Setting up Fail2ban against brute force attempts

blacklistd | fail2ban | sshguard

DRAFT - we didn’t get postfix-sasl to actually ban hosts, although attacks were detected. only ssh attackers were taken into account. as a result, we are better of with sshguard

Install

systemctl stop sshguard
systemctl disable sshguard

systemctl list-unit-files | grep tables
systemctl stop iptables
systemctl disable iptables

apt install fail2ban nftables

systemctl start nftables
systemctl enable nftables

Setup

eventually change the defaults to strenghten it more and avoid dns delays

cd /etc/fail2ban/
mv -i jail.conf jail.conf.dist
grep -vE '^#|^$' jail.conf.dist > jail.conf.clean
grep -vE '^#|^$' jail.conf.dist > jail.conf
vi jail.conf

bantime  = 12h
usedns = no

[pam-generic]
enabled = true

[recidive]
enabled = true
protocol  = 0-255

also switch Netfilter frontends and block all ports whatever protocol got catched

vi jail.conf

:%s/iptables/nftables/g

banaction = nftables-allports
banaction_allports = nftables-allports

ssh

tune your ssh port

vi /etc/fail2ban/jail.conf

[sshd]
port    = 2222

email

and make sure the email filters are enabled

vi jail.conf

[postfix]
enabled  = true

[postfix-rbl]
enabled  = true

[postfix-sasl]
enabled  = true

[dovecot]
enabled  = true

Ready to go

systemctl restart nftables.service

systemctl restart fail2ban
systemctl enable fail2ban

Operations

tail -F /var/log/syslog

fail2ban-client status
fail2ban-client banned

Additional notes

postfix docker image specifics

for a Postfix container providing its logs into /data/postfixprod/, you need to enable a specific filter

cd /etc/fail2ban/jail.d/
vi postfixprod.conf

[postfix-auth]
enabled  = true
port     = smtp,ssmtp
filter   = postfix-auth
action   = iptables[name=SMTP-auth, port=smtp, protocol=tcp]
logpath  = /data/postfixprod/mail.log

you should now see the new Iptables chains that are going to be maintained automatically (-n to avoid no-resolve delays),

iptables -L -n
iptables -L f2b-SMTP-auth -n
watch iptables -L f2b-SMTP-auth -n

Resources

https://github.com/fail2ban/fail2ban

Setting up Fail2ban against brute force attempts

Install

Setup

ssh

email

Ready to go

Operations

Additional notes

postfix docker image specifics

Resources

setup

tutorials

nftables

ssh

email

www

docker