Block BruteForce using Fail2ban

Fail2ban merupakan aplikasi security server yang berguna untuk mencegah dan melakukan logging jika ada yang melakukan attacking menggunakan metode bruteforce, langsung saja kita masuk ke konfigurasinya...

1. Kita lakukan instalasi paket fail2ban, untuk sistem yang menggunakan APT based bisa di lakukan apt-get install fail2ban, untuk YUM based bisa gunakan yum -y install fail2ban

2. membuat sistem startup yang di gunakan agar pada saat booting operating sistem bisa melakukan startup pada paket fail2ban

# chkconfig –levels 235 fail2ban on
# /etc/init.d/fail2ban start

3. setelah itu kita coba dengan melakukan login sebanyak 3 kali atau lebih dengan menggunakan password yang tidak sebenarnya, ini dimaksudkan agar kita mengetahui fail2ban sudah running atau belum.

4. selanjutnya kita lihat log fail2ban pada file /var/log/fail2ban.log

# tail -f /var/log/fail2ban.log

5. maka selanjutnya akan muncul log IP kita pada saat melakukan login salah sebelumnya, contoh isi lognya adalah seperti ini:

2011-11-28 22:27:58,953 fail2ban.jail : INFO Jail ‘ssh’ started
2011-11-28 22:29:36,430 fail2ban.actions: WARNING [ssh] Ban 192.168.1.18

terlihat log di atas IP Address kita di banned, banned secara default berlaku selama 10 menit, namun kita bisa melakukan set di file /etc/fail2ban/jail.conf

# nano /etc/fail2ban/jail.conf

6. berikut ini adalah cntoh file jail.conf, kita bisa melakukan konfigurasi sesuai dengan kebutuhan kita pada file ini:

————————————————————
# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision: 617 $
#
# The DEFAULT allows a global definition of the options. They can be override
# in each jail afterwards.
[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1 192.168.0.99
# "bantime" is the number of seconds that a host is banned.
bantime = 600
# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 600
# "maxretry" is the number of failures before a host get banned.
maxretry = 3
# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto". This option can be overridden in
# each jail too (use "gamin" for a jail and "polling" for another).
#
# gamin: requires Gamin (a file alteration monitor) to be installed. If Gamin
# is not installed, Fail2ban will use polling.
# polling: uses a polling algorithm which does not require external libraries.
# auto: will choose Gamin if available and polling otherwise.
backend = auto
[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
sendmail-whois[name=SSH, dest=you@mail.com, sender=fail2ban@mail.com]
logpath = /var/log/secure
maxretry = 5
[proftpd-iptables]
enabled = true
filter = proftpd
action = iptables[name=ProFTPD, port=ftp, protocol=tcp]
sendmail-whois[name=ProFTPD, dest=you@mail.com]
logpath = /var/log/secure
maxretry = 6
[sasl-iptables]
enabled = true
filter = sasl
backend = polling
action = iptables[name=sasl, port=smtp, protocol=tcp]
sendmail-whois[name=sasl, dest=you@mail.com]
logpath = /var/log/maillog
[apache-tcpwrapper]
enabled = true
filter = apache-auth
action = hostsdeny
logpath = /var/log/httpd/*error_log
maxretry = 6
[postfix-tcpwrapper]
enabled = true
filter = postfix
action = hostsdeny
sendmail[name=Postfix, dest=you@mail.com]
logpath = /var/log/maillog
bantime = 300
[courierpop3]
enabled = true
port = pop3
filter = courierlogin
action = iptables[name=%(__name__)s, port=%(port)s]
logpath = /var/log/maillog
maxretry = 5
[courierimap]
enabled = true
port = imap2
filter = courierlogin
action = iptables[name=%(__name__)s, port=%(port)s]
logpath = /var/log/maillog
maxretry = 5
[ssh-tcpwrapper]
enabled = false
filter = sshd
action = hostsdeny
sendmail-whois[name=SSH, dest=you@mail.com]
ignoreregex = for myuser from
logpath = /var/log/secure
[vsftpd-notification]
enabled = false
filter = vsftpd
action = sendmail-whois[name=VSFTPD, dest=you@mail.com]
logpath = /var/log/secure
maxretry = 5
bantime = 1800
[vsftpd-iptables]
enabled = false
filter = vsftpd
action = iptables[name=VSFTPD, port=ftp, protocol=tcp]
sendmail-whois[name=VSFTPD, dest=you@mail.com]
logpath = /var/log/secure
maxretry = 5
bantime = 1800
[apache-badbots]
enabled = false
filter = apache-badbots
action = iptables-multiport[name=BadBots, port="http,https"]
sendmail-buffered[name=BadBots, lines=5, dest=you@mail.com]
logpath = /var/log/httpd/*access_log
bantime = 172800
maxretry = 1
[apache-shorewall]
enabled = false
filter = apache-noscript
action = shorewall
sendmail[name=Apache, dest=you@mail.com]
logpath = /var/log/httpd/error_log
[ssh-ipfw]
enabled = false
filter = sshd
action = ipfw[localhost=192.168.0.1]
sendmail-whois[name="SSH,IPFW", dest=you@mail.com]
logpath = /var/log/secure
ignoreip = 168.192.0.1
[named-refused-udp]
enabled = false
filter = named-refused
action = iptables-multiport[name=Named, port="domain,953", protocol=udp]
sendmail-whois[name=Named, dest=you@mail.com]
logpath = /var/log/secure
ignoreip = 168.192.0.1
[named-refused-tcp]
enabled = false
filter = named-refused
action = iptables-multiport[name=Named, port="domain,953", protocol=tcp]
sendmail-whois[name=Named, dest=you@mail.com]
logpath = /var/log/secure
ignoreip = 168.192.0.1

------------------------------------------------------------

7. pada konfigurasi diata terdapat email you@mail.com itu kita bisa ganti dengan email kita sebagai laporan log dari fail2ban.

8. langkah terakhir adalah dengan melakukan restart paket fail2ban

# /etc/init.d/fail2ban restart

Silahkan Mencoba...

Posted in: bruteforce,debian,fail2ban