{"id":1009,"date":"2014-07-14T20:26:06","date_gmt":"2014-07-14T19:26:06","guid":{"rendered":"https:\/\/www.fanjoe.be\/?p=1009"},"modified":"2015-01-22T00:41:26","modified_gmt":"2015-01-21T23:41:26","slug":"raspberry-pi-configurer-fail2ban","status":"publish","type":"post","link":"https:\/\/www.fanjoe.be\/?p=1009","title":{"rendered":"Raspberry Pi : Configurer Fail2Ban"},"content":{"rendered":"

\"Fail2ban-01\"<\/a><\/p>\n

Pour compl\u00e9ter l’article sur IPtables<\/a>, nous allons maintenant installer Fail2Ban.<\/p>\n

Fail2Ban est un programme \u00e9crit en Python qui va tourner en t\u00e2che de fond et analyser les logs des diff\u00e9rents serveur (Nginx, SSH, FTP, …). Il va rep\u00e9rer les erreurs d’acc\u00e8s et bannir l’adresse IP qui en est \u00e0 l’origine gr\u00e2ce \u00e0 IPtable. Tr\u00e8s concr\u00e8tement il va emp\u00eacher les attaques par force brute qui consistent \u00e0 essayer toutes les combinaisons de mots-de-passes.<\/p>\n

Vous pensez que \u00e7a ne peut pas vous arriver ? Je croyait, comme vous, \u00eatre \u00e0 l’abri de ce genre d’attaque jusqu’\u00e0 ce que je constate une charge anormale du processeur :<\/p>\n

