Glen Pitt-Pladdy :: Blogfail2ban on Cacti via SNMP | |||
fail2ban is a popular intrusion (and abuse) protection tool that is normally used to update firewall rules based on failed authentication attempts logged. For example if there are repeated failed attempts on your ssh port then that IP will be banned for several minutes, even hours. That means that brute force attacks from one source are practically impossible. More often than not attacks are on SMTP servers (spammers looking for a relay) or web forms / forums and it can be used equally well there. fail2ban to SNMPThis is based on my SNMP Basics article with my my Universal Log Analyser providing the basis of processing fail2ban log files for stats to ship via snmpd. First up ensure you get to grips with those first then you will need the universal log analyser plugin (see below). Place that where you keep the plugins and add to /etc/snmp/local-snmp/cronjob: # run fail2ban stats That tells uloganalyser to process fail2ban logs with the fail2ban plugin, putting the results in /var/local/snmp/fail2ban. From there a snmpd extension script (fail2ban-stats) picks up the data. Place that in a suitable place (eg. /etc/snmp) and add the following config to your /etc/snmp/snmpd.conf, restarting snmpd after: extend fail2ban /etc/snmp/fail2ban-stats SNMP to CactiAt this point your Cacti host definition needs to be working for SNMP and you should be able to simply import the template and add the graph. Download: Universal Log Analyser plugin and Cacti template for fail2ban on GitHub ExtendingThis is only a very small template as I only expose very limited services to the outside world, but it's easy to add more categories:
What it looks like
|
|||
|
Disclaimer: This is a load of random thoughts, ideas and other nonsense and is not intended to be taken seriously. I have no idea what I am doing with most of this so if you are stupid and naive enough to believe any of it, it is your own fault and you can live with the consequences. More importantly this blog may contain substances such as humor which have not yet been approved for human (or machine) consumption and could seriously damage your health if taken seriously. If you still feel the need to litigate (or whatever other legal nonsense people have dreamed up now), then please address all complaints and other stupidity to yourself as you clearly "don't get it".
Copyright Glen Pitt-Pladdy 2008-2023
|
|||
Comments:
I've got a new server pre-config with fail2ban with from iredmail postfix server setup; in the fail2ban it uses 'service-iredmail' convention as below, do i need to modify fail2ban.pm, or what else as well ?
/etc/snmp/uloganalyser-plugin/fail2ban.pm 20130331:110 /var/log/messages:160530
unknown class "ssh-iredmail" fail2ban: Dec 6 14:21:53 emu fail2ban.actions: WARNING
[ssh-iredmail] Unban 183.129.249.98
/etc/snmp/uloganalyser-plugin/fail2ban.pm 20130331:83 /var/log/messages:159122
unknown fail2ban: Dec 6 13:15:29 emu fail2ban.actions: INFO [postfix-iredmail]
50.70.125.250 already banned
-------------------------------------
# cat jail.local
# File generated by iRedMail (2013.11.05.17.36.10):
[ssh-iredmail]
..
[roundcube-iredmail]
..
[dovecot-iredmail]
..
[postfix-iredmail]
These tools are build for my needs which is to run on Debian based systems. You are welcome to extend them for your needs. In the case of what classes things are logged in, see the %CLASSES hash in fail2ban.pm which defines what log items are classified to what class of service for graphing.
This script looks good on debian but i`m trying to fix some problems with fail2ban.pm on Centos. After start uloganalyser with fail2ban plugin some informations are missing inside exit file:
On Centos i have
lastrun=1418645581
lastline=533
lastposition=48288
repeatline=2014-12-14 02:55:17,837 fail2ban.actions[28205]: WARNING [ssh-iptables] Ban 96.36.12.142
lastinode=195267
as you see lines started with fail2ban (fail2ban:banned:mail fail2ban:banned:other fail2ban:banned:ssh) are missing.
Any ide or clue how to fix this problem?
I'm guessing from the "repeatline" that Centos is using different labels from Debian. In Debian "ssh" is used, where your line above "ssh-iptables" is used. The %CLASSES hash provides the mappings from jail names to service classifications. It's likely you need something like:
'ssh-iptables' => 'ssh',
... and likewise for any other names Centos that need mapping onto generic service classes.
It was first thing what i added to filter but still not results.
Maybe something wrong is inside log file because from my observation Centos add process PID to fail2ban.actions:
2014-12-15 01:49:07,482 fail2ban.actions[28205]: WARNING [ssh-iptables] Ban 61.174.51.232
2014-12-15 03:07:38,474 fail2ban.actions[28205]: WARNING [ssh-iptables] Ban 23.253.97.132
Unfortunatelly there is no option to disable adding PID in config file.
Ok - then if the service classes are correct, then you will have to update the regular expressions to match any other format differences. The line prefix is taken care of in the 4th line of the "analyse" sub, and then the type of message and details in the if/elsif statements below that.
Essentially all this script does is match the lines with a regex, and then count up or down depending on Ban/Unban for the matching service class.
PERL is to complicate for me so together with my colleague we found different solution. He wrote small log parser to modify Centos logs and remove all information about PID. Now your script works fine :)
One more question - how often should be start cronjob?
Unfortunatelly PERL is too difficult for me, and sorry to say i have no idea how to fix it. I`ll try to find different solution.
Typically the sample period of Cacti is 5 minutes, so harvesting the data every 5 minutes would be the practical minimum. See the SNMP basics article for more information on the cronjob.