linuxserver / fail2ban-confs Goto Github PK

These confs are pulled into our fail2ban image: https://github.com/linuxserver/docker-fail2ban

License: GNU General Public License v3.0

fail2ban-confs's Introduction

Configuration README

!! NOTICE !!

When using linuxserver/fail2ban, the *.conf files in this directory and its subdirectories will be replaced every time the container restarts. The files are meant to be easily viewed so that you can reference them.

If you would like to customize anything, create a *.local file with the same name as the *.conf file and apply your customizations. You do not need to copy the entire *.conf file to *.local, you only need to include things you want to change.

For example, to adjust jail.conf, create jail.local and apply your customizations there.

File Parsing Order

Fail2ban will combine action configurations in the following order:

action.d/*.conf (in alphabetical order)
action.d/*.local (in alphabetical order)

Fail2ban will combine filter configurations in the following order:

filter.d/*.conf (in alphabetical order)
filter.d/*.local (in alphabetical order)

Fail2ban will combine jail configurations in the following order:

jail.conf
jail.d/*.conf (in alphabetical order)
jail.local
jail.d/*.local (in alphabetical order)

Chains

Chains affect how access is restricted. There are two primary ways to restrict access.

`DOCKER-USER`

The DOCKER-USER chain is used to restrict access to applications running in Docker containers. This will restrict access to all containers, not just the one that the jail is configured for.

`INPUT`

The INPUT chain is used to restrict access to applications running on the host. This will restrict access to the host network stack. The host network stack may not be inclusive of all Docker network stacks, thus the DOCKER-USER chain is used separately for applications running in Docker containers.

`FORWARD` (for legacy versions of Docker)

The FORWARD chain may be used on systems running older versions of Docker where the DOCKER-USER chain is not available.

`jail.local` Examples

These are examples of what you can do in your jail.local. There is no universally correct way to setup jail.local as it depends on your needs. You can enable any of the pre-made jails by reviewing the files in jail.d/ and adding a few lines to your jail.local to enable the jail.

Basic Example

This example shows how to enable jails for sshd on the host, and SWAG (nginx) running in a container. It also includes some general recommendations and optional lines commented out.

In order for bans to work correctly, the INPUT chain should be used for applications running on the host, and the DOCKER-USER chain should be used for applications running in containers.

In this basic example:

sshd expects ssh to be running on the host (not in a container), so the INPUT chain is used
nginx-http-auth expects nginx to be running in a container (ex: SWAG), so the DOCKER-USER chain is used

[DEFAULT]

# Prevents banning LAN subnets
ignoreip    = 127.0.0.1/8 ::1
              10.0.0.0/8
              172.16.0.0/12
              192.168.0.0/16

# The ban action "iptables-multiport" (default) should work for most
# The ban action "iptables-allports" can be used if multiport causes issues
#banaction = %(banaction_allports)s

[sshd]
# configuration inherits from jail.conf
enabled = true
chain   = INPUT
action  = %(known/action)s

[nginx-http-auth]
# configuration inherits from jail.conf
enabled = true
chain   = DOCKER-USER
action  = %(known/action)s

[nginx-badbots]
# configuration inherits from jail.d/nginx-badbots.conf
enabled = true
chain   = DOCKER-USER
action  = %(known/action)s

[nginx-botsearch]
# configuration inherits from jail.conf
enabled = true
chain   = DOCKER-USER
action  = %(known/action)s

[nginx-deny]
# configuration inherits from jail.d/nginx-deny.conf
enabled = true
chain   = DOCKER-USER
action  = %(known/action)s

[nginx-unauthorized]
# configuration inherits from jail.d/nginx-unauthorized.conf
enabled = true
chain   = DOCKER-USER
action  = %(known/action)s

Incremental Banning

This example only includes the configurations for incremental banning. You can add these lines to the [DEFAULT] section of your existing config.

With these configurations, after an IP is unbanned, if it gets banned again the ban time will increase exponentially.

[DEFAULT]

# "bantime.increment" allows to use database for searching of previously banned ip's to increase a
# default ban time
bantime.increment = true

# "bantime.maxtime" is the max number of seconds using the ban time can reach (doesn't grow further)
bantime.maxtime = 5w

# "bantime.factor" is a coefficient to calculate exponent growing of the formula or common multiplier
bantime.factor = 24

# "bantime" is the number of seconds that a host is banned.
bantime = 1h

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 24h

# "maxretry" is the number of failures before a host get banned.
maxretry = 5

unRAID

Add these lines to your jail.local to enable jails for unRAID's sshd and Web GUI. The port line for the Web GUI is optional, but if you use unRAID's My Servers plugin to enable public access you should add the port you use (replace YOUR-UNRAID-MY-SERVERS-WAN-PORT) Both of these jails protect unRAID at the host level using the INPUT chain.

