tcp] -# sendmail-whois[name=SSH, dest="%(destemail)s", sender="%(sender)s", sendername="%(sendername)s"] -# blocklist_de[email="%(sender)s", apikey="xxxxxx", service="%(filter)s"] -#logpath = /var/log/sshd.log -#maxretry = 20 +# Generic filter for PAM. Has to be used with action which bans all +# ports such as iptables-allports, shorewall + +#[pam-generic] +# pam-generic filter can be customized to monitor specific subset of 'tty's +#banaction = %(banaction_allports)s +#logpath = %(syslog_authpriv)s +#backend = %(syslog_backend)s + + +#[xinetd-fail] + +#banaction = iptables-multiport-log +#logpath = %(syslog_daemon)s +#backend = %(syslog_backend)s +#maxretry = 2 + + +# stunnel - need to set port for this +#[stunnel] + +#logpath = /var/log/stunnel4/stunnel.log + + +#[ejabberd-auth] + +#port = 5222 +#logpath = /var/log/ejabberd/ejabberd.log + + +#[counter-strike] + +#logpath = /opt/cstrike/logs/L[0-9]*.log +# Firewall: http://www.cstrike-planet.com/faq/6 +#tcpport = 27030,27031,27032,27033,27034,27035,27036,27037,27038,27039 +#udpport = 1200,27000,27001,27002,27003,27004,27005,27006,27007,27008,27009,27010,27011,27012,27013,27014,27015 +#action = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] +# %(banaction)s[name=%(__name__)s-udp, port="%(udpport)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] # consider low maxretry and a long bantime # nobody except your own Nagios server should ever probe nrpe #[nagios] -#enabled = false -#filter = nagios -#action = iptables[name=Nagios, port=5666, protocol=tcp] -# sendmail-whois[name=Nagios, dest="%(destemail)s", sender="%(sender)s", sendername="%(sendername)s"] -#logpath = /var/log/messages ; nrpe.cfg may define a different log_facility + +#logpath = %(syslog_daemon)s ; nrpe.cfg may define a different log_facility +#backend = %(syslog_backend)s +#maxretry = 1 + + +#[oracleims] +# see "oracleims" filter file for configuration requirement for Oracle IMS v6 and above +#logpath = /opt/sun/comms/messaging64/log/mail.log_current +#banaction = %(banaction_allports)s + +#[directadmin] +#logpath = /var/log/directadmin/login.log +#port = 2222 + +#[portsentry] +#logpath = /var/lib/portsentry/portsentry.history #maxretry = 1 +#[pass2allow-ftp] +# this pass2allow example allows FTP traffic after successful HTTP authentication +#port = ftp,ftp-data,ftps,ftps-data +# knocking_url variable must be overridden to some secret value in jail.local +#knocking_url = /knocking/ +#filter = apache-pass[knocking_url="%(knocking_url)s"] +# access log of the website with HTTP auth +#logpath = %(apache_access_log)s +#blocktype = RETURN +#returntype = DROP +#bantime = 3600 +#maxretry = 1 +#findtime = 1 + + +#[murmur] +# AKA mumble-server +#port = 64738 +#action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol=tcp, chain="%(chain)s", actname=%(banaction)s-tcp] +# %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol=udp, chain="%(chain)s", actname=%(banaction)s-udp] +#logpath = /var/log/mumble-server/mumble-server.log + + +#[screensharingd] +# For Mac OS Screen Sharing Service (VNC) +#logpath = /var/log/system.log +#logencoding = utf-8 + +#[haproxy-http-auth] +# HAProxy by default doesn't log to file you'll need to set it up to forward +# logs to a syslog server which would then write them to disk. +# See "haproxy-http-auth" filter for a brief cautionary note when setting +# maxretry and findtime. +#logpath = /var/log/haproxy.log + +#[slapd] +#port = ldap,ldaps +#filter = slapd +#logpath = /var/log/slapd.log + # vim: filetype=dosini diff --git a/iptables/rules.v4 b/iptables/rules.v4 