Plesk Dienste mit Fail2Ban schützen

Um das Plesk Panel sowie andere Plesk Dienste wie IMAP, POP3, SMTP und SSH vor Bruteforce Attacken zu schützen, installieren wir Fail2Ban und fügen passende Filter hinzu.

Fail2Ban ist ein Dienst der Logdateien anderer Dienste überprüft und z.B.fehlerhafte IMAP Logins erkennt und die Source IP-Adresse per iptables sperrt.

Punkt 1: Installation von Fail2Ban

Zuerst installieren wir das benötigte Paket.

Debian

apt-get install fail2ban
update-rc.d fail2ban defaults

CentOS

yum install fail2ban
chkconfig fail2ban on

Punkt 2: Filter hinzufügen

Die Fail2Ban Filter werden im Ordner /etc/fail2ban/filter.d/ abgelegt, der Dateiname bestimmt den Filternamen in der später erklärten jail.conf.

Plesk Panel Port 8443

# Fail2Ban configuration file
#
# Author: Yaroslav O. Halchenko <debian@onerussian.com>
#
# $Revision: 716 $
#

[Definition]

# Option:  failregex
# Notes.:  regex to match failures to find a home directory on a server, which
#          became popular last days. Most often attacker just uses IP instead of
#          domain name -- so expect to see them in generic error.log if you have
#          per-domain log files.
# Values:  TEXT
#
#xx.xx.xxx.x xx.xx.xxx.xxx:8443 - [08/Jul/2012:10:49:37 +0200] "POST /login_up.php3 HTTP/1.1" 200 6646 "-" "-"
failregex = <HOST> .* \"POST /login_up.php3 .*\" [0-9]{3} [0-9]{4} .*$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

Courier IMAP/POP3

# Fail2Ban configuration file
#
# Author: Christoph Haas
# Modified by: Cyril Jaquier
#
# $Revision: 728 $
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
failregex = LOGIN FAILED, ip=\[<HOST>\]$

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Postfix SMTP

# Fail2Ban configuration file
#
# Author: Thanos Koukoulis
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = LOGIN FAILED, ip=\[<HOST>\]
(?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed: \w

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
# .LOGIN FAILED, ip=\[<HOST>\]

ProFTPd

# Fail2Ban configuration file
#
# Author: Yaroslav Halchenko
#
# $Revision$
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+ *$
            \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): .*$
            \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\. *$
            \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$
            .*proftpd\[\S+\]: \S+ \(\S+\[<HOST>\]\) - no such user .*$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

Punkt 3: Jail Konfiguration

Nun bearbeiten wir /etc/fail2ban/jail.conf und fügen unsere Filter am Ende der Datei hinzu. Das SSHd Logfile wird automatisch überwacht und ist nach der Installation auch gleich aktiv.

Wichtig: Passt bitte die bantime und dest=me@me.net euren Wünschen an.

[pleskpanel]

enabled = true
filter = plesk
action = iptables-multiport[name=plesk, port="8443,8880,12443", protocol=tcp]
logpath = /usr/local/psa/admin/logs/httpsd_access_log
maxretry = 3

[courierservice]

enabled = true
filter = courierlogin
action = iptables-multiport[name=courier, port="110,995,143,993", protocol=tcp]
logpath = /usr/local/psa/var/log/maillog
maxretry = 5

[smtp-iptables]

enabled = true
filter = smtp
action = iptables-multiport[name=smtp, port="25,465,110,995,143,993", protocol=tcp]
sendmail-whois[name=SMTP, dest=me@me.net , sender=fail2ban@me.net]
logpath = /usr/local/psa/var/log/maillog
maxretry = 5

[proftpd-iptables]

enabled = true
filter = proftpd
action = iptables[name=ProFTPD, port=ftp, protocol=tcp]
sendmail-whois[name=ProFTPD, dest=me@me.net, sender=fail2ban@me.net]
logpath = /var/log/secure
maxretry = 5

Nun aktivieren wir die neuen Filter.

/etc/init.d/fail2ban restart

Blockierte IP-Adressen sehen wir im Logfile und in den iptables.

tail -f /var/log/fail2ban.log

iptables -nL