Bloqueio de repetidas tentativas de login ao seu Linux
Esse artigo mostra como implementar um sistema de segurança para bloqueio de ataques brute-force em seu servidor SSH. Ao mesmo tempo também mostra como criar um esquema para permitir acesso remoto (para manutenção) a partir de qualquer IP da internet.
Parte 5: Configurando o fail2ban
O arquivo de configuração do fail2ban até o presente momento é o /etc/fail2ban.conf.
Para um funcionamento básico, não é necessário editar o arquivo, ele já vem com tudo configurado e pronto para usar.
As funcionalidades que eu achei interessantes são:
Para um funcionamento básico, não é necessário editar o arquivo, ele já vem com tudo configurado e pronto para usar.
As funcionalidades que eu achei interessantes são:
- Possibilidade de enviar um email para o root dizendo que um IP foi bloqueado;
- Possibilidade de analisar também os logs do Apache atrás de falhas repetidas de autenticação;
- Personalização de quantas falhas e de quanto tempo entre elas antes de se definir um bloqueio;
- Faixas de IPs a serem ignoradas no monitoramento;
- Expressões regex podem ser editadas de acordo com a necessidade.
# Fail2Ban configuration file
# $Revision: 1.8.2.13 $
# 2005.06.21 modified for readability Iain Lea iain@bricbrac.de
[DEFAULT]
# Option: background
# Notes.: start fail2ban as a daemon. Output is redirect to logfile.
# Values: [true | false] Default: false
background = false
# Option: debug
# Notes.: enable debug mode. More verbose output and bypass root user test.
# Values: [true | false] Default: false
debug = false
# Option: logtargets
# Notes.: log targets. Space separated list of logging targets.
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
logtargets = /var/log/fail2ban.log
# Option: syslog-target
# Notes.: where to find syslog facility if logtarget SYSLOG.
# Values: SOCKET HOST HOST:PORT Default: /dev/log
syslog-target = /dev/log
# Option: syslog-facility
# Notes.: which syslog facility to use if logtarget SYSLOG.
# Values: NUM Default: 1
syslog-facility = 1
# Option: pidlock
# Notes.: path of the PID lock file (must be able to write to file).
# Values: FILE Default: /var/run/fail2ban.pid
pidlock = /var/run/fail2ban.pid
# Option: maxfailures
# Notes.: number of failures before IP gets banned.
# Values: NUM Default: 5
maxfailures = 5
# Option: bantime
# Notes.: number of seconds an IP will be banned.
# Values: NUM Default: 600
bantime = 600
# Option: findtime
# Notes.: lifetime in seconds of a "failed" log entry.
# Values: NUM Default: 600
findtime = 600
# Option: ignoreip
# Notes.: space separated list of IP's to be ignored by fail2ban.
# You can use CIDR mask in order to specify a range.
# Example: ignoreip = 192.168.0.1/24 123.45.235.65
# Values: IP Default: 192.168.0.0/16
ignoreip = 192.168.0.0/16
# Option: cmdstart
# Notes.: command executed once at the start of Fail2Ban
# Values: CMD Default:
cmdstart =
# Option: cmdend
# Notes.: command executed once at the end of Fail2Ban.
# Values: CMD Default:
cmdend =
# Option: polltime
# Notes.: number of seconds fail2ban sleeps between iterations.
# Values: NUM Default: 1
polltime = 1
[MAIL]
