From 5d60700c0ca0910275629db956caffb117618cde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Fri, 10 Jul 2015 16:22:43 +0200 Subject: [PATCH 1/5] Added pass2allow (knocking with fail2ban) --- ChangeLog | 3 + config/action.d/allow-iptables-multiport.conf | 59 +++++++++++++++++++ config/filter.d/apache-pass.conf | 20 +++++++ config/jail.conf | 13 ++++ 4 files changed, 95 insertions(+) create mode 100644 config/action.d/allow-iptables-multiport.conf create mode 100644 config/filter.d/apache-pass.conf diff --git a/ChangeLog b/ChangeLog index bc849aaa..ac61693f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,6 +34,9 @@ ver. 0.9.3 (2015/XX/XXX) - wanna-be-released - New Features: * New filters: - froxlor-auth Thanks Joern Muehlencord + * New type of operation: + - pass2allow: use fail2ban for "knocking", opening a closed port + (apache-pass filter, allow-iptables-multiport action) - Enhancements: * action.d/cloudflare.conf - improved documentation on how to allow diff --git a/config/action.d/allow-iptables-multiport.conf b/config/action.d/allow-iptables-multiport.conf new file mode 100644 index 00000000..6f9ffd71 --- /dev/null +++ b/config/action.d/allow-iptables-multiport.conf @@ -0,0 +1,59 @@ +# Fail2Ban configuration file for allowing hosts +# +# WARNING +# Please be aware that all users behind NAT will access the service on the specified port. +# You should protect this service with another jail that has very long bantime. + +[INCLUDES] + +before = iptables-common.conf + +[Definition] + +# Option: actionstart +# Notes.: command executed once at the start of Fail2Ban. +# Values: CMD +# +actionstart = iptables -N f2b- + iptables -A f2b- -j + iptables -I -p -m multiport --dports -j f2b- + +# Option: actionstop +# Notes.: command executed once at the end of Fail2Ban +# Values: CMD +# +actionstop = iptables -D -p -m multiport --dports -j f2b- + iptables -F f2b- + iptables -X f2b- + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = iptables -n -L | grep -q 'f2b-[ \t]' + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = iptables -I f2b- 1 -s -j + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = iptables -D f2b- -s -j + +[Init] + +# Option: allowtype +# Notes: ACCEPT skips other chains +# Value: [ RETURN | ACCEPT ] +# +allowtype = RETURN + +# Author: Viktor Szépe diff --git a/config/filter.d/apache-pass.conf b/config/filter.d/apache-pass.conf new file mode 100644 index 00000000..dd00f953 --- /dev/null +++ b/config/filter.d/apache-pass.conf @@ -0,0 +1,20 @@ +# Fail2Ban Apache pass filter +# This filter is for access.log, NOT for error.log +# +# The knocking request must have a referer. + +[INCLUDES] + +before = apache-common.conf + +[Definition] + +failregex = ^ - \w+ \[\] "GET HTTP/1\.[01]" 200 \d+ ".*" "[^-].*"$ + +ignoreregex = + +[Init] + +knocking_url = /knocking/ + +# Author: Viktor Szépe diff --git a/config/jail.conf b/config/jail.conf index 67eda24e..ca0a2bfa 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -767,3 +767,16 @@ port = 2222 enabled = false logpath = /var/lib/portsentry/portsentry.history maxretry = 1 + +[pass2allow] +# allow FTP traffic after successful HTTP auth +enabled = false +filter = apache-pass +banaction = allow-iptables-multiport +# access log of the website with HTTP auth +logpath = /var/log/apache2/access.log +port = ftp,ftp-data,ftps,ftps-data +protocol = tcp +bantime = 3600 +maxretry = 1 +findtime = 1 From 5b7e1de2f4a99b00b70bb5f743780445cd8e2a7b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Sat, 11 Jul 2015 18:20:09 +0200 Subject: [PATCH 2/5] Instead of allow-iptables-multiport actions swap blocktype and (new) returntype --- config/action.d/allow-iptables-multiport.conf | 59 ------------------- config/action.d/iptables-allports.conf | 2 +- config/action.d/iptables-common.conf | 6 ++ config/action.d/iptables-multiport-log.conf | 2 +- config/action.d/iptables-multiport.conf | 2 +- config/action.d/iptables-new.conf | 2 +- config/action.d/iptables.conf | 2 +- config/jail.conf | 20 ++++--- 8 files changed, 22 insertions(+), 73 deletions(-) delete mode 100644 config/action.d/allow-iptables-multiport.conf diff --git a/config/action.d/allow-iptables-multiport.conf b/config/action.d/allow-iptables-multiport.conf deleted file mode 100644 index 6f9ffd71..00000000 --- a/config/action.d/allow-iptables-multiport.conf +++ /dev/null @@ -1,59 +0,0 @@ -# Fail2Ban configuration file for allowing hosts -# -# WARNING -# Please be aware that all users behind NAT will access the