From 38d3f01a511d168328e310f8c441698969ec1d5f Mon Sep 17 00:00:00 2001 From: Sander Hoentjen Date: Tue, 8 Mar 2016 13:58:03 +0100 Subject: [PATCH 001/488] add support for the CSF firewall --- config/action.d/csf.conf | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 config/action.d/csf.conf diff --git a/config/action.d/csf.conf b/config/action.d/csf.conf new file mode 100644 index 00000000..c2dc51b6 --- /dev/null +++ b/config/action.d/csf.conf @@ -0,0 +1,26 @@ +# Fail2Ban configuration file +# http://configserver.com/cp/csf.html +# +# Note: CSF doesn't play nicely with other actions. It has been observed to +# remove bans created by other iptables based actions. If you are going to use +# this action, use it for all of your jails. +# +# DON'T MIX CSF and other IPTABLES based actions + +[Definition] + +actionstart = +actionstop = +actioncheck = +actionban = csf --deny "banned by Fail2Ban " +actionunban = csf --denyrm + +[Init] + +# Name used in CSF configuration +# +name = default + +# DEV NOTES: +# +# based on apf.conf by Mark McKinstry From 884f708bd7f4b48c90503752d927975ba10dafbc Mon Sep 17 00:00:00 2001 From: Michael Orlitzky Date: Sun, 15 Jul 2018 09:07:28 -0400 Subject: [PATCH 002/488] fail2ban/files: rename "gentoo" files to "openrc". We ship a service script and configuration file for "gentoo" that are actually more generally applicable: they work on any system where OpenRC is used. This commit simply renames the files from "gentoo" to "openrc" to reflect the fact that they are in no way Gentoo-specific. --- MANIFEST | 4 ++-- files/{gentoo-confd => fail2ban-openrc.conf} | 0 files/{gentoo-initd => fail2ban-openrc.init} | 0 3 files changed, 2 insertions(+), 2 deletions(-) rename files/{gentoo-confd => fail2ban-openrc.conf} (100%) rename files/{gentoo-initd => fail2ban-openrc.init} (100%) diff --git a/MANIFEST b/MANIFEST index 3ea2816b..ca9be123 100644 --- a/MANIFEST +++ b/MANIFEST @@ -375,8 +375,8 @@ files/fail2ban.service.in files/fail2ban-tmpfiles.conf files/fail2ban.upstart files/gen_badbots -files/gentoo-confd -files/gentoo-initd +files/fail2ban-openrc.conf +files/fail2ban-openrc.init files/ipmasq-ZZZzzz_fail2ban.rul files/logwatch/fail2ban files/logwatch/fail2ban-0.8.log diff --git a/files/gentoo-confd b/files/fail2ban-openrc.conf similarity index 100% rename from files/gentoo-confd rename to files/fail2ban-openrc.conf diff --git a/files/gentoo-initd b/files/fail2ban-openrc.init similarity index 100% rename from files/gentoo-initd rename to files/fail2ban-openrc.init From 1cec3d05b8a052423a7ef4f8205c9d63b1ce9b07 Mon Sep 17 00:00:00 2001 From: Michael Orlitzky Date: Sun, 15 Jul 2018 09:11:53 -0400 Subject: [PATCH 003/488] files/fail2ban-openrc.conf: remove hard-coded paths. There were two paths mentioned in comments in the fail2ban OpenRC conf file, but those paths aren't guaranteed to be correct (until/unless we integrate the conf file with the build system). The first comment referenced the physical location of the associated init script, and in my opinion is not useful to an end user in the first place. It has been removed: OpenRC users know what this file is for, there's no reason to repeat it in a comment. The second comment contained an absolute path to fail2ban-client, and I've removed the leading path components because "fail2ban-client" is generally run from your $PATH. --- files/fail2ban-openrc.conf | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/files/fail2ban-openrc.conf b/files/fail2ban-openrc.conf index 00d19f8b..1c589763 100644 --- a/files/fail2ban-openrc.conf +++ b/files/fail2ban-openrc.conf @@ -1,6 +1,4 @@ -# Config file for /etc/init.d/fail2ban -# -# For information on options, see "/usr/bin/fail2ban-client -h". +# For available options, plase run "fail2ban-client -h". FAIL2BAN_OPTIONS="" From