208 lines
7.5 KiB
Plaintext
208 lines
7.5 KiB
Plaintext
|
# Fail2Ban configuration file
|
||
|
|
#
|
||
|
|
# Author: Russell Odom <russ@gloomytrousers.co.uk>
|
||
|
|
# Submits attack reports to DShield (http://www.dshield.org/)
|
||
|
|
#
|
||
|
|
# You MUST configure at least:
|
||
|
|
# <port> (the port that's being attacked - use number not name).
|
||
|
|
#
|
||
|
|
# You SHOULD also provide:
|
||
|
|
# <myip> (your public IP address, if it's not the address of eth0)
|
||
|
|
# <userid> (your DShield userID, if you have one - recommended, but reports will
|
||
|
|
# be used anonymously if not)
|
||
|
|
# <protocol> (the protocol in use - defaults to tcp)
|
||
|
|
#
|
||
|
|
# Best practice is to provide <port> and <protocol> in jail.conf like this:
|
||
|
|
# action = dshield[port=1234,protocol=tcp]
|
||
|
|
#
|
||
|
|
# ...and create "dshield.local" with contents something like this:
|
||
|
|
# [Init]
|
||
|
|
# myip = 10.0.0.1
|
||
|
|
# userid = 12345
|
||
|
|
#
|
||
|
|
# Other useful configuration values are <mailargs> (you can use for specifying
|
||
|
|
# a different sender address for the report e-mails, which should match what is
|
||
|
|
# configured at DShield), and <lines>/<minreportinterval>/<maxbufferage> (to
|
||
|
|
# configure how often the buffer is flushed).
|
||
|
|
#
|
||
|
|
|
||
|
|
[Definition]