# Option: enabled
# Notes.: enable mail notification when banning an IP address.
# Values: [true | false] Default: false
enabled = false
# Option: host
# Notes.: host running the mail server.
# Values: STR Default: localhost
host = localhost
# Option: port
# Notes.: port of the mail server.
# Values: INT Default: 25
port = 25
# Option: from
# Notes.: e-mail address of the sender.
# Values: MAIL Default: fail2ban
from = fail2ban
# Option: to
# Notes.: e-mail addresses of the receiver. Addresses are space separated.
# Values: MAIL Default: root
to = root
# Option: subject
# Notes.: subject of the e-mail.
# Tags: <ip> IP address
# <failures> number of failures
# <failtime> unix timestamp of the last failure
# Values: TEXT Default: [Fail2Ban] Banned <ip>
subject = [Fail2Ban] Banned <ip>
# Option: message
# Notes.: message of the e-mail.
# Tags: <ip> IP address
# <failures> number of failures
# <failtime> unix timestamp of the last failure
# <br> new line
# Values: TEXT Default:
message = Hi,<br>
The IP <ip> has just been banned by Fail2Ban after
<failures> attempts.<br>
Regards,<br>
Fail2Ban
# You can define a new section for each log file to check for
# password failure. Each section has to define the following
# options: logfile, fwban, fwunban, timeregex, timepattern,
# failregex.
[Apache]
# Option: enabled
# Notes.: enable monitoring for this section.
# Values: [true | false] Default: false
enabled = false
# Option: logfile
# Notes.: logfile to monitor.
# Values: FILE Default: /var/log/httpd/access_log
logfile = /var/log/httpd/access_log
# Option: fwstart
# Notes.: command executed once at the start of Fail2Ban
# Values: CMD Default:
fwstart = iptables -N fail2ban-http
iptables -I INPUT -p tcp --dport http -j fail2ban-http
iptables -A fail2ban-http -j RETURN
# Option: fwend
# Notes.: command executed once at the end of Fail2Ban
# Values: CMD Default:
fwend = iptables -D INPUT -p tcp --dport http -j fail2ban-http
iptables -D fail2ban-http -j RETURN
iptables -X fail2ban-http
# Option: fwban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <failures> number of failures
# <failtime> unix timestamp of the last failure
# <bantime> unix timestamp of the ban time
# Values: CMD
# Default: iptables -I INPUT 1 -s <ip> -j DROP
fwban = iptables -I fail2ban-http 1 -s <ip> -j DROP
# Option: fwunban
# Notes.: command executed when unbanning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <bantime> unix timestamp of the ban time
# <unbantime> unix timestamp of the unban time
# Values: CMD
# Default: iptables -D INPUT -s <ip> -j DROP
fwunban = iptables -D fail2ban-http -s <ip> -j DROP
# Option: timeregex
# Notes.: regex to match timestamp in Apache logfile.
# Values: [Wed Jan 05 15:08:01 2005]
# Default: S{3} S{3} d{2} d{2}:d{2}:d{2} d{4}
timeregex = S{3} S{3} d{2} d{2}:d{2}:d{2} d{4}
# Option: timepattern
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
# Values: TEXT Default: %%a %%b %%d %%H:%%M:%%S %%Y
timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
# Option: failregex
# Notes.: regex to match the password failure messages in the logfile.
# Values: TEXT Default: authentication failure|user .* not found
failregex = authentication failure|user .* not found
[SSH]
# Option: enabled
# Notes.: enable monitoring for this section.
# Values: [true | false] Default: true
enabled = true
# Option: logfile
# Notes.: logfile to monitor.
# Values: FILE Default: /var/log/secure
logfile = /var/log/secure
# Option: fwstart
# Notes.: command executed once at the start of Fail2Ban
# Values: CMD Default:
fwstart = iptables -N fail2ban-ssh
iptables -I INPUT -p tcp --dport ssh -j fail2ban-ssh
iptables -A fail2ban-ssh -j RETURN
# Option: fwend
# Notes.: command executed once at the end of Fail2Ban
# Values: CMD Default:
fwend = iptables -D INPUT -p tcp --dport ssh -j fail2ban-ssh
iptables -D fail2ban-ssh -j RETURN
iptables -X fail2ban-ssh
# Option: fwbanrule
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <failures> number of failures
# <failtime> unix timestamp of the last failure
# <bantime> unix timestamp of the ban time
# Values: CMD
# Default: iptables -I INPUT 1 -s <ip> -j DROP
fwban = iptables -I fail2ban-ssh 1 -s <ip> -j DROP
# Option: fwunbanrule
# Notes.: command executed when unbanning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <bantime> unix timestamp of the ban time
# <unbantime> unix timestamp of the unban time
# Values: CMD
# Default: iptables -D INPUT -s <ip> -j DROP
fwunban = iptables -D fail2ban-ssh -s <ip> -j DROP
# Option: timeregex
# Notes.: regex to match timestamp in SSH logfile.
# Values: [Mar 7 17:53:28]
# Default: S{3}s{1,2}d{1,2} d{2}:d{2}:d{2}
timeregex = S{3}s{1,2}d{1,2} d{2}:d{2}:d{2}
# Option: timepattern
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
# Values: TEXT Default: %%b %%d %%H:%%M:%%S
timepattern = %%b %%d %%H:%%M:%%S
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid ser
failregex = Authentication failure|Failed password|Invalid user
# $Revision: 1.8.2.13 $
# 2005.06.21 modified for readability Iain Lea iain@bricbrac.de
[DEFAULT]
