Fail2ban in NethServer

Feature
30

So new version of manual for NS version 6.7:

  1. install fail2ban

  2. Edit custom config

    mkdir -p /etc/e-smith/templates-custom/etc/shorewall/shorewall.conf
    cp -p /etc/e-smith/templates/etc/shorewall/shorewall.conf/60options /etc/e-smith/templates-custom/etc/shorewall/shorewall.conf/60options
    vim /etc/e-smith/templates-custom/etc/shorewall/shorewall.conf/60options

    BLACKLIST=“ALL”

  3. Edit jail.local for futher updates

    cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

vim /etc/fail2ban/jail.local

usedns = no
banaction = shorewall
#
# JAILS
#

[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
maxretry = 2

4)Edit /etc/fail2ban/action.d/shorewall.conf

blocktype = drop

  1. As for finding out who is blocked run :

    shorewall show dynamic

  2. For testing filters for other services run :

    fail2ban-regex /var/log/messages /etc/fail2ban/filter.d/sshd-ddos.conf

    Running tests

     Use   failregex filter file : sshd-ddos, basedir: /etc/fail2ban

    Use log file : /var/log/messages
    Use encoding : UTF-8

    Results

     Failregex: 27 total

    |- #) [# of hits] regular expression
    | 1) [27] ^\s*(<[^.]+.[^.]+>)?\s*(?:\S+ )?(?:kernel: [ \d+.\d+] )?(?:@vserver_\S+ )?(?:(?:[\d+])?:\s+[[(]?sshd(?:(\S+))?[])]?:?|[[(]?sshd(?:(\S+))?[])]?:?(?:[\d+])?:?)?\s(?:[ID \d+ \S+])?\sDid not receive identification string from \s*$
    `-
    Ignoreregex: 0 total

    Lines: 39917 lines, 0 ignored, 27 matched, 39890 missed [processed in 8.54 sec]
    Missed line(s): too many to print. Use --print-all-missed to print all 39890 lines

  3. For verbose output please use :

    fail2ban-regex -v /var/log/messages /etc/fail2ban/filter.d/sshd-ddos.conf

3 Likes