Voir la source de Fail2ban

[[Category:Sécurité]]
[[Category:Web]]
= Principe =
Fail2ban analyse les logs et bannit les IPs qui ont essayées de se connecter sans succès.<br>
Fail2ban waits 1 second before checking for new logs to be scanned.

= [http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Configuration Configuration] =
== Default ==
<filebox fn=/etc/fail2ban/jail.conf lang=bash>
[DEFAULT]
# les adresses IP à ne pas exclure
ignoreip = 127.0.0.1/8 192.168.x.x

# durée d'exclusion d'une IP en seconde. Utiliser un nombre négatif pour une exclusion permanente
bantime = 600

# exclusion si maxretry correspondances en findtime (secondes)
findtime = 600
maxretry = 5

# "filter" defines the filter to use by the jail. By default jails have names matching their filter name
filter = %(__name__)s

# iptables-multiport
action = %(action_)s
</filebox>

<filebox fn=/etc/fail2ban/jail.conf lang=bash>
[ma_section]
# active ma_section
enabled  = true
# utilise le filtre /etc/fail2ban/filter.d/mon_filtre.conf
filter   = mon_filtre
# exécute l'action /etc/fail2ban/action.d/iptables.conf si le filtre retourne true
action   = iptables[name=mon_action, port=xxx, protocol=tcp]
# le fichier de log à scanner
logpath  = /var/log/mon_log.log
</filebox>
{{warn | Only one filter is allowed per jail, but it is possible to specify several actions, on separate lines.}}

== Filtres ==
{{boxx|/etc/fail2ban/filter.d/*.conf}}

= [http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Testing Tests] =
<kode lang=bash>
# affiche la configuration actuelle
fail2ban-client -d

fail2ban-client status

# tester une regex avec une ligne
fail2ban-regex "line" "failregex"

# tester un fichier de filtre avec un fichier de log
fail2ban-regex /chemin/fichier.log /chemin/filtre.conf

# tester une regex avec un fichier de log
fail2ban-regex /chemin/fichier.log "failregex"
</kode>
{{info | Log: {{boxx|/var/log/fail2ban.log}}}}

= Liens =
* [https://doc.ubuntu-fr.org/fail2ban fail2ban sur Ubuntu-fr]
* [https://wiki.archlinux.org/index.php/Fail2ban fail2ban sur ArchWiki]
* [https://www.digitalocean.com/community/tutorials/how-to-protect-an-nginx-server-with-fail2ban-on-ubuntu-14-04 How To Protect an Nginx Server with Fail2Ban]

= Exemples =
<filebox fn=/etc/fail2ban/filter.d/mediawiki.conf lang=bash>
[Definition]

block = \/?(index.php\?title=Sp%%C3%%A9cial:Connexion)\S*
code  = (400)

failregex = ^<HOST> \- \S+ \[\] \"(GET|POST) %(block)s \S+\" .+$
            ^<HOST> \- \S+ \[\] \"[A-Z]+ \S+ \S+\" %(code)s .+$
            ^<HOST> \- \S+ \[\] \"\\x[0-9A-Z]{2}.+$

ignoreregex = 


# 0.0.0.0 - - [20/Jun/2016:06:27:12 +0200] "GET /index.php?title=Sp%C3%A9cial:Connexion&returnto=Surcharge+d%E2%80%99op%C3%A9rateurs HTTP/1.0" 200 11542 "https://wiki.bananeatomic.fr/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"

# 0.0.0.0 - - [24/Jun/2016:16:14:40 +0200] "POST /404 HTTP/1.1" 400 264 "-" "apache" "-"

# 0.0.0.0 - - [20/Jun/2016:06:07:42 +0200] "CONNECT 126mx00.mxmail.netease.com:25 HTTP/1.0" 400 166 "-" "-"

# 0.0.0.0 - - [23/Jun/2016:20:57:04 +0200] "\x08\x02\x8C\x7F\x7F\xD5\xDF\xE8\xBF\x96\x06\xA1\xF7\xFDs\x80#,\xD8\x154V6\x96LIH\xAC~lu\xD8\x04\x18\xFF\x10\x07\xCB\xE3\xDAi\xA8\xD8j\xA9\xDEnP\x0Exkoib8D\xEAz-\xBD\x84gh\x9B" 400 166 "-" "-" "-"
</filebox>

= Installation =
<kode lang=bash>
pacman -S fail2ban

systemctl start fail2ban
systemctl enable fail2ban
</kode>