-
Notifications
You must be signed in to change notification settings - Fork 1
/
Fail2Ban
181 lines (136 loc) · 7.47 KB
/
Fail2Ban
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
sudo apt-get update ; apt-get install mutt fail2ban -y
touch /var/log/secure
ln -s /var/log/secure /var/log/auth.log
mv /etc/fail2ban/jail.d/defaults-debian.conf /etc/fail2ban/jail.d/defaults-debian.conf.bkp
mv /etc/fail2ban/jail.conf /etc/fail2ban/jail.conf.bkp
echo '# ===============================================================================================================
# Fail2Ban Arquivo de Configuração
#[INCLUDES]
#before = paths-debian.conf
[DEFAULT]
ignoreip = localhost
# Bloqueia por 12 horas
bantime = 21600
# Permanece registrado por 1 hora
findtime = 3600
# No maximo 30 tentativas
maxretry = 30
usedns = warn
backend = auto
#logencoding = auto
#enabled = false
#filter = %(__name__)s
mta = sendmail
#protocol = tcp
chain = INPUT
port = 0:65535
destemail = [email protected]
sendername = Fail2Ban
# Default action to take: ban only
action = iptables[name=%(__name__)s, port=%(port)s]
# ===============================================================================================================
[sshd]
enabled = true
filter = sshd
action = iptables-multiport[name=SSH, port="22,1804", protocol=tcp]
sendmail[name=SSH, [email protected]]
logpath = /var/log/auth.log
maxretry = 1
[pmg-web-auth]
enabled = true
filter = pmg-web-auth
action = iptables-multiport[name=PMG-WEB, port="8006", protocol=tcp]
sendmail[name=PMG-WEB, [email protected]]
logpath = /var/log/daemon.log
maxretry = 2
[pmg-smtp]
enabled = true
filter = pmg-smtp
action = iptables-multiport[name=PMG-SMTP, port="25,465,587", protocol=tcp]
sendmail[name=PMG-SMTP, [email protected]]
logpath = /var/log/mail.log
# ===============================================================================================================' echo > /etc/fail2ban/jail.conf
echo '# ===============================================================================================================
# Fail2Ban Arquivo de Configuração - PMG-WEB
[INCLUDES]
[Definition]
failregex = pmgdaemon\[.*authentication failure; rhost=<HOST> user=.* msg=.*
ignoreregex =
# ===============================================================================================================' echo > /etc/fail2ban/filter.d/pmg-web-auth.conf
echo '# ===============================================================================================================
# Fail2Ban Arquivo de Configuração - PMG-SMTP
[INCLUDES]
before = common.conf
[Definition]
_daemon = postfix/(submission/)?smtp(d|s)
failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.\d+ Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$
^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.\d+ : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
^%(__prefix_line)sNOQUEUE: reject: EHLO from \S+\[<HOST>\]: 504 5\.5\.\d+ <\S+>: Helo command rejected: need fully-qualified hostname;
^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$
^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.1\.\d+ <\S*>: Sender address rejected: Domain not found; from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$
^%(__prefix_line)sNOQUEUE: reject: RCPT from (.*)\[<HOST>\]: 450 4\.7\.\d+ .*$
^%(__prefix_line)simproper command pipelining after \S+ from [^[]*\[<HOST>\]:?$
(?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/ ]*)?$
#SPFBL
# ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 <\S*>: Recipient address rejected: SPFBL you are permanently blocked. *$
# ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 <\S*>: Recipient address rejected: SPFBL you was banned. *$
ignoreregex =
# ===============================================================================================================' echo > /etc/fail2ban/filter.d/pmg-smtp.conf
mv /etc/fail2ban/action.d/sendmail.conf /etc/fail2ban/action.d/sendmail.conf.bkp
echo '# ===============================================================================================================
# Fail2Ban Arquivo de Configuração - SENDMAIL
[INCLUDES]
before = sendmail-common.conf
[Definition]
actionstart = printf %%b "Subject: [Fail2Ban] <name>: iniciou em `uname -n`
Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
From: <sendername> <<sender>>
To: <dest>\n
Olá,\n
O jail <name> foi iniciado com sucesso.\n
Saudações,\n
Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
actionstop = printf %%b "Subject: [Fail2Ban] <name>: parou em `uname -n`
Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
From: <sendername> <<sender>>
To: <dest>\n
Olá,\n
O jail <name> foi parado.\n
Saudações,\n
Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
actioncheck =
actionban = printf %%b "Subject: [Fail2Ban] <name>: banido <ip> de `uname -n`
Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
From: <sendername> <<sender>>
To: <dest>\n
Olá,\n
O IP <ip> acaba de ser banido por Fail2Ban depois de
<failures> tentativas contra <name>.\n
Saudações,\n
Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
actionunban = printf %%b "Subject: [Fail2Ban] <name>: desbanido <ip> de `uname -n`
Date: `LC_TIME=C date -u +"%%a, %%d %%h %%Y %%T +0000"`
From: <sendername> <<sender>>
To: <dest>\n
Olá,\n
O IP <ip> acaba de ser desbanido contra <name>.\n
Saudações,\n
Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
[Init]
name = default
# ===============================================================================================================' echo > /etc/fail2ban/action.d/sendmail.conf
echo '# ===============================================================================================================
# Fail2Ban Arquivo de Configuração - MUTT
[Definition]
actionstart = echo "O jail <name> foi iniciado com sucesso." | /usr/bin/mutt -F /root/.muttrc -s "[Fail2Ban] <name>: iniciado em `uname -n`" <dest>
actionstop = echo "O jail <name> foi parado." | /usr/bin/mutt -F /root/.muttrc -s "[Fail2Ban] <name>: parado em `uname -n`" <dest>
actioncheck =
actionban = echo "O IP <ip> acaba de ser banido por Fail2Ban depois de <failures> tentativas contra <name>" | /usr/bin/mutt /root/.muttrc -s "[Fail2Ban] <name>: banido <ip> em `uname -n`" <dest>
actionunban = echo "O IP <ip> acaba de ser desbanido contra <name>" | /usr/bin/mutt /root/.muttrc -s "[Fail2Ban] <name>: desbanido <ip> em `uname -n`" <dest>
[Init]
name = default
# ===============================================================================================================' echo > /etc/fail2ban/action.d/mutt.conf
service fail2ban restart ; fail2ban-client status ; tail -f /var/log/fail2ban.log
systemctl restart fail2ban; systemctl status fail2ban
fail2ban-client -v status