Um das Plesk Panel sowie andere Plesk Dienste wie IMAP, POP3, SMTP und SSH vor Bruteforce Attacken zu schützen, installieren wir Fail2Ban und fügen passende Filter hinzu.
Fail2Ban ist ein Dienst der Logdateien anderer Dienste überprüft und z.B.fehlerhafte IMAP Logins erkennt und die Source IP-Adresse per iptables sperrt.
Punkt 1: Installation von Fail2Ban
Zuerst installieren wir das benötigte Paket.
Debian
|
1 2 |
apt-get install fail2ban update-rc.d fail2ban defaults |
CentOS
|
1 2 |
yum install fail2ban chkconfig fail2ban on |
Punkt 2: Filter hinzufügen
Die Fail2Ban Filter werden im Ordner /etc/fail2ban/filter.d/ abgelegt, der Dateiname bestimmt den Filternamen in der später erklärten jail.conf.
Plesk Panel Port 8443
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
# Fail2Ban configuration file # # Author: Yaroslav O. Halchenko <debian@onerussian.com> # # $Revision: 716 $ # [Definition] # Option: failregex # Notes.: regex to match failures to find a home directory on a server, which # became popular last days. Most often attacker just uses IP instead of # domain name -- so expect to see them in generic error.log if you have # per-domain log files. # Values: TEXT # #xx.xx.xxx.x xx.xx.xxx.xxx:8443 - [08/Jul/2012:10:49:37 +0200] "POST /login_up.php3 HTTP/1.1" 200 6646 "-" "-" failregex = <HOST> .* \"POST /login_up.php3 .*\" [0-9]{3} [0-9]{4} .*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex = |
Courier IMAP/POP3
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
# Fail2Ban configuration file # # Author: Christoph Haas # Modified by: Cyril Jaquier # # $Revision: 728 $ # [Definition] # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Values: TEXT # failregex = LOGIN FAILED, ip=\[<HOST>\]$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex = |
Postfix SMTP
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
# Fail2Ban configuration file # # Author: Thanos Koukoulis # [Definition] # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P<host>\S+) # Values: TEXT # failregex = LOGIN FAILED, ip=\[<HOST>\] (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed: \w # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # .LOGIN FAILED, ip=\[<HOST>\] |
ProFTPd
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
# Fail2Ban configuration file # # Author: Yaroslav Halchenko # # $Revision$ # [Definition] # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Values: TEXT # failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+ *$ \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): .*$ \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\. *$ \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$ .*proftpd\[\S+\]: \S+ \(\S+\[<HOST>\]\) - no such user .*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex = |
Punkt 3: Jail Konfiguration
Nun bearbeiten wir /etc/fail2ban/jail.conf und fügen unsere Filter am Ende der Datei hinzu. Das SSHd Logfile wird automatisch überwacht und ist nach der Installation auch gleich aktiv.
Wichtig: Passt bitte die bantime und dest=me@me.net euren Wünschen an.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
[pleskpanel] enabled = true filter = plesk action = iptables-multiport[name=plesk, port="8443,8880,12443", protocol=tcp] logpath = /usr/local/psa/admin/logs/httpsd_access_log maxretry = 3 [courierservice] enabled = true filter = courierlogin action = iptables-multiport[name=courier, port="110,995,143,993", protocol=tcp] logpath = /usr/local/psa/var/log/maillog maxretry = 5 [smtp-iptables] enabled = true filter = smtp action = iptables-multiport[name=smtp, port="25,465,110,995,143,993", protocol=tcp] sendmail-whois[name=SMTP, dest=me@me.net , sender=fail2ban@me.net] logpath = /usr/local/psa/var/log/maillog maxretry = 5 [proftpd-iptables] enabled = true filter = proftpd action = iptables[name=ProFTPD, port=ftp, protocol=tcp] sendmail-whois[name=ProFTPD, dest=me@me.net, sender=fail2ban@me.net] logpath = /var/log/secure maxretry = 5 |
Nun aktivieren wir die neuen Filter.
|
1 |
/etc/init.d/fail2ban restart |
Blockierte IP-Adressen sehen wir im Logfile und in den iptables.
|
1 |
tail -f /var/log/fail2ban.log |
|
1 |
iptables -nL |
0