# Option: background
# Notes.: start fail2ban as a daemon. Output is redirect to logfile.
# Values: [true | false] Default: false
background = false
# Option: debug
# Notes.: enable debug mode. More verbose output and bypass root user test.
# Values: [true | false] Default: false
debug = false
# Option: logtargets
# Notes.: log targets. Space separated list of logging targets.
# Values: STDERR SYSLOG file Default: /var/log/fail2ban.log
logtargets = /var/log/fail2ban.log
# Option: syslog-target
# Notes.: where to find syslog facility if logtarget SYSLOG.
# Values: SOCKET HOST HOST:PORT Default: /dev/log
syslog-target = /dev/log
# Option: syslog-facility
# Notes.: which syslog facility to use if logtarget SYSLOG.
# Values: NUM Default: 1
syslog-facility = 1
# Option: pidlock
# Notes.: path of the PID lock file (must be able to write to file).
# Values: FILE Default: /var/run/fail2ban.pid
pidlock = /var/run/fail2ban.pid
# Option: maxfailures
# Notes.: number of failures before IP gets banned.
# Values: NUM Default: 5
maxfailures = 5
# Option: bantime
# Notes.: number of seconds an IP will be banned.
# Values: NUM Default: 600
bantime = 600
# Option: findtime
# Notes.: lifetime in seconds of a "failed" log entry.
# Values: NUM Default: 600
findtime = 600
# Option: ignoreip
# Notes.: space separated list of IP's to be ignored by fail2ban.
# You can use CIDR mask in order to specify a range.
# Example: ignoreip = 192.168.0.1/24 123.45.235.65
# Values: IP Default: 192.168.0.0/16
ignoreip = 192.168.0.0/16
# Option: cmdstart
# Notes.: command executed once at the start of Fail2Ban
# Values: CMD Default:
cmdstart =
# Option: cmdend
# Notes.: command executed once at the end of Fail2Ban.
# Values: CMD Default:
cmdend =
# Option: polltime
# Notes.: number of seconds fail2ban sleeps between iterations.
# Values: NUM Default: 1
polltime = 1
[MAIL]
# Option: enabled
# Notes.: enable mail notification when banning an IP address.
# Values: [true | false] Default: false
enabled = false
# Option: host
# Notes.: host running the mail server.
# Values: STR Default: localhost
host = localhost
# Option: port
# Notes.: port of the mail server.
# Values: INT Default: 25
port = 25
# Option: from
# Notes.: e-mail address of the sender.
# Values: MAIL Default: fail2ban
from = fail2ban
# Option: to
# Notes.: e-mail addresses of the receiver. Addresses are space separated.
# Values: MAIL Default: root
to = root
# Option: subject
# Notes.: subject of the e-mail.
# Tags: <ip> IP address
# <failures> number of failures
# <failtime> unix timestamp of the last failure
# Values: TEXT Default: [Fail2Ban] Banned <ip>
subject = [Fail2Ban] Banned <ip>
# Option: message
# Notes.: message of the e-mail.
# Tags: <ip> IP address
# <failures> number of failures
# <failtime> unix timestamp of the last failure
# <br> new line
# Values: TEXT Default:
message = Hi,<br>
The IP <ip> has just been banned by Fail2Ban after
<failures> attempts.<br>
Regards,<br>
Fail2Ban
# You can define a new section for each log file to check for
# password failure. Each section has to define the following
# options: logfile, fwban, fwunban, timeregex, timepattern,
# failregex.
[Apache]
# Option: enabled
# Notes.: enable monitoring for this section.
# Values: [true | false] Default: false
enabled = false
# Option: logfile
# Notes.: logfile to monitor.
# Values: FILE Default: /var/log/httpd/access_log
logfile = /var/log/httpd/access_log
# Option: fwstart
# Notes.: command executed once at the start of Fail2Ban
# Values: CMD Default:
fwstart = iptables -N fail2ban-http
iptables -I INPUT -p tcp --dport http -j fail2ban-http
iptables -A fail2ban-http -j RETURN
# Option: fwend
# Notes.: command executed once at the end of Fail2Ban
# Values: CMD Default:
fwend = iptables -D INPUT -p tcp --dport http -j fail2ban-http
iptables -D fail2ban-http -j RETURN
iptables -X fail2ban-http
# Option: fwban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <failures> number of failures
# <failtime> unix timestamp of the last failure
# <bantime> unix timestamp of the ban time
# Values: CMD
# Default: iptables -I INPUT 1 -s <ip> -j DROP
fwban = iptables -I fail2ban-http 1 -s <ip> -j DROP
# Option: fwunban
# Notes.: command executed when unbanning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <bantime> unix timestamp of the ban time