index 304e2c3..14ab375 100644 --- a/iptables/rules.v4 +++ b/iptables/rules.v4 @@ -1,12 +1,25 @@ -# Generated by iptables-save v1.6.0 on Tue Jul 18 13:55:14 2017 +# Generated by iptables-save v1.6.0 on Tue Jul 18 14:08:07 2017 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [12:1256] -:fail2ban-postfix - [0:0] -:fail2ban-ssh - [0:0] --A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh --A INPUT -p tcp -m multiport --dports 25,465,587 -j fail2ban-postfix +:OUTPUT ACCEPT [31:7988] +:f2b-apache - [0:0] +:f2b-apache-modsecurity - [0:0] +:f2b-apache-nohome - [0:0] +:f2b-apache-noscript - [0:0] +:f2b-apache-overflows - [0:0] +:f2b-postfix - [0:0] +:f2b-ssh - [0:0] +:f2b-sshd - [0:0] +-A INPUT -p tcp -m multiport --dports 22 -j f2b-ssh +-A INPUT -p tcp -m multiport --dports 25,465,587 -j f2b-postfix +-A INPUT -p tcp -m multiport --dports 0:65535 -j f2b-sshd +-A INPUT -p tcp -m multiport --dports 80,443 -j f2b-apache-nohome +-A INPUT -p tcp -m multiport --dports 80,443 -j f2b-apache-modsecurity +-A INPUT -p tcp -m multiport --dports 80,443 -j f2b-apache-overflows +-A INPUT -p tcp -m multiport --dports 80,443 -j f2b-apache-noscript +-A INPUT -p tcp -m multiport --dports 80,443 -j f2b-apache +-A INPUT -p tcp -m multiport --dports 80,443 -j f2b-apache -A INPUT -s 220.192.0.0/12 -p tcp -m multiport --dports 22 -j REJECT --reject-with icmp-port-unreachable -A INPUT -s 222.184.0.0/13 -p tcp -m multiport --dports 22 -j REJECT --reject-with icmp-port-unreachable -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT @@ -18,9 +31,18 @@ -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT +-A INPUT -p tcp -m multiport --dports 23 -j REJECT --reject-with icmp-port-unreachable +-A INPUT -p tcp -m multiport --dports 445 -j REJECT --reject-with icmp-port-unreachable -A INPUT -j NFLOG --nflog-prefix "INPUT Reject " --nflog-threshold 1 -A INPUT -j REJECT --reject-with icmp-port-unreachable --A fail2ban-postfix -j RETURN --A fail2ban-ssh -j RETURN +-A f2b-apache -j RETURN +-A f2b-apache-modsecurity -j RETURN +-A f2b-apache-nohome -j RETURN +-A f2b-apache-noscript -j RETURN +-A f2b-apache-overflows -j RETURN +-A f2b-postfix -j RETURN +-A f2b-ssh -s 116.31.116.27/32 -j REJECT --reject-with icmp-port-unreachable +-A f2b-ssh -j RETURN +-A f2b-sshd -j RETURN COMMIT -# Completed on Tue Jul 18 13:55:14 2017 +# Completed on Tue Jul 18 14:08:07 2017 diff --git a/iptables/rules.v6 b/iptables/rules.v6 index 8082b96..7595228 100644 --- a/iptables/rules.v6 +++ b/iptables/rules.v6 @@ -1,8 +1,8 @@ -# Generated by ip6tables-save v1.6.0 on Tue Jul 18 13:55:14 2017 +# Generated by ip6tables-save v1.6.0 on Tue Jul 18 14:08:07 2017 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [0:0] +:OUTPUT ACCEPT [147:65851] -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT -A INPUT -m conntrack --ctstate RELATED -j ACCEPT -A INPUT -p ipv6-icmp -j ACCEPT @@ -25,4 +25,4 @@ -A FORWARD -j NFLOG --nflog-prefix "IPv6 FORWARD Reject " --nflog-threshold 1 -A FORWARD -j REJECT --reject-with icmp6-port-unreachable COMMIT -# Completed on Tue Jul 18 13:55:14 2017 +# Completed on Tue Jul 18 14:08:07 2017 diff --git a/motd b/motd index d7310d6..4fb9559 100644 --- a/motd +++ b/motd @@ -1,4 +1,4 @@ -Debian GNU/Linux 8.8 (jessie) +Debian GNU/Linux 9.0 (stretch) _ _ _ | \ | |___/ | | \| / __| | @@ -6,7 +6,8 @@ Debian GNU/Linux 8.8 (jessie) |_| \_|___/_| -Vorsicht: Einige Klugscheißer haben Ideendurchfall. +Auch die schönste Frau ist an den Füßen zu Ende. + -- Giacomo Girolamo Casanova Today is Prickle-Prickle, the 53rd day of Confusion in the YOLD 3183 -- 2.39.5