<\/p>\n

\"Fail2ban-02\"<\/a><\/p>\n

Un petit netstat du port 22 m’a appris ceci :<\/p>\n

$ netstat -tn 2>\/dev\/null | grep :22 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head<\/pre>\n
 1 192.168.0.2\r\n35 116.10.191.213<\/pre>\n
Il y avait 35 process en cours sur le port 22 (SSH) venant d’une adresse IP situ\u00e9e en Chine :<\/p>\n
\"Fail2ban-03\"<\/a><\/p>\n
Pour installer Fail2Ban, c’est assez simple. Comme d’habitude, on va proc\u00e9der aux mises \u00e0 jours, puis \u00e0 l’installation du service :<\/p>\n
$ sudo apt-get update && sudo apt-get upgrade && sudo apt-get install fail2ban<\/pre>\n
Lecture des listes de paquets... Fait\r\nConstruction de l'arbre des d\u00e9pendances\r\nLecture des informations d'\u00e9tat... Fait\r\nLes paquets suppl\u00e9mentaires suivants seront install\u00e9s :\r\ngamin libgamin0 python-central python-gamin whois\r\nLes NOUVEAUX paquets suivants seront install\u00e9s :\r\nfail2ban gamin libgamin0 python-central python-gamin whois\r\n0 mis \u00e0 jour, 6 nouvellement install\u00e9s, 0 \u00e0 enlever et 0 non mis \u00e0 jour.\r\nIl est n\u00e9cessaire de prendre 347 ko dans les archives.\r\nApr\u00e8s cette op\u00e9ration, 1 371 ko d'espace disque suppl\u00e9mentaires seront utilis\u00e9s.\r\nSouhaitez-vous continuer [O\/n] ?<\/pre>\n
Une fois l’installation termin\u00e9e, on va \u00e9diter le fichier de configuration de Fail2Ban :<\/p>\n
$ sudo nano \/etc\/fail2ban\/jail.conf<\/pre>\n
Les valeurs par d\u00e9faut peuvent \u00eatre adapt\u00e9es. Elles vaudront pour toutes les r\u00e8gles, sauf si des valeurs sp\u00e9cifiques sont d\u00e9finies :<\/p>\n
[DEFAULT]\r\n\r\n# \"ignoreip\" can be an IP address, a CIDR mask or a DNS host\r\nignoreip = 127.0.0.1\/8\r\nbantime\u00a0 = 3600\r\nfindtime = 3600\r\nmaxretry = 3<\/pre>\n
Le bantime<\/code> et findtime<\/code> sont d\u00e9fini en secondes.<\/p>\n
bantime<\/code> indique le temps de bannissement.
\nfindtime<\/code> indique jusqu’o\u00f9 Fail2Ban doit remonter dans l’historique.
\nmaxretry<\/code> indique le nombre de tentatives infructueuses avant bannissement.<\/p>\n
Voici ce que j’ai d\u00e9fini pour SSH :<\/p>\n
[ssh]\r\n\r\nenabled\u00a0 = true\r\nport\u00a0\u00a0\u00a0\u00a0 = ssh\r\nfilter\u00a0\u00a0 = sshd\r\nlogpath\u00a0 = \/var\/log\/auth.log\r\nmaxretry = 3\r\nfindtime = 86400\r\nbantime = 86400<\/pre>\n
Et les r\u00e8gles pour Nginx :<\/p>\n
[nginx-auth]\r\nenabled = true\r\nfilter = nginx-auth\r\naction = iptables-multiport[name=NoAuthFailures, port=\"http,https\"]\r\nlogpath = \/var\/log\/nginx*\/*error*.log\r\nmaxretry = 3\r\n\r\n[nginx-login]\r\nenabled = true\r\nfilter = nginx-login\r\naction = iptables-multiport[name=NoLoginFailures, port=\"http,https\"]\r\nlogpath = \/var\/log\/nginx*\/*access*.log\r\nmaxretry = 3\r\n\r\n[nginx-noscript]\r\nenabled = true\r\naction = iptables-multiport[name=NoScript, port=\"http,https\"]\r\nfilter = nginx-noscript\r\nlogpath = \/var\/log\/nginx*\/*access*.log\r\nmaxretry = 3\r\nfindtime = 86400\r\nbantime\u00a0 = 86400<\/pre>\n
Pour chaque nouvelle r\u00e8gle que l’on ajoute dans jail.conf<\/code>, il faut cr\u00e9er un fichier de configuration dans \/etc\/fail2ban\/filter.d\/<\/code> :<\/p>\n
$ sudo nano \/etc\/fail2ban\/filter.d\/nginx-auth.conf<\/pre>\n
# Auth filter \/etc\/fail2ban\/filter.d\/nginx-auth.conf:\r\n#\r\n# Blocks IPs that fail to authenticate using basic authentication\r\n#\r\n[Definition]\r\n\r\nfailregex = no user\/password was provided for basic authentication.*client:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 user .* was not found in.*client:\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 user .* password mismatch.*client:\r\n\r\nignoreregex =<\/pre>\n
$ sudo nano \/etc\/fail2ban\/filter.d\/nginx-login.conf<\/pre>\n
# Login filter \/etc\/fail2ban\/filter.d\/nginx-login.conf:\r\n#\r\n# Blocks IPs that fail to authenticate using web application's log in page\r\n#\r\n# Scan access log for HTTP 200 + POST \/sessions => failed log in\r\n[Definition]\r\nfailregex = ^ -.*POST \/sessions HTTP\/1\\..\" 200\r\nignoreregex =<\/pre>\n
$ sudo nano \/etc\/fail2ban\/filter.d\/nginx-noscript.conf<\/pre>\n
# Noscript filter \/etc\/fail2ban\/filter.d\/nginx-noscript.conf:\r\n#\r\n# Block IPs trying to execute scripts such as .php, .pl, .exe and other funny scripts.\r\n#\r\n# Matches e.g.\r\n# 192.168.1.1 - - \"GET \/something.php\r\n#\r\n[Definition]\r\nfailregex = ^ -.*GET.*(\\.php|\\.asp|\\.exe|\\.pl|\\.cgi|\\scgi)\r\nignoreregex =<\/pre>\n
Une fois toutes les r\u00e8gles en place, on red\u00e9mare Fail2Ban :<\/p>\n
$ sudo service fail2ban restart<\/pre>\n
Apr\u00e8s quelques minutes ou heures, on devrait voir apparaitre quelques traces d’activit\u00e9 dans le log de Fail2Ban :<\/p>\n
$ sudo tail -f \/var\/log\/fail2ban.log<\/pre>\n
Pour plus d’infos, vous pouvez visiter ce site qui r\u00e9sume tout un tas de pr\u00e9cautions \u00e0 prendre pour \u00e9viter de se faire hacker :
\nhttp:\/\/www.clubic.com\/forum\/hardware-general\/raspberry-pi-ze-topic-id877239-page1.html<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
<\/a><\/p>\n
Pour compl\u00e9ter l’article sur IPtables<\/a>, nous allons maintenant installer Fail2Ban.<\/p>\n
Fail2Ban…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[10,3,12],"tags":[110,22],"class_list":["post-1009","post","type-post","status-publish","format-standard","hentry","category-geek","category-informatique","category-raspberrypi","tag-fail2ban","tag-raspberry-pi","end"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.fanjoe.be\/index.php?rest_route=\/wp\/v2\/posts\/1009","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.fanjoe.be\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fanjoe.be\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fanjoe.be\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fanjoe.be\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1009"}],"version-history":[{"count":0,"href":"https:\/\/www.fanjoe.be\/index.php?rest_route=\/wp\/v2\/posts\/1009\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.fanjoe.be\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1009"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fanjoe.be\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1009"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fanjoe.be\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}