service on the specified port. -# You should protect this service with another jail that has very long bantime. - -[INCLUDES] - -before = iptables-common.conf - -[Definition] - -# Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. -# Values: CMD -# -actionstart = iptables -N f2b- - iptables -A f2b- -j - iptables -I -p -m multiport --dports -j f2b- - -# Option: actionstop -# Notes.: command executed once at the end of Fail2Ban -# Values: CMD -# -actionstop = iptables -D -p -m multiport --dports -j f2b- - iptables -F f2b- - iptables -X f2b- - -# Option: actioncheck -# Notes.: command executed once before each actionban command -# Values: CMD -# -actioncheck = iptables -n -L | grep -q 'f2b-[ \t]' - -# Option: actionban -# Notes.: command executed when banning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionban = iptables -I f2b- 1 -s -j - -# Option: actionunban -# Notes.: command executed when unbanning an IP. Take care that the -# command is executed with Fail2Ban user rights. -# Tags: See jail.conf(5) man page -# Values: CMD -# -actionunban = iptables -D f2b- -s -j - -[Init] - -# Option: allowtype -# Notes: ACCEPT skips other chains -# Value: [ RETURN | ACCEPT ] -# -allowtype = RETURN - -# Author: Viktor Szépe diff --git a/config/action.d/iptables-allports.conf b/config/action.d/iptables-allports.conf index b30404d3..9e2d18a3 100644 --- a/config/action.d/iptables-allports.conf +++ b/config/action.d/iptables-allports.conf @@ -18,7 +18,7 @@ before = iptables-common.conf # Values: CMD # actionstart = iptables -N f2b- - iptables -A f2b- -j RETURN + iptables -A f2b- -j iptables -I -p -j f2b- # Option: actionstop diff --git a/config/action.d/iptables-common.conf b/config/action.d/iptables-common.conf index c191c5a1..dff01362 100644 --- a/config/action.d/iptables-common.conf +++ b/config/action.d/iptables-common.conf @@ -43,3 +43,9 @@ protocol = tcp # REJECT, REJECT --reject-with icmp-port-unreachable # Values: STRING blocktype = REJECT --reject-with icmp-port-unreachable + +# Option: returntype +# Note: This is the default rule on "actionstart". This should be RETURN +# in all (blocking) actions, except REJECT in allowing actions. +# Values: STRING +returntype = RETURN diff --git a/config/action.d/iptables-multiport-log.conf b/config/action.d/iptables-multiport-log.conf index f4d80d6c..093ce7b2 100644 --- a/config/action.d/iptables-multiport-log.conf +++ b/config/action.d/iptables-multiport-log.conf @@ -20,7 +20,7 @@ before = iptables-common.conf # Values: CMD # actionstart = iptables -N f2b- - iptables -A f2b- -j RETURN + iptables -A f2b- -j iptables -I 1 -p -m multiport --dports -j f2b- iptables -N f2b--log iptables -I f2b--log -j LOG --log-prefix "$(expr f2b- : '\(.\{1,23\}\)'):DROP " --log-level warning -m limit --limit 6/m --limit-burst 2 diff --git a/config/action.d/iptables-multiport.conf b/config/action.d/iptables-multiport.conf index b70baf92..f365d917 100644 --- a/config/action.d/iptables-multiport.conf +++ b/config/action.d/iptables-multiport.conf @@ -15,7 +15,7 @@ before = iptables-common.conf # Values: CMD # actionstart = iptables -N f2b- - iptables -A f2b- -j RETURN + iptables -A f2b- -j iptables -I -p -m multiport --dports -j f2b- # Option: actionstop diff --git a/config/action.d/iptables-new.conf b/config/action.d/iptables-new.conf index 3c6657d9..831931dd 100644 --- a/config/action.d/iptables-new.conf +++ b/config/action.d/iptables-new.conf @@ -17,7 +17,7 @@ before = iptables-common.conf # Values: CMD # actionstart = iptables -N f2b- - iptables -A f2b- -j RETURN + iptables -A f2b- -j iptables -I -m state --state NEW -p --dport -j f2b- # Option: actionstop diff --git a/config/action.d/iptables.conf b/config/action.d/iptables.conf index a956fc55..572bdc11 100644 --- a/config/action.d/iptables.conf +++ b/config/action.d/iptables.conf @@ -15,7 +15,7 @@ before = iptables-common.conf # Values: CMD # actionstart = iptables -N f2b- - iptables -A f2b- -j RETURN + iptables -A f2b- -j iptables -I -p --dport -j f2b- # Option: actionstop diff --git a/config/jail.conf b/config/jail.conf index ca0a2bfa..c416c076 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -770,13 +770,15 @@ maxretry = 1 [pass2allow] # allow FTP traffic after successful HTTP auth -enabled = false -filter = apache-pass -banaction = allow-iptables-multiport +enabled = false +filter = apache-pass +banaction = iptables-multiport +blocktype = RETURN +returntype = DROP # access log of the website with HTTP auth -logpath = /var/log/apache2/access.log -port = ftp,ftp-data,ftps,ftps-data -protocol = tcp -bantime = 3600 -maxretry = 1 -findtime = 1 +logpath = /var/log/apache2/access.log +port = ftp,ftp-data,ftps,ftps-data +protocol = tcp +bantime = 3600 +maxretry = 1 +findtime = 1 From 586703dcc27ca2d98bb94bbeb4e6f0fce20909e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Mon, 13 Jul 2015 16:46:04 +0200 Subject: [PATCH 3/5] Test, changelog and fixes to pass2allow --- ChangeLog | 9 ++++++--- config/jail.conf | 9 +++------ fail2ban/tests/files/logs/apache-pass | 2 ++ 3 files changed, 11 insertions(+), 9 deletions(-) create mode 100644 fail2ban/tests/files/logs/apache-pass diff --git a/ChangeLog b/ChangeLog index ac61693f..de3de7f1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,11 +32,14 @@ ver. 0.9.3 (2015/XX/XXX) - wanna-be-released currently not banned or persistent) - New Features: + * RETURN iptables target is now a variable: + * New type of operation: pass2allow, use fail2ban for "knocking", + opening a closed port by swapping blocktype and returntype * New filters: - froxlor-auth Thanks Joern Muehlencord - * New type of operation: - - pass2allow: use fail2ban for "knocking", opening a closed port - (apache-pass filter, allow-iptables-multiport action) + - apache-pass - filter Apache access log for successfull authentication + * New jails: + - pass2allow-ftp - allows FTP traffic after successful HTTP authentication - Enhancements: * action.d/cloudflare.conf - improved documentation on how to allow diff --git a/config/jail.conf b/config/jail.conf index c416c076..350582fc 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -768,17 +768,14 @@ enabled = false logpath = /var/lib/portsentry/portsentry.history maxretry = 1 -[pass2allow] -# allow FTP traffic after successful HTTP auth -enabled = false +[pass2allow-ftp] +# this pass2allow example allows FTP traffic after successful HTTP authentication filter = apache-pass -banaction = iptables-multiport blocktype = RETURN returntype = DROP # access log of the website with HTTP auth -logpath = /var/log/apache2/access.log +logpath = %(apache_access_log)s port = ftp,ftp-data,ftps,ftps-data -protocol = tcp bantime = 3600 maxretry = 1 findtime = 1 diff --git a/fail2ban/tests/files/logs/apache-pass b/fail2ban/tests/files/logs/apache-pass new file mode 100644 index 00000000..cb8d3454 --- /dev/null +++ b/fail2ban/tests/files/logs/apache-pass @@ -0,0 +1,2 @@ +# failJSON: { "time": "2013-06-27T11:55:44", "match": true , "host": "192.0.2.12" } +192.0.2.12 - user1 [27/Jun/2013:11:55:44] "GET /knocking/ HTTP/1.1" 200 266 "http://domain.net/hello-world/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:40.0) Gecko/20100101 Firefox/40.0" From b638e807ad818463859f4d0c1c774d01c621d133 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Mon, 13 Jul 2015 18:12:04 +0200 Subject: [PATCH 4/5] Explicitly stating that knocking_url needs to be customized --- config/jail.conf | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index 350582fc..a306e7ec 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -770,12 +770,14 @@ maxretry = 1 [pass2allow-ftp] # this pass2allow example allows FTP traffic after successful HTTP authentication -filter = apache-pass -blocktype = RETURN -returntype = DROP +port = ftp,ftp-data,ftps,ftps-data +filter = apache-pass # access log of the website with HTTP auth -logpath = %(apache_access_log)s -port = ftp,ftp-data,ftps,ftps-data -bantime = 3600 -maxretry = 1 -findtime = 1 +logpath = %(apache_access_log)s +# knocking URL needs to be customized per each deployment +knocking_url = /secret-knocking-url +blocktype = RETURN +returntype = DROP +bantime = 3600 +maxretry = 1 +findtime = 1 From 948b12e5df176ddee46cb2e03d4e316ff137c9d1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Tue, 14 Jul 2015 18:35:51 +0200 Subject: [PATCH 5/5] Fixed definition of knocking_url for pass2allow --- config/jail.conf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index a306e7ec..b0ed6355 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -771,11 +771,10 @@ maxretry = 1 [pass2allow-ftp] # this pass2allow example allows FTP traffic after successful HTTP authentication port = ftp,ftp-data,ftps,ftps-data +# knocking URL needs to be customized in apache-pass.local filter = apache-pass # access log of the website with HTTP auth logpath = %(apache_access_log)s -# knocking URL needs to be customized per each deployment -knocking_url = /secret-knocking-url blocktype = RETURN returntype = DROP bantime = 3600