[unraid-sshd]
# configuration inherits from jail.d/unraid-sshd.conf
enabled = true
chain   = INPUT
action  = %(known/action)s

[unraid-webgui]
# configuration inherits from jail.d/unraid-webgui.conf
enabled = true
chain   = INPUT
port    = http,https,YOUR-UNRAID-MY-SERVERS-WAN-PORT
action  = %(known/action)s

Unifi-Controller

Add these lines to enable the jail for Unifi-Controller.

[unifi-controller-auth]
# configuration inherits from jail.d/unifi-controller-auth.conf
enabled = true
chain   = DOCKER-USER
action  = %(known/action)s

Additional Actions

The default action will use iptables to perform bans. You may also apply bans using other services such as CloudFlare, report bans to services such as AbuseIPDB, or setup notifications for with services such as Apprise or Discord Webhooks.

[DEFAULT]
# Apply additional actions to all bans with all jails
action  = %(action_)s
          apprise-api[host="127.0.0.1", tag="fail2ban"]
          cloudflare[cfuser="YOUR-EMAIL", cftoken="YOUR-TOKEN"]
          discord-webhook[webhook="https://discord.com/api/webhooks/######/######"]

abuseipdb_apikey = YOUR-API-KEY

[sshd]
# Apply additional actions only to bans for the sshd jail
action  = %(known/action)s
          abuseipdb[abuseipdb_apikey="%(abuseipdb_apikey)s", abuseipdb_category="18,22"]

[unifi-controller-auth]
# Apply additional actions only to bans for the unifi-controller-auth jail
action  = %(known/action)s
          abuseipdb[abuseipdb_apikey="%(abuseipdb_apikey)s", abuseipdb_category="18,21"]

Full Example

[DEFAULT]

# "bantime.increment" allows to use database for searching of previously banned ip's to increase a
# default ban time
bantime.increment = true

# "bantime.maxtime" is the max number of seconds using the ban time can reach (doesn't grow further)
bantime.maxtime = 5w

# "bantime.factor" is a coefficient to calculate exponent growing of the formula or common multiplier
bantime.factor = 24

# "bantime" is the number of seconds that a host is banned.
bantime = 1h

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 24h

# "maxretry" is the number of failures before a host get banned.
maxretry = 5

# Prevents banning LAN subnets
ignoreip    = 127.0.0.1/8 ::1
              10.0.0.0/8
              172.16.0.0/12
              192.168.0.0/16

# The ban action "iptables-multiport" (default) should work for most
# The ban action "iptables-allports" can be used if multiport causes issues
#banaction = %(banaction_allports)s

# Read https://github.com/sebres/PoC/blob/master/FW.IDS-DROP-vs-REJECT/README.md before changing block type
# The block type "REJECT --reject-with icmp-port-unreachable" (default behavior) should respond to, but then instantly reject connection attempts
# The block type "DROP" should not respond to connection attempts, resulting in a timeout
#banaction = iptables-multiport[blocktype=DROP]

# Add additional actions
action  = %(action_)s
          apprise-api[host="127.0.0.1", tag="fail2ban"]
          cloudflare[cfuser="YOUR-EMAIL", cftoken="YOUR-TOKEN"]

abuseipdb_apikey = YOUR-API-KEY

[unraid-sshd]
# configuration inherits from jail.d/unraid-sshd.conf
enabled = true
chain   = INPUT
action  = %(known/action)s
          abuseipdb[abuseipdb_apikey="%(abuseipdb_apikey)s", abuseipdb_category="18,22"]

[unraid-webgui]
# configuration inherits from jail.d/unraid-webgui.conf
enabled = true
chain   = INPUT
port    = http,https,YOUR-UNRAID-MY-SERVERS-WAN-PORT
action  = %(known/action)s
          abuseipdb[abuseipdb_apikey="%(abuseipdb_apikey)s", abuseipdb_category="18,21"]

[unifi-controller-auth]
# configuration inherits from jail.d/unifi-controller-auth.conf
enabled = true
chain   = DOCKER-USER
action  = %(known/action)s
          abuseipdb[abuseipdb_apikey="%(abuseipdb_apikey)s", abuseipdb_category="18,21"]

[vaultwarden-auth]
# configuration inherits from jail.d/vaultwarden-auth.conf
enabled = true
chain   = DOCKER-USER
action  = %(known/action)s
          abuseipdb[abuseipdb_apikey="%(abuseipdb_apikey)s", abuseipdb_category="18,21"]

Customizing jails

You can customize additional aspects about a jail by modifying your jail.local file.

