|
|
|
|
|
__ _ _ ___ _
|
|
|
|
|
|
/ _|__ _(_) |_ ) |__ __ _ _ _
|
|
|
|
|
|
| _/ _` | | |/ /| '_ \/ _` | ' \
|
|
|
|
|
|
|_| \__,_|_|_/___|_.__/\__,_|_||_|
|
|
|
|
|
|
|
|
|
|
|
|
=============================================================
|
|
|
|
|
|
Fail2Ban (version 0.1.0) 10/12/2004
|
|
|
|
|
|
=============================================================
|
|
|
|
|
|
|
|
|
|
|
|
Fail2Ban scans log files like /var/log/pwdfail and bans IP
|
|
|
|
|
|
that makes too much password failures. It updates firewall
|
|
|
|
|
|
rules to reject the IP address. Currently sshd and iptables
|
|
|
|
|
|
are supported. It needs log4py.
|
|
|
|
|
|
|
|
|
|
|
|
This is my first Python program. I began learning Python for
|
|
|
|
|
|
less than one week so please be understanding ;-) English is
|
|
|
|
|
|
not either my mother tongue...
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
More details:
|
|
|
|
|
|
-------------
|
|
|
|
|
|
|
|
|
|
|
|
Fail2Ban is rather simple. I have a home server connected to
|
|
|
|
|
|
the Internet which runs apache, samba, sshd, ... I see in my
|
|
|
|
|
|
logs that people are trying to log into my box using "manual"
|
|
|
|
|
|
brute force or scripts. They try 10, 20 and sometimes more
|
|
|
|
|
|
user/password (without success anyway). In order to
|
|
|
|
|
|
discourage these script kiddies, I wanted that sshd refuse
|
|
|
|
|
|
login from a specific ip after 3 password failures. After
|
|
|
|
|
|
some google searches, I found that sshd was not able of that.
|
|
|
|
|
|
So I search for a script or program that do it. Found
|
|
|
|
|
|
nothing :-( So I decide to write mine and to learn Python :-)
|
|
|
|
|
|
|
|
|
|
|
|
I read the log file (/var/log/pwdfail/current on metalog) and
|
|
|
|
|
|
search for line with "Failed password". Then get the ip and
|
|
|
|
|
|
if it has already done 3 or more password failure in the last
|
|
|
|
|
|
banTime, I ban the ip for banTime using a iptable rule. After
|
|
|
|
|
|
banTime, the rule is deleted.
|
|
|
|
|
|
|
|
|
|
|
|
Runs on my server and does its job rather well :-) The idea
|
|
|
|
|
|
is to make fail2ban usable with most syslog daemons and
|
|
|
|
|
|
services that require a login (sshd, telnetd, ...). It should
|
|
|
|
|
|
also support others firewalls than iptables.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Installation:
|
|
|
|
|
|
-------------
|
|
|
|
|
|
|
|
|
|
|
|
Require: python-2.2 (http://www.python.org)
|
|
|
|
|
|
log4py-1.1 (http://sourceforge.net/projects/log4py)
|
|
|
|
|
|
|
|
|
|
|
|
To install, just do:
|
|
|
|
|
|
|
|
|
|
|
|
> tar xvfj fail2ban-0.1.0.tar.bz2
|
|
|
|
|
|
> cd fail2ban-0.1.0
|
|
|
|
|
|
> python setup.py install
|
|
|
|
|
|
|
|
|
|
|
|
This will install Fail2Ban into /usr/lib/fail2ban. The
|
|
|
|
|
|
fail2ban.py executable is placed into /usr/bin.
|
|
|
|
|
|
|
|
|
|
|
|
Fail2Ban should now be correctly installed. Just type:
|
|
|
|
|
|
|
|
|
|
|
|
> fail2ban.py -h
|
|
|
|
|
|
|
|
|
|
|
|
to see if everything is alright.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Configuration:
|
|
|
|
|
|
--------------
|
|
|
|
|
|
|
|
|
|
|
|
For the time, there is no configuration file. You must use
|
|
|
|
|
|
commande line options instead. Here are the options:
|
|
|
|
|
|
|
|
|
|
|
|
-b start fail2ban in background
|
|
|
|
|
|
-d start fail2ban in debug mode
|
|
|
|
|
|
-f <FILE> read password failure from FILE
|
|
|
|
|
|
-h display this help message
|
|
|
|
|
|
-l <FILE> log message in FILE
|
|
|
|
|
|
-r <VALUE> allow a max of VALUE password failure
|
|
|
|
|
|
-t <TIME> ban IP for TIME seconds
|
|
|
|
|
|
-v verbose
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Contact:
|
|
|
|
|
|
--------
|
|
|
|
|
|
|
|
|
|
|
|
You need some new features, you found bugs or you just
|
|
|
|
|
|
appreciate this program, you can contact me at :
|
|
|
|
|
|
|
|
|
|
|
|
Website: http://www.sourceforge.net/projects/fail2ban
|
|
|
|
|
|
|
|
|
|
|
|
Cyril Jaquier: <lostcontrol@users.sourceforge.net>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Thanks:
|
|
|
|
|
|
-------
|
|
|
|
|
|
|
|
|
|
|
|
K<EFBFBD>vin Drapel, Marvin Rouge
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
License:
|
|
|
|
|
|
--------
|
|
|
|
|
|
|
|
|
|
|
|
Fail2Ban is free software; you can redistribute it
|
|
|
|
|
|
and/or modify it under the terms of the GNU General Public
|
|
|
|
|
|
License as published by the Free Software Foundation; either
|
|
|
|
|
|
version 2 of the License, or (at your option) any later
|
|
|
|
|
|
version.
|
|
|
|
|
|
|
|
|
|
|
|
Fail2Ban is distributed in the hope that it will be
|
|
|
|
|
|
useful, but WITHOUT ANY WARRANTY; without even the implied
|
|
|
|
|
|
warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
|
|
|
|
|
PURPOSE. See the GNU General Public License for more
|
|
|
|
|
|
details.
|
|
|
|
|
|
|
|
|
|
|
|
You should have received a copy of the GNU General Public
|
|
|
|
|
|
License along with Fail2Ban; if not, write to the Free
|
|
|
|
|
|
Software Foundation, Inc., 59 Temple Place, Suite 330,
|
|
|
|
|
|
Boston, MA 02111-1307 USA
|
