Fail2ban - Histórico de revisão

Banto Palmarino em 19h26min de 12 de setembro de 2018

2018-09-12T19:26:53Z

← Edição anterior		Edição das 16h26min de 12 de setembro de 2018
Linha 192:		Linha 192:
	* https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04		* https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04
	* https://github.com/TrogloGeek/fail2ban-apache-sqlinject		* https://github.com/TrogloGeek/fail2ban-apache-sqlinject
			* [https://www.abuseipdb.com/fail2ban.html Integrating AbuseIPDB with Fail2Ban - Automatically Report Bad IPs]

Banto Palmarino: /* Drupal 7 (CVE-2018-7600