|
||
|
|
|
||
|
|
# bypass ban/unban for restored tickets
|
||
|
|
norestored = 1
|
||
|
|
|
||
|
|
# Option: actionstart
|
||
|
|
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
|
||
|
|
# Values: CMD
|
||
|
|
#
|
||
|
|
actionstart =
|
||
|
|
|
||
|
|
# Option: actionstop
|
||
|
|
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
|
||
|
|
# Values: CMD
|
||
|
|
#
|
||
|
|
actionstop = if [ -f <tmpfile>.buffer ]; then
|
||
|
|
cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" <mailargs> <dest>
|
||
|
|
date +%%s > <tmpfile>.lastsent
|
||
|
|
fi
|
||
|
|
rm -f <tmpfile>.buffer <tmpfile>.first
|
||
|
|
|
||
|
|
# Option: actioncheck
|
||
|
|
# Notes.: command executed once before each actionban command
|
||
|
|
# Values: CMD
|
||
|
|
#
|
||
|
|
actioncheck =
|
||
|
|
|
||
|
|
# Option: actionban
|
||
|
|
# Notes.: command executed when banning an IP. Take care that the
|
||
|
|
# command is executed with Fail2Ban user rights.
|
||
|
|
# Tags: See jail.conf(5) man page
|
||
|
|
# Values: CMD
|
||
|
|
#
|
||
|
|
# See http://www.dshield.org/specs.html for more on report format/notes
|
||
|
|
#
|
||
|
|
# Note: We are currently using <time> for the timestamp because no tag is
|
||
|
|
# available to indicate the timestamp of the log message(s) which triggered the
|
||
|
|
# ban. Therefore the timestamps we are using in the report, whilst often only a
|
||
|
|
# few seconds out, are incorrect. See
|
||
|
|
# http://sourceforge.net/tracker/index.php?func=detail&aid=2017795&group_id=121032&atid=689047
|
||
|
|
#
|
||
|
|
actionban = TZONE=`date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'`
|
||
|
|
DATETIME="`perl -e '@t=localtime(<time>);printf "%%4d-%%02d-%%02d %%02d:%%02d:%%02d",1900+$t[5],$t[4]+1,$t[3],$t[2],$t[1],$t[0]'` $TZONE"
|
||
|
|
PROTOCOL=`awk '{IGNORECASE=1;if($1=="<protocol>"){print $2;exit}}' /etc/protocols`
|
||
|
|
if [ -z "$PROTOCOL" ]; then PROTOCOL=<protocol>; fi
|
||
|
|
printf %%b "$DATETIME\t<userid>\t<failures>\t<ip>\t<srcport>\t<myip>\t<port>\t$PROTOCOL\t<tcpflags>\n" >> <tmpfile>.buffer
|
||
|
|
NOW=`date +%%s`
|
||
|
|
if [ ! -f <tmpfile>.first ]; then
|
||
|
|
echo <time> | cut -d. -f1 > <tmpfile>.first
|
||
|
|
fi
|
||
|
|
if [ ! -f <tmpfile>.lastsent ]; then
|
||
|
|
echo 0 > <tmpfile>.lastsent
|
||
|
|
fi
|
||
|
|
LOGAGE=$(($NOW - `cat <tmpfile>.first`))
|
||
|
|
LASTREPORT=$(($NOW - `cat <tmpfile>.lastsent`))
|
||
|
|
LINES=$( wc -l <tmpfile>.buffer | awk '{ print $1 }' )
|
||
|
|
if [ $LINES -ge <lines> && $LASTREPORT -gt <minreportinterval> ] || [ $LOGAGE -gt <maxbufferage> ]; then
|
||
|
|
cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ $TZONE Fail2Ban" <mailargs> <dest>
|
||
|
|
rm -f <tmpfile>.buffer <tmpfile>.first
|
||
|
|
echo $NOW > <tmpfile>.lastsent
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Option: actionunban
|
||
|
|
# Notes.: command executed when unbanning an IP. Take care that the
|
||
|
|
# command is executed with Fail2Ban user rights.
|
||
|
|
# Tags: See jail.conf(5) man page
|
||
|
|
# Values: CMD
|
||
|
|
#
|
||
|
|
actionunban = if [ -f <tmpfile>.first ]; then
|
||
|
|
NOW=`date +%%s`
|
||
|
|
LOGAGE=$(($NOW - `cat <tmpfile>.first`))
|
||
|
|
if [ $LOGAGE -gt <maxbufferage> ]; then
|
||
|
|
cat <tmpfile>.buffer | <mailcmd> "FORMAT DSHIELD USERID <userid> TZ `date +%%z | sed 's/\([+-]..\)\(..\)/\1:\2/'` Fail2Ban" <mailargs> <dest>
|
||
|
|
rm -f <tmpfile>.buffer <tmpfile>.first
|
||
|
|
echo $NOW > <tmpfile>.lastsent
|
||
|
|
fi
|
||
|
|
fi
|
||
|
|
|
||
|
|
|
||
|
|
[Init]
|
||
|
|
# Option: port
|
||
|
|
# Notes.: The target port for the attack (numerical). MUST be provided in the
|
||
|
|
# jail config, as it cannot be detected here.
|
||
|
|
# Values: [ NUM ]
|
||
|
|
#
|
||
|
|
port = ???