eb58e90ba9ccd049fae8bd92d8f828df6fdb287e Mon Sep 17 00:00:00 2001 From: Michael Orlitzky Date: Sun, 15 Jul 2018 09:17:29 -0400 Subject: [PATCH 004/488] files/fail2ban-openrc.conf: remove a commented example setting. Our OpenRC conf file already tells users how to find the available options that can be placed in the FAIL2BAN_OPTIONS variable, so having a specific example of, FAIL2BAN_OPTIONS="-x" doesn't provide much more information. In fact, it makes you wonder why it's there in the first place: does the init script have some kind of problem with stale sockets? It used to, but that problem has been fixed. This commit removes the redundant example. --- files/fail2ban-openrc.conf | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/files/fail2ban-openrc.conf b/files/fail2ban-openrc.conf index 1c589763..1a2450e2 100644 --- a/files/fail2ban-openrc.conf +++ b/files/fail2ban-openrc.conf @@ -1,6 +1,2 @@ # For available options, plase run "fail2ban-client -h". - -FAIL2BAN_OPTIONS="" - -# Force execution of the server even if the socket already exists: -#FAIL2BAN_OPTIONS="-x" +#FAIL2BAN_OPTIONS="" From 64ec399542f20582090a69b77f4c5b90f7b41019 Mon Sep 17 00:00:00 2001 From: Michael Orlitzky Date: Sun, 15 Jul 2018 12:59:18 -0400 Subject: [PATCH 005/488] files/fail2ban-openrc.init: drop "need net" dependency. The "need net" dependency in our OpenRC service script was incorrect: the fail2ban service does not need a working WAN to function. This issue is well-documented and is covered in the OpenRC Service Script Guide, currently located at https://github.com/OpenRC/openrc/blob/master/service-script-guide.md --- files/fail2ban-openrc.init | 1 - 1 file changed, 1 deletion(-) diff --git a/files/fail2ban-openrc.init b/files/fail2ban-openrc.init index 0fb157cd..69025499 100755 --- a/files/fail2ban-openrc.init +++ b/files/fail2ban-openrc.init @@ -26,7 +26,6 @@ extra_started_commands="reload showlog" FAIL2BAN="/usr/bin/fail2ban-client ${FAIL2BAN_OPTIONS}" depend() { - need net need logger after iptables } From af24c52558296e52e90cb55fad449b2bf9e996c6 Mon Sep 17 00:00:00 2001 From: Michael Orlitzky Date: Sun, 15 Jul 2018 13:05:11 -0400 Subject: [PATCH 006/488] files/fail2ban-openrc.init: change "need logger" dependency to "use logger". Our OpenRC service script contained a "need logger" dependency, which meant that the life cycle of the fail2ban service was tied to that of the system logger service. That isn't quite correct: fail2ban functions fine even if the system logger is stopped: 1. fail2ban is capable of analyzing non-syslog log files. 2. Even if fail2ban is solely analyzing syslog files, we don't want to stop the fail2ban service simply because syslog was stopped -- fail2ban just won't see any new log lines until syslog is started again. This commit changes the "need net" dependency to "use net", which will still attempt to start the system logger service, but which won't kill fail2ban if the system logger is ever stopped. --- files/fail2ban-openrc.init | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/fail2ban-openrc.init b/files/fail2ban-openrc.init index 69025499..138bff30 100755 --- a/files/fail2ban-openrc.init +++ b/files/fail2ban-openrc.init @@ -26,7 +26,7 @@ extra_started_commands="reload showlog" FAIL2BAN="/usr/bin/fail2ban-client ${FAIL2BAN_OPTIONS}" depend() { - need logger + use logger after iptables } From bc4a742e32f610879fcdb1af7677e46007ac0682 Mon Sep 17 00:00:00 2001 From: Michael Orlitzky Date: Sun, 15 Jul 2018 13:13:13 -0400 Subject: [PATCH 007/488] files/fail2ban-openrc.init: replace FAIL2BAN with standard OpenRC variables. The FAIL2BAN variable in our OpenRC service script was a combination of two standard OpenRC variables, "command" and "command_args". This commit simply replaces the custom variable