# <unbantime> unix timestamp of the unban time
# Values: CMD
# Default: iptables -D INPUT -s <ip> -j DROP
fwunban = iptables -D fail2ban-http -s <ip> -j DROP
# Option: timeregex
# Notes.: regex to match timestamp in Apache logfile.
# Values: [Wed Jan 05 15:08:01 2005]
# Default: S{3} S{3} d{2} d{2}:d{2}:d{2} d{4}
timeregex = S{3} S{3} d{2} d{2}:d{2}:d{2} d{4}
# Option: timepattern
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
# Values: TEXT Default: %%a %%b %%d %%H:%%M:%%S %%Y
timepattern = %%a %%b %%d %%H:%%M:%%S %%Y
# Option: failregex
# Notes.: regex to match the password failure messages in the logfile.
# Values: TEXT Default: authentication failure|user .* not found
failregex = authentication failure|user .* not found
[SSH]
# Option: enabled
# Notes.: enable monitoring for this section.
# Values: [true | false] Default: true
enabled = true
# Option: logfile
# Notes.: logfile to monitor.
# Values: FILE Default: /var/log/secure
logfile = /var/log/secure
# Option: fwstart
# Notes.: command executed once at the start of Fail2Ban
# Values: CMD Default:
fwstart = iptables -N fail2ban-ssh
iptables -I INPUT -p tcp --dport ssh -j fail2ban-ssh
iptables -A fail2ban-ssh -j RETURN
# Option: fwend
# Notes.: command executed once at the end of Fail2Ban
# Values: CMD Default:
fwend = iptables -D INPUT -p tcp --dport ssh -j fail2ban-ssh
iptables -D fail2ban-ssh -j RETURN
iptables -X fail2ban-ssh
# Option: fwbanrule
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <failures> number of failures
# <failtime> unix timestamp of the last failure
# <bantime> unix timestamp of the ban time
# Values: CMD
# Default: iptables -I INPUT 1 -s <ip> -j DROP
fwban = iptables -I fail2ban-ssh 1 -s <ip> -j DROP
# Option: fwunbanrule
# Notes.: command executed when unbanning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <bantime> unix timestamp of the ban time
# <unbantime> unix timestamp of the unban time
# Values: CMD
# Default: iptables -D INPUT -s <ip> -j DROP
fwunban = iptables -D fail2ban-ssh -s <ip> -j DROP
# Option: timeregex
# Notes.: regex to match timestamp in SSH logfile.
# Values: [Mar 7 17:53:28]
# Default: S{3}s{1,2}d{1,2} d{2}:d{2}:d{2}
timeregex = S{3}s{1,2}d{1,2} d{2}:d{2}:d{2}
# Option: timepattern
# Notes.: format used in "timeregex" fields definition. Note that '%' must be
# escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
# Values: TEXT Default: %%b %%d %%H:%%M:%%S
timepattern = %%b %%d %%H:%%M:%%S
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT Default: Authentication failure|Failed password|Invalid ser
failregex = Authentication failure|Failed password|Invalid user
Eu gostaria de citar outros dois softwares que utilizo para bloquear IP´s de atacantes em meu servidor:
APF Firewall
http://www.rfxnetworks.com/apf.php
Descrição: Firewall baseado em IPTables de fácil configuração e muito eficiente. A configuração é feita através de um .conf simples onde são informadas as portas a serem liberadas/bloqueadas, além de outras funcionalidades tanto para portas tcp como udp, além de bloquear ataques via ICMP (Denial of Service por exemplo) pois possui embutido um "anti-DOS". Utiliza a lista negras de IP´s que é atualizada frequentemente através do site www.dshiel.org (Distributed Intrusion Detection System), onde constam os IP´s utilizados com maior frequência para fins ilícitos.
-------------------------------------------
BFD - Brute Force Detect
http://www.rfxnetworks.com/bfd.php
Descrição: Em conjunto com o APF Firewall, detecta tentativas de acesso não autorizada a serviços como SSH, Apache, EXIM, FTP, etc. Após 5 tentativas de acesso sem sucesso, o IP de origem é "dropado" no IpTables e o administrador do servidor pode ser avisado por e-mail.
Ambos são desenvolvidos pelo RFX Networks e são free e de uso irrestrito. Não é preciso manjar de IpTables, basta saber quais portais você quer liberar/fechar e eles fazem o trabalho.
É isso ai!
Abraço, Fernando.