CentOS7 : Fail2Ban のインストール

　ログを監視して不審なアクセス遮断してくれる Fail2Ban をインストールしたので、そのメモです。
　iptables の設定だけでも、試行回数に応じた遮断はできるのですが、予想以上に効果があったのでおすすめです。

スポンサーリンク（広告）

Fail2Ban のインストール

sudo yum install -y epel-release
sudo yum install -y –-enablerepo=epel fail2ban

1 2	sudo yum install -y epel-release sudo yum install -y –-enablerepo=epel fail2ban

ログファイルの保存場所の変更

　デフォルトだと、/var/log/ に保存されるのですが、整理のために変更します。

sudo mkdir /var/log/fail2ban
sudo vi /etc/fail2ban/fail2ban.conf

1 2	sudo mkdir /var/log/fail2ban sudo vi /etc/fail2ban/fail2ban.conf

# Option: logtarget
# Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
#         Only one log target can be specified.
#         If you change logtarget from the default value and you are
#         using logrotate -- also adjust or disable rotation in the
#         corresponding configuration file
#         (e.g. /etc/logrotate.d/fail2ban on Debian systems)
# Values: [ STDOUT | STDERR | SYSLOG | FILE ]  Default: STDERR
#
#logtarget = /var/log/fail2ban.log
logtarget = /var/log/fail2ban/fail2ban.log

# Option: logtarget

# Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.

# Only one log target can be specified.

# If you change logtarget from the default value and you are

# using logrotate -- also adjust or disable rotation in the

# corresponding configuration file

# (e.g. /etc/logrotate.d/fail2ban on Debian systems)

# Values: [ STDOUT | STDERR | SYSLOG | FILE ] Default: STDERR

#logtarget = /var/log/fail2ban.log

logtarget = /var/log/fail2ban/fail2ban.log

　併せて、ログローテートの設定も編集します。

sudo vi /etc/logrotate.d/fail2ban

1	sudo vi /etc/logrotate.d/fail2ban

#
# Gentoo:
# http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/files/fail2ban-logrotate?view=markup
#
# Debian:
# https://github.com/fail2ban/fail2ban/blob/debian/debian/fail2ban.logrotate

/var/log/fail2ban/fail2ban.log {
        missingok
        notifempty
        postrotate
        /usr/bin/fail2ban-client flushlogs >/dev/null || true
        endscript
}

# Gentoo:

# http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/files/fail2ban-logrotate?view=markup

# Debian:

# https://github.com/fail2ban/fail2ban/blob/debian/debian/fail2ban.logrotate

/var/log/fail2ban/fail2ban.log {

missingok

notifempty

postrotate

/usr/bin/fail2ban-client flushlogs >/dev/null || true

endscript

}

Fail2Ban の設定

　Fail2Ban の設定は、/etc/fail2ban/jail.local に書き込まれた内容が優先して適用されますので、細かい設定はこちらのファイルを使って行います。

sudo vi /etc/fail2ban/jail.local

1	sudo vi /etc/fail2ban/jail.local

[DEFAULT]
#ホワイトリスト
#ignoreip = 127.0.0.0/8
ignoreip = 127.0.0.0/8 hogehoge.net

# "bantime" is the number of seconds that a host is banned.
bantime  = 600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 5

[sshd]
enabled = true
ignoreip = 127.0.0.0/8 hogehoge.net 192.168.0.1/32
bantime  = 86400
findtime  = 86400
maxretry = 5

[sshd-ddos]
enabled = true

[apache-auth]
enabled = true

[apache-badbots]
enabled = true

[apache-nohome]
enabled = true

[apache-modsecurity]
enabled = true

[apache-shellshock]
enabled = true

[dovecot]
enabled = true
bantime  = 86400
findtime  = 86400
maxretry = 5

[postfix]
enabled = true
bantime  = 86400
findtime  = 86400
maxretry = 5

[postfix-sasl]
enabled = true
bantime  = 86400
findtime  = 86400
maxretry = 5

[webmin-auth]
enabled = true

[DEFAULT]

#ホワイトリスト

#ignoreip = 127.0.0.0/8

ignoreip = 127.0.0.0/8 hogehoge.net

# "bantime" is the number of seconds that a host is banned.

bantime = 600

# A host is banned if it has generated "maxretry" during the last "findtime"

# seconds.

findtime = 600

# "maxretry" is the number of failures before a host get banned.

maxretry = 5

[sshd]

enabled = true

ignoreip = 127.0.0.0/8 hogehoge.net 192.168.0.1/32

bantime = 86400

findtime = 86400

maxretry = 5

[sshd-ddos]

enabled = true

[apache-auth]

enabled = true

[apache-badbots]

enabled = true

[apache-nohome]

enabled = true

[apache-modsecurity]

enabled = true

[apache-shellshock]

enabled = true

[dovecot]

enabled = true

bantime = 86400

findtime = 86400

maxretry = 5

[postfix]

enabled = true

bantime = 86400

findtime = 86400

maxretry = 5

[postfix-sasl]

enabled = true

bantime = 86400

findtime = 86400

maxretry = 5

[webmin-auth]

enabled = true

iptables を使う場合

　FirewallD ではなく iptables を使う場合は、以下の設定をコメントアウトします。

sudo vi /etc/fail2ban/jail.d/00-firewalld.conf

1	sudo vi /etc/fail2ban/jail.d/00-firewalld.conf

# This file is part of the fail2ban-firewalld package to configure the use of
# the firewalld actions as the default actions.  You can remove this package
# (along with the empty fail2ban meta-package) if you do not use firewalld
[DEFAULT]
#banaction = firewallcmd-ipset
#↓iptablesを使うので追記
banaction = iptables-multiport