[unifi-controller-auth]
# configuration inherits from jail.d/unifi-controller-auth.conf
enabled = true

# If you are using non-standard ports for your unifi-controller, you can specify the ports you use
port    = 8081,8442

# If your log file is mounted to a non-standard location inside the container, you can specify the path that the container will see your log file
logpath = /path/to/unificontroller/server.log

# If you are running the unifi-controller on your host (not in a docker container) you can change the chain to INPUT
#chain   = INPUT
# If you are running the unifi-controller in a docker container you can change the chain to DOCKER-USER
#chain   = DOCKER-USER

fail2ban-confs's People

Contributors

Stargazers

Watchers

Forkers

nomandera jinior ewojc binsentsu kasteddu gpaquis niaodian jeblove

fail2ban-confs's Issues

[Feature Request] Add configuration files for Caddy

Please add configuration files for Caddy! It's a really good web server that I use to reverse proxy to services, but there aren't any filter or jail configuration files for it yet.

Thanks, team linuxserver.io

Can't find fail2ban.sock

I'm using this fail2ban Prometheus exporter which relies on the fail2ban socket, but the exporter log is filled with errors about not being able to find the socket file.

Note that the author of the exporter recommends mounting the folder, not the socket file directly.

Ubuntu Server 20.04

docker-compose.yaml:

version: "3.9"
networks:
  metrix:
    external: true

services:
  fail2ban:
    image: lscr.io/linuxserver/fail2ban:latest
    container_name: fail2ban
    restart: unless-stopped
    environment:
      - TZ=America/Los_Angeles
    volumes:
      - ./socket:/var/run/fail2ban
      - ./config:/config
      - /var/log:/var/log:ro
      - /srv/emby/config/logs:/remotelogs/emby:ro
      - /srv/bittorrent/nginx/log:/remotelogs/nginx:ro
      - /srv/plex/config/Library/Application\ Support/Plex\ Media\ Server/Logs:/remotelogs/plex:ro
    cap_add:
      - NET_ADMIN
    network_mode: "host"

  f2b-exporter:
    image: registry.gitlab.com/hectorjsmith/fail2ban-prometheus-exporter:latest
    container_name: f2b-exporter
    volumes:
      - ./socket:/var/run/fail2ban:ro
    ports:
      - 9191:9191
    depends_on:
      - fail2ban
    networks:
      - metrix

I've tried to use a defined volume as well, but honestly, it doesn't seem that the fail2ban.sock file is located in /var/run/fail2ban at all in this image. If I run 'docker-compose exec fail2ban ls /var/run/fail2ban', I get an empty output.

Where is the fail2ban.sock file located in this image?

Thanks, team linuxserver.io

Cloudflare-token action doesn't execute actionunban

Hi,
I am trying to setup fail2ban with the Cloudflare-token action. I did some tests and I noticed that the action creates the firewall rules correctly when one or more IPs should be banned but it doesn't remove them when the ban is lifted.
I am also using the Opnsense rule and it works fine, so I assume this issue is only related to the Cloudflare token action.

As a side note, I've also noticed that Cloudflare is going to deprecate the firewall APIs in favour of the WAF custom rules.

Anyway this is my custom jail.local file.. Is anyone experiencing the same issue? Thanks

jail.local

[DEFAULT]
# "maxretry" is the number of failures before a host get banned.
maxretry = 1
bantime = 20s

# Apply additional actions to all bans with all jails
action  = cloudflare-token[cfzone="ZONE", cftoken="TOKEN"]
          gotify[url="URL"]

[emby-auth]
# Apply additional actions only to bans for the emby-auth jail
enabled = true
chain   = INPUT
action  = %(known/action)s
          opnsense[alias="Fail2Ban", firewall="URL", key="KEY", secret="SECRET", allow_insecure=false]

Dell Entrerpreise SONiC Jail/Rules

Is it possible to create jail and rule for Dell Enterprise SONiC.

DES use an audit log file for failed/wrong authentication. Fail2Ban docker install as a TCPM allow to enforce security on the switch by preventing bruteforce login/password.

See my Pull Request

User-defined jails not being loaded?

Hi, I'm trying to set up Fail2ban on my server. I've plugged Caddy's logs into Fail2ban using the remotelogs volume mapping and am trying to set up the jails so that Fail2ban will read Caddy's logs. However, I'm having a bit of trouble having Fail2ban read the jail configuration file.

