2020-10-25 13:46:26 +00:00
|
|
|
# Fail2Ban configuration file
|
|
|
|
|
#
|
|
|
|
|
# Mikrotik routerOS action to add/remove address-list entries
|
|
|
|
|
#
|
|
|
|
|
# Author: Duncan Bellamy <dunk@denkimushi.com>
|
|
|
|
|
# based on forum.mikrotik.com post by pakjebakmeel
|
2020-12-06 10:53:21 +00:00
|
|
|
#
|
2020-10-25 13:46:26 +00:00
|
|
|
# in the instructions:
|
|
|
|
|
# (10.0.0.1 is ip of mikrotik router)
|
|
|
|
|
# (10.0.0.2 is ip of fail2ban machine)
|
|
|
|
|
#
|
|
|
|
|
# on fail2ban machine:
|
|
|
|
|
# sudo mkdir /var/lib/fail2ban/ssh
|
|
|
|
|
# sudo chmod 700 /var/lib/fail2ban/ssh
|
|
|
|
|
# sudo ssh-keygen -N "" -f /var/lib/fail2ban/ssh/fail2ban_id_rsa
|
|
|
|
|
# sudo scp /var/lib/fail2ban/ssh/fail2ban_id_rsa.pub admin@10.0.0.1:/
|
|
|
|
|
# ssh admin@10.0.0.1
|
|
|
|
|
#
|
|
|
|
|
# on mikrotik router:
|
|
|
|
|
# /user add name=miki-f2b group=write address=10.0.0.2 password=""
|
|
|
|
|
# /user ssh-keys import public-key-file=fail2ban_id_rsa.pub user=miki-f2b
|
|
|
|
|
# /quit
|
|
|
|
|
#
|
|
|
|
|
# on fail2ban machine:
|
|
|
|
|
# (check password login fails)
|
|
|
|
|
# ssh miki-f2b@10.0.0.1
|
|
|
|
|
# (check private key works)
|
|
|
|
|
# sudo ssh -i /var/lib/fail2ban/ssh/fail2ban_id_rsa miki-f2b@10.0.0.1
|
|
|
|
|
#
|
|
|
|
|
# Then create rules on mikrorik router that use address
|
|
|
|
|
# list(s) maintained by fail2ban eg in the forward chain
|
|
|
|
|
# drop from address list, or in the forward chain drop
|
|
|
|
|
# from address list to server
|
|
|
|
|
#
|
|
|
|
|
# example extract from jail.local overriding some defaults
|
|
|
|
|
# action = mikrotik[mtikkeyfile="%(mkeyfile)s", mtikuser="%(muser)s", mtikhost="%(mhost)s", mtiklistname="%(mlistname)s"]
|
|
|
|
|
#
|
|
|
|
|
# ignoreip = 127.0.0.1/8 192.168.0.0/24
|
|
|
|
|
|
|
|
|
|
# mkeyfile = /etc/fail2ban/ssh/mykey_id_rsa
|
|
|
|
|
# muser = myuser
|
|
|
|
|
# mhost = 192.168.0.1
|
|
|
|
|
# mlistname = BAD LIST
|
|
|
|
|
|
|
|
|
|
[Definition]
|
|
|
|
|
|
|
|
|
|
actionstart =
|
|
|
|
|
|
2020-11-25 18:53:43 +00:00
|
|
|
actionstop = %(actionflush)s
|
|
|
|
|
|
2020-12-29 14:30:32 +00:00
|
|
|
actionflush = %(mtikcommand)s "/ip firewall address-list remove [find list=\"%(mtiklistname)s\" comment~\"%(startcomment)s-*\"]"
|
2020-10-25 13:46:26 +00:00
|
|
|
|
|
|
|
|
actioncheck =
|
|
|
|
|
|
|
|
|
|
actionban = %(mtikcommand)s "/ip firewall address-list add list=\"%(mtiklistname)s\" address=<ip> comment=%(mtikcomment)s"
|
|
|
|
|
|
2020-12-06 10:53:21 +00:00
|
|
|
actionunban = %(mtikcommand)s "/ip firewall address-list remove [find list=\"%(mtiklistname)s\" comment=%(mtikcomment)s]"
|
2020-10-25 13:46:26 +00:00
|
|
|
|
|
|
|
|
mtikcommand = ssh -l %(mtikuser)s -p%(mtikport)s -i %(mtikkeyfile)s %(mtikhost)s
|
|
|
|
|
|
|
|
|
|
# Option: mktikuser
|
|
|
|
|
# Notes.: username to use when connecting to routerOS
|
|
|
|
|
mtikuser =
|
|
|
|
|
# Option: mtikport
|
|
|
|
|
# Notes.: port to use when connecting to routerOS
|
|
|
|
|
mtikport = 22
|
|
|
|
|
# Option: mtikkeyfile
|
|
|
|
|
# Notes.: ssh private key to use for connecting to routerOS
|
|
|
|
|
mtikkeyfile =
|
|
|
|
|
# Option: mtikhost
|
|
|
|
|
# Notes.: hostname or ip of router
|
|
|
|
|
mtikhost =
|
|
|
|
|
# Option: mtiklistname
|
|
|
|
|
# Notes.: name of "address-list" to use on router
|
|
|
|
|
mtiklistname = Auto Fail2Ban
|
2020-11-25 18:53:43 +00:00
|
|
|
# Option: startcomment
|
|
|
|
|
# Notes.: used as a prefix to all comments, and used to match for flushing rules
|
2020-12-29 13:17:41 +00:00
|
|
|
startcomment = f2b-<name>
|
2020-10-25 13:46:26 +00:00
|
|
|
# Option: mtikcomment
|
|
|
|
|
# Notes.: comment to use on routerOS (must be unique as used for ip address removal)
|
2020-12-29 13:17:41 +00:00
|
|
|
mtikcomment = %(startcomment)s-<ip>
|
2020-10-25 13:46:26 +00:00
|
|
|
|
|
|
|
|
[Init]
|
|
|
|
|
name="%(__name__)s"
|