# This file is part of the fail2ban-firewalld package to configure the use of

# the firewalld actions as the default actions. You can remove this package

# (along with the empty fail2ban meta-package) if you do not use firewalld

[DEFAULT]

#banaction = firewallcmd-ipset

#↓iptablesを使うので追記

banaction = iptables-multiport

　Fail2Ban をインストールしたときに、依存関係で FirewallD もインストールされてしまっている場合は、自動起動をオフにします。

sudo systemctl stop firewalld
sudo systemctl disable firewalld

1 2	sudo systemctl stop firewalld sudo systemctl disable firewalld

Webmin-auth を有効にする場合

　Webmin-auth を有効にするにするとログに以下のような警告が表示されます。

NOTICE  Jail started without 'journalmatch' set. Jail regexs will be checked against all journal entries, which is not advised for performance reasons.

1	NOTICE Jail started without 'journalmatch' set. Jail regexs will be checked against all journal entries, which is not advised for performance reasons.

　ということで、journalmatch のセクションをフィルタファイルに書き足します。

sudo vi /etc/fail2ban/filter.d/webmin-auth.conf

1	sudo vi /etc/fail2ban/filter.d/webmin-auth.conf

# Fail2Ban filter for webmin
#

[INCLUDES]

before = common.conf

[Definition]

_daemon = webmin

failregex = ^%(__prefix_line)sNon-existent login as .+ from <HOST>\s*$
            ^%(__prefix_line)sInvalid login as .+ from <HOST>\s*$

ignoreregex = 

# DEV Notes:
#
# pattern :     webmin[15673]: Non-existent login as toto from 86.0.6.217
#               webmin[29544]: Invalid login as root from 86.0.6.217
#
# Rule Author: Delvit Guillaume

# backend=systemd を使えるように追加
[Init]
journalmatch = _SYSTEMD_UNIT=webmin.service

# Fail2Ban filter for webmin

[INCLUDES]

before = common.conf

[Definition]

_daemon = webmin

failregex = ^%(__prefix_line)sNon-existent login as .+ from <HOST>\s*$

^%(__prefix_line)sInvalid login as .+ from <HOST>\s*$

ignoreregex =

# DEV Notes:

# pattern : webmin[15673]: Non-existent login as toto from 86.0.6.217

# webmin[29544]: Invalid login as root from 86.0.6.217

# Rule Author: Delvit Guillaume

# backend=systemd を使えるように追加

[Init]

journalmatch = _SYSTEMD_UNIT=webmin.service

ブラックリストを導入する場合

　Unban されたら、何事もなかったかのように再度アタックしてくるのがうざい場合は、ブラックリストの導入がおすすめです。

　フィルタの作成

cd /etc/fail2ban/filter.d
sudo wget https://raw.githubusercontent.com/mitchellkrogza/Fail2Ban-Blacklist-JAIL-for-Repeat-Offenders-with-Perma-Extended-Banning/master/filter.d/blacklist.conf -O blacklist.conf

1 2	cd /etc/fail2ban/filter.d sudo wget https://raw.githubusercontent.com/mitchellkrogza/Fail2Ban-Blacklist-JAIL-for-Repeat-Offenders-with-Perma-Extended-Banning/master/filter.d/blacklist.conf -O blacklist.conf

　アクションの作成

cd /etc/fail2ban/action.d
sudo wget https://raw.githubusercontent.com/mitchellkrogza/Fail2Ban-Blacklist-JAIL-for-Repeat-Offenders-with-Perma-Extended-Banning/master/action.d/blacklist.conf -O blacklist.conf

1 2	cd /etc/fail2ban/action.d sudo wget https://raw.githubusercontent.com/mitchellkrogza/Fail2Ban-Blacklist-JAIL-for-Repeat-Offenders-with-Perma-Extended-Banning/master/action.d/blacklist.conf -O blacklist.conf

　ブラックリストファイルの作成

sudo touch /etc/fail2ban/ip.blacklist
sudo chmod 755 /etc/fail2ban/ip.blacklist

1 2	sudo touch /etc/fail2ban/ip.blacklist sudo chmod 755 /etc/fail2ban/ip.blacklist

　設定ファイルの追記

[blacklist]
enabled = true
filter = blacklist
banaction = blacklist
logpath  = /var/log/fail2ban/fail2ban.*
bantime  = 31536000   ; 1 year
findtime = 31536000   ; 1 year
maxretry = 10

[blacklist]

enabled = true

filter = blacklist

banaction = blacklist

logpath = /var/log/fail2ban/fail2ban.*

bantime = 31536000 ; 1 year

findtime = 31536000 ; 1 year

maxretry = 10

Fail2Ban の起動

　Fail2Ban を起動し、併せて自動起動を有効にします。

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

1 2	sudo systemctl start fail2ban sudo systemctl enable fail2ban