The README states not to set up configuration files as .confs as they will be wiped between container restarts, so I copied the jail.d/nginx-bad-request.conf to jail.d/caddy.local. Then, in jail.local, I've added the following lines:

[caddy]
enabled = true
chain = DOCKER-USER
action  = %(known/action)s

However, when Fail2ban loads, the jail is not shown in fail2ban-client status. What am I doing wrong here?

unRAID 6.11.5

If I'm doing something wrong, can the relevant portion be added to the README on how to properly add user-defined jail files in jail.d and have it be loaded by jail.local?

Issue of traefik-auth not catching all log lines

Hi, monitoring the Traefik log I have an example of a successful ban and a missed ban. I suspect the regex in the filter.d traefik-auth file is not catching the lines. The example log file lines are:

188.95.55.5 - 11111 [05/Nov/2022:22:36:54 +0000] "GET / HTTP/2.0" 401 17 "-" "-" 295 "whoami-1@file" "-" 0ms
188.95.55.5 - 222222 [05/Nov/2022:22:36:59 +0000] "GET / HTTP/2.0" 401 17 "-" "-" 297 "whoami-1@file" "-" 0ms
188.95.55.5 - 33333 [05/Nov/2022:22:37:04 +0000] "GET / HTTP/2.0" 401 17 "-" "-" 298 "whoami-1@file" "-" 0ms
188.95.55.5 - - [05/Nov/2022:22:37:04 +0000] "GET / HTTP/2.0" 401 17 "-" "-" 299 "whoami-1@file" "-" 0ms
185.212.111.150 - - [05/Nov/2022:22:45:11 +0000] "GET /home/test.txt HTTP/2.0" 401 381 "-" "-" 316 "webdav@file" "https://10.0.10.10/:5006" 15ms
185.212.111.150 - - [05/Nov/2022:22:45:28 +0000] "GET /home/test.txt HTTP/2.0" 401 381 "-" "-" 317 "webdav@file" "https://10.0.10.10/:5006" 5510ms
185.212.111.150 - - [05/Nov/2022:22:45:42 +0000] "GET /home/test.txt HTTP/2.0" 401 381 "-" "-" 318 "webdav@file" "https://10.0.10.10/:5006" 5291ms
185.212.111.150 - - [05/Nov/2022:22:45:53 +0000] "GET /home/test.txt HTTP/2.0" 401 381 "-" "-" 320 "webdav@file" "https://10.0.10.10/:5006" 4070ms
185.212.111.150 - - [05/Nov/2022:22:45:57 +0000] "GET /home/test.txt HTTP/2.0" 401 381 "-" "-" 321 "webdav@file" "https://10.0.10.10/:5006" 6ms

In the above example the IP address 188.95.55.5 is caught and banned but 185.212.111.150 is not caught.

Running in docker under Ubuntu 22.04

jail.local:
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

destemail = [email protected]
sendername = Fail2ban
sender = [email protected]
mta = sendmail

bantime.increment = true
bantime.maxtime = 4w
bantime.factor = 24
bantime = 1h
findtime = 24h
maxretry = 3

action = %(action_mw)s

[traefik-auth]
enabled = true
chain = INPUT

Log file output

2022-11-05 22:36:54,404 FFFF8140EB20 INFO [traefik-auth] Found 188.95.55.5 - 2022-11-05 22:36:54
2022-11-05 22:36:59,622 FFFF8140EB20 INFO [traefik-auth] Found 188.95.55.5 - 2022-11-05 22:36:59
2022-11-05 22:37:04,235 FFFF8140EB20 INFO [traefik-auth] Found 188.95.55.5 - 2022-11-05 22:37:04
2022-11-05 22:37:04,263 FFFF8130BB20 NOTIC [traefik-auth] Ban 188.95.55.5

N/A

Would it be possible to maybe upgate the regex to catch this test intrusion please?

Thanks, team linuxserver.io

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.

linuxserver / fail2ban-confs Goto Github PK

fail2ban-confs's Introduction

Configuration README

File Parsing Order

Chains

DOCKER-USER

INPUT

FORWARD (for legacy versions of Docker)

jail.local Examples

Basic Example

Incremental Banning

unRAID

Unifi-Controller

Additional Actions

Full Example

Customizing jails

fail2ban-confs's People

Contributors

Stargazers

Watchers

Forkers

fail2ban-confs's Issues

Thanks, team linuxserver.io

Thanks, team linuxserver.io

Log file output

Thanks, team linuxserver.io

Recommend Projects

Recommend Topics

Recommend Org

`DOCKER-USER`

`INPUT`

`FORWARD` (for legacy versions of Docker)

`jail.local` Examples