with the two standard ones. This will aid future simplifications of the service script. --- files/fail2ban-openrc.init | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/files/fail2ban-openrc.init b/files/fail2ban-openrc.init index 138bff30..1374da3d 100755 --- a/files/fail2ban-openrc.init +++ b/files/fail2ban-openrc.init @@ -23,7 +23,8 @@ description_reload="reload configuration" description_showlog="show fail2ban logs" extra_started_commands="reload showlog" -FAIL2BAN="/usr/bin/fail2ban-client ${FAIL2BAN_OPTIONS}" +command="/usr/bin/fail2ban-client" +command_args="${FAIL2BAN_OPTIONS}" depend() { use logger @@ -37,20 +38,20 @@ start() { # bug 347477 rm -f /var/run/fail2ban/fail2ban.sock || return 1 start-stop-daemon --start --pidfile /var/run/fail2ban/fail2ban.pid \ - -- ${FAIL2BAN} start + -- ${command} ${command_args} start eend $? "Failed to start fail2ban" } stop() { ebegin "Stopping fail2ban" start-stop-daemon --stop --pidfile /var/run/fail2ban/fail2ban.pid --retry 30 \ - -- ${FAIL2BAN} stop + -- ${command} ${command_args} stop eend $? "Failed to stop fail2ban" } reload() { ebegin "Reloading fail2ban" - ${FAIL2BAN} reload + ${command} ${command_args} reload eend $? "Failed to reload fail2ban" } From 115024d14a0b1a5a4b96175712f257b408883f38 Mon Sep 17 00:00:00 2001 From: Michael Orlitzky Date: Sun, 15 Jul 2018 13:15:44 -0400 Subject: [PATCH 008/488] files/fail2ban-openrc.init: use a variable for the pid file location. OpenRC has a special variable "pidfile" that should be used to store the location of the daemon's PID file. This commit replaces two instances of said location with one variable. --- files/fail2ban-openrc.init | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/files/fail2ban-openrc.init b/files/fail2ban-openrc.init index 1374da3d..9969a3e0 100755 --- a/files/fail2ban-openrc.init +++ b/files/fail2ban-openrc.init @@ -25,6 +25,7 @@ extra_started_commands="reload showlog" command="/usr/bin/fail2ban-client" command_args="${FAIL2BAN_OPTIONS}" +pidfile="/run/${RC_SVCNAME}/${RC_SVCNAME}.pid" depend() { use logger @@ -37,14 +38,14 @@ start() { # remove stalled sock file after system crash # bug 347477 rm -f /var/run/fail2ban/fail2ban.sock || return 1 - start-stop-daemon --start --pidfile /var/run/fail2ban/fail2ban.pid \ + start-stop-daemon --start --pidfile "${pidfile}" \ -- ${command} ${command_args} start eend $? "Failed to start fail2ban" } stop() { ebegin "Stopping fail2ban" - start-stop-daemon --stop --pidfile /var/run/fail2ban/fail2ban.pid --retry 30 \ + start-stop-daemon --stop --pidfile "${pidfile}" --retry 30 \ -- ${command} ${command_args} stop eend $? "Failed to stop fail2ban" } From 0b146208eb3a6f3ceb04d59e9e89c1cc914854ea Mon Sep 17 00:00:00 2001 From: Michael Orlitzky Date: Sun, 15 Jul 2018 13:32:03 -0400 Subject: [PATCH 009/488] files/fail2ban-openrc.init: move pre-flight checks into start_pre(). Our OpenRC service script performs two tasks before starting the service: 1. It removes any stake sockets (from e.g. a system crash). 2. It ensures that the PID file directory exists. These have both been moved into the "start_pre" phase, which is designed to do such things (and will allow us to simplify the "start" phase in the future). The existing "mkdir -p" has also been converted into a "checkpath -d" command which is built-in to OpenRC. --- files/fail2ban-openrc.init | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/files/fail2ban-openrc.init b/files/fail2ban-openrc.init index 9969a3e0..e1cf5273 100755 --- a/files/fail2ban-openrc.init +++ b/files/fail2ban-openrc.init @@ -32,12 +32,16 @@ depend() { after iptables } +start_pre() { + checkpath -d "${pidfile%/*}" || return 1 + + # Remove stale socket after system crash, Gentoo bug 347477 + rm -f /var/run/fail2ban/fail2ban.sock || return 1 +} + start() { ebegin "Starting fail2ban" - mkdir -p /var/run/fail2ban || return 1 - # remove stalled sock file after system crash - # bug 347477 - rm -f /var/run/fail2ban/fail2ban.sock || return 1 + start-stop-daemon --start --pidfile "${pidfile}" \ -- ${command} ${command_args} start eend $? "Failed to start fail2ban" From e0097aefb95bac48c992f6b5ae58fc99140ecc03 Mon Sep 17 00:00:00 2001 From: Michael Orlitzky Date: Sun, 15 Jul 2018 13:37:00 -0400 Subject: [PATCH 010/488] files/fail2ban-openrc.init: use RC_SVCNAME instead of hard-coding the name. If our service is installed under some other name, then we don't want the service script to say things like "Starting fail2ban..." because the name "fail2ban" won't make any sense at that point. Instead, we use the $RC_SVCNAME variable to ensure that the service name matches what we tell the user. Typically, however, $RC_SVCNAME will still be "fail2ban". --- files/fail2ban-openrc.init | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/files/fail2ban-openrc.init b/files/fail2ban-openrc.init index e1cf5273..bcbdf8fd 100755 --- a/files/fail2ban-openrc.init +++ b/files/fail2ban-openrc.init @@ -40,24 +40,24 @@ start_pre() { } start() { - ebegin "Starting fail2ban" + ebegin "Starting ${RC_SVCNAME}" start-stop-daemon --start --pidfile "${pidfile}" \ -- ${command} ${command_args} start - eend $? "Failed to start fail2ban" + eend $? "Failed to start ${RC_SVCNAME}" } stop() { - ebegin "Stopping fail2ban" + ebegin "Stopping ${RC_SVCNAME}" start-stop-daemon --stop --pidfile "${pidfile}" --retry 30 \ -- ${command} ${command_args} stop - eend $? "Failed to stop fail2ban" + eend $? "Failed to stop ${RC_SVCNAME}" } reload() { - ebegin "Reloading fail2ban" + ebegin "Reloading ${RC_SVCNAME}" ${command} ${command_args} reload - eend $? "Failed to reload fail2ban" + eend $? "Failed to reload ${RC_SVCNAME}" } showlog(){ From c8ed0e0d913feeb361de800d1af6fd56e96bb840 Mon Sep 17 00:00:00 2001 From: Michael Orlitzky Date: Sun, 15 Jul 2018 13:44:53 -0400 Subject: [PATCH 011/488] files/fail2ban-openrc.init: use the standard OpenRC "retry" variable. If the "retry" variable is set in the service script, we don't have to pass it to start-stop-daemon explicitly. While we can't immediately eliminate any code with this change, it will be necessary later to adopt the default OpenRC stop() function. --- files/fail2ban-openrc.init | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/files/fail2ban-openrc.init b/files/fail2ban-openrc.init index bcbdf8fd..e3ddfe1a 100755 --- a/files/fail2ban-openrc.init +++ b/files/fail2ban-openrc.init @@ -26,6 +26,7 @@ extra_started_commands="reload showlog" command="/usr/bin/fail2ban-client" command_args="${FAIL2BAN_OPTIONS}" pidfile="/run/${RC_SVCNAME}/${RC_SVCNAME}.pid" +retry="30" depend() { use logger @@ -49,7 +50,7 @@ start() { stop() { ebegin "Stopping ${RC_SVCNAME}" - start-stop-daemon --stop --pidfile "${pidfile}" --retry 30 \ + start-stop-daemon --stop --pidfile "${pidfile}" --retry "${retry}" \ -- ${command} ${command_args} stop eend $? "Failed to stop ${RC_SVCNAME}" } From 1fb7ffe759f5d4ff73a6d271c5b98c8c18a0ad1c Mon Sep 17 00:00:00 2001 From: Michele Bologna Date: Fri, 14 Sep 2018 22:12:52 +0200 Subject: [PATCH 012/488] Feat: ban nginx forbidden accesses If you have configured nginx to forbid some paths in your webserver, e.g.: location ~ /\. { deny all; } if a client tries to access https://yoursite/.user.ini then you will see in nginx error log: 2018/09/14 19:03:05 [error] 2035#2035: *9134 access forbidden by rule, client: 10.20.30.40, server: www.example.net, request: "GET /.user.ini HTTP/1.1", host: "www.example.net", referrer: "https://www.example.net" By carefully setting this filter we ban every IP that tries too many times to access forbidden resources. Author: Michele Bologna https://www.michelebologna.net/ --- config/filter.d/nginx-forbidden.conf | 21 +++++++++++++++++++++ fail2ban/tests/files/logs/nginx-forbidden | 5 +++++ 2 files changed, 26 insertions(+) create mode 100644 config/filter.d/nginx-forbidden.conf create mode 100644 fail2ban/tests/files/logs/nginx-forbidden diff --git a/config/filter.d/nginx-forbidden.conf b/config/filter.d/nginx-forbidden.conf new file mode 100644 index 00000000..3c54e61e --- /dev/null +++ b/config/filter.d/nginx-forbidden.conf @@ -0,0 +1,21 @@ +# fail2ban filter configuration for nginx forbidden accesses +# +# If you have configured nginx to forbid some paths in your webserver, e.g.: +# +# location ~ /\. { +# deny all; +# } +# +# if a client tries to access https://yoursite/.user.ini then you will see +# in nginx error log: +# +# 2018/09/14 19:03:05 [error] 2035#2035: *9134 access forbidden by rule, client: 10.20.30.40, server: www.example.net, request: "GET /.user.ini HTTP/1.1", host: "www.example.net", referrer: "https://www.example.net" +# +# By carefully setting this filter we ban every IP that tries too many times to +# access forbidden resources. +# +# Author: Michele Bologna https://www.michelebologna.net/ + +[Definition] +failregex = \[error\] \d+#\d+: \*\d+ access forbidden by rule, client: +ignoreregex = diff --git a/fail2ban/tests/files/logs/nginx-forbidden b/fail2ban/tests/files/logs/nginx-forbidden new file mode 100644 index 00000000..6da3ed01 --- /dev/null +++ b/fail2ban/tests/files/logs/nginx-forbidden @@ -0,0 +1,5 @@ +# failJSON: { "time": "2018-09-14T19:03:05", "match": true , "host": "12.34.56.78" } +2018/09/14 19:03:05 [error] 2035#2035: *9134 access forbidden by rule, client: 12.34.56.78, server: www.example.net, request: "GET /wp-content/themes/evolve/js/back-end/libraries/fileuploader/upload_handler.php HTTP/1.1", host: "www.example.net", referrer: "http://example.net/foo.php" + +# failJSON: { "time": "2018-09-13T15:42:05", "match": true , "host": "12.34.56.78" } +2018/09/13 15:42:05 [error] 2035#2035: *287 access forbidden by rule, client: 12.34.56.78, server: www.example.com, request: "GET /wp-config.php~ HTTP/1.1", host: "www.example.com" From 7e88ae0ee66628893a283d6fed06a347f9f6673e Mon Sep 17 00:00:00 2001 From: Michele Bologna Date: Fri, 14 Sep 2018 23:08:12 +0200 Subject: [PATCH 013/488] Feat: add forbidden to jail.conf --- config/jail.conf | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/config/jail.conf b/config/jail.conf index 697c81dd..a6f2ac5a 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -390,6 +390,11 @@ port = http,https logpath = %(nginx_error_log)s maxretry = 2 +[nginx-forbidden] + +port = http,https +logpath = %(nginx_error_log)s +maxretry = 10 # Ban attackers that try to use PHP's URL-fopen() functionality # through GET/POST variables. - Experimental, with more than a year From 93272188430d0d856ed29a5e040748e4d41c8b99 Mon Sep 17 00:00:00 2001 From: Noel Kuntze Date: Sat, 29 Jun 2019 01:39:38 +0200 Subject: [PATCH 014/488] Improved blocklist_de action to not resend bans that were already reported --- config/action.d/blocklist_de.conf | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/config/action.d/blocklist_de.conf b/config/action.d/blocklist_de.conf index ba6d427b..d8a4b3e5 100644 --- a/config/action.d/blocklist_de.conf +++ b/config/action.d/blocklist_de.conf @@ -54,7 +54,21 @@ actioncheck = # Tags: See jail.conf(5) man page # Values: CMD # -actionban = curl --fail --data-urlencode "server=" --data "apikey=" --data "service=" --data "ip=" --data-urlencode "logs=
" --data 'format=text' --user-agent "" "https://www.blocklist.de/en/httpreports.html" + +tmpfile = "/var/run/fail2ban/last-log-.time" + +actionban = if [ ! -e "" ] + then + # if the file doesn't exist yet, create it + touch -d @