|
||
|
|
|
||
|
|
# Option: userid
|
||
|
|
# Notes.: Your DShield user ID. Should be provided either in the jail config or
|
||
|
|
# in a .local file.
|
||
|
|
# Register at https://secure.dshield.org/register.html
|
||
|
|
# Values: [ NUM ]
|
||
|
|
#
|
||
|
|
userid = 0
|
||
|
|
|
||
|
|
# Option: myip
|
||
|
|
# Notes.: The target IP for the attack (your public IP). Should be provided
|
||
|
|
# either in the jail config or in a .local file unless your PUBLIC IP
|
||
|
|
# is the first IP assigned to eth0
|
||
|
|
# Values: [ an IP address ] Default: Tries to find the IP address of eth0,
|
||
|
|
# which in most cases will be a private IP, and therefore incorrect
|
||
|
|
#
|
||
|
|
myip = `ip -4 addr show dev eth0 | grep inet | head -n 1 | sed -r 's/.*inet ([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/\1/'`
|
||
|
|
|
||
|
|
# Option: protocol
|
||
|
|
# Notes.: The protocol over which the attack is happening
|
||
|
|
# Values: [ tcp | udp | icmp | (any other protocol name from /etc/protocols) | NUM ] Default: tcp
|
||
|
|
#
|
||
|
|
protocol = tcp
|
||
|
|
|
||
|
|
# Option: lines
|
||
|
|
# Notes.: How many lines to buffer before making a report. Regardless of this,
|
||
|
|
# reports are sent a minimum of <minreportinterval> apart, or if the
|
||
|
|
# buffer contains an event over <maxbufferage> old, or on shutdown
|
||
|
|
# Values: [ NUM ]
|
||
|
|
#
|
||
|
|
lines = 50
|
||
|
|
|
||
|
|
# Option: minreportinterval
|
||
|
|
# Notes.: Minimum period (in seconds) that must elapse before we submit another
|
||
|
|
# batch of reports. DShield request a minimum of 1 hour (3600 secs)
|
||
|
|
# between reports.
|
||
|
|
# Values: [ NUM ]
|
||
|
|
#
|
||
|
|
minreportinterval = 3600
|
||
|
|
|
||
|
|
# Option: maxbufferage
|
||
|
|
# Notes.: Maximum age (in seconds) of the oldest report in the buffer before we
|
||
|
|
# submit the batch, even if we haven't reached <lines> yet. Note that
|
||
|
|
# this is only checked on each ban/unban, and that we always send
|
||
|
|
# anything in the buffer on shutdown. Must be greater than
|
||
|
|
# Values: [ NUM ]
|
||
|
|
#
|
||
|
|
maxbufferage = 21600
|
||
|
|
|
||
|
|
# Option: srcport
|
||
|
|
# Notes.: The source port of the attack. You're unlikely to have this info, so
|
||
|
|
# you can leave the default
|
||
|
|
# Values: [ NUM ]
|
||
|
|
#
|
||
|
|
srcport = ???
|
||
|
|
|
||
|
|
# Option: tcpflags
|
||
|
|
# Notes.: TCP flags on attack. You're unlikely to have this info, so you can
|
||
|
|
# leave empty
|
||
|
|
# Values: [ STRING ]
|
||
|
|
#
|
||
|
|
tcpflags =
|
||
|
|
|
||
|
|
# Option: mailcmd
|
||
|
|
# Notes.: Your system mail command. Is passed 2 args: subject and recipient
|
||
|
|
# Values: CMD
|
||
|
|
#
|
||
|
|
mailcmd = mail -E 'set escape' -s
|
||
|
|
|
||
|
|
# Option: mailargs
|
||
|
|
# Notes.: Additional arguments to mail command. e.g. for standard Unix mail:
|
||
|
|
# CC reports to another address:
|
||
|
|
# -c me@example.com
|
||
|
|
# Appear to come from a different address (the From address must match
|
||
|
|
# the one configured at DShield - the '--' indicates arguments to be
|
||
|
|
# passed to Sendmail):
|
||
|
|
# -- -f me@example.com
|
||
|
|
# Values: [ STRING ]
|
||
|
|
#
|
||
|
|
mailargs =
|
||
|
|
|
||
|
|
# Option: dest
|
||
|
|
# Notes.: Destination e-mail address for reports
|
||
|
|
# Values: [ STRING ]
|
||
|
|
#
|
||
|
|
dest = reports@dshield.org
|
||
|
|
|
||
|
|
# Option: tmpfile
|
||
|
|
# Notes.: Base name of temporary files used for buffering
|
||
|
|
# Values: [ STRING ]
|
||
|
|
#
|
||
|
|
tmpfile = /var/run/fail2ban/tmp-dshield
|
||
|
|
|