Fail2ban IDS Framework

fail2ban est un système de protection contre les tentatives d'intrusion désormais écrit en langage Python.
Il est le plus souvent utilisé pour bannir les adresses IP inconnues qui tentent de se connecter indûment avec SSH.

Installation et configuration

pkg install pf py27-fail2ban

cp -a /usr/local/etc/fail2ban/fail2ban.conf /usr/local/etc/fail2ban/fail2ban.local

cat /usr/local/etc/fail2ban/jail.d/sshd.conf

[ssh-pf]
enabled  = true
filter   = bsd-sshd
action   = pf
logpath  = /var/log/auth.log
bantime  = 5400
findtime = 5400
maxretry = 3

cat /usr/local/etc/fail2ban/filter.d/bsd-sshd.conf

# Fail2Ban configuration file
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf
[Definition]
_daemon = sshd
# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>S+)
# Values:  TEXT
#
failregex = ^%(__prefix_line)s(?:error: PAM: )?[A|a]uthentication (?:failure|error) for .* from <HOST>s*$
            ^%(__prefix_line)sDid not receive identification string from <HOST>$
            ^%(__prefix_line)sFailed [-/w]+ for .* from <HOST>(?: port d*)?(?: sshd*)?$
            ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>s*$
            ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>s*$
            ^%(__prefix_line)sUser S+ from <HOST> not allowed because not listed in AllowUsers$
            ^%(__prefix_line)sauthentication failure; logname=S* uid=S* euid=S* tty=S* ruser=S* rhost=<HOST>(?:s+user=.*)?s*$
            ^%(__prefix_line)srefused connect from S+ (<HOST>)s*$
            ^%(__prefix_line)sreverse mapping checking getaddrinfo for .* [<HOST>] .* POSSIBLE BREAK-IN ATTEMPT!$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

[Definition]
actionstart =
actionstop =
actioncheck =
actionban = pfctl -t fail2ban -T add <ip>
actionunban = pfctl -t fail2ban -T delete `pfctl -t fail2ban -T show 2>/dev/null | grep <ip>`
[Init]
port = ssh
localhost = 127.0.0.1

Configurer pf pour bloquer les adresses placées en liste noire

Dans /etc/pf.conf il faut ajouter le contenu suivant :

ext_if="em2" # interface à utiliser pour les bannissements 
table <fail2ban> persist
block quick proto tcp from <fail2ban> to $ext_if port ssh

Démarrage

Dans /etc/rc.conf, il faut ajouter le contenu :

#Fail2ban
pf_enable="Yes"
fail2ban_enable="Yes"

Puis (re)lancer manuellement les services :

Surveiller les actions avec :

tail -f /var/log/fail2ban.log

Lister les IPs bannies avec :

pfctl -t fail2ban -T show

Utilisation

Sources

• http://blog.alteroot.org/articles/2014-06-14/fail2ban-on-freebsd.html
• http://philpep.org/blog/fail2ban-sshd-et-pf
• http://www.fail2ban.org/wiki/index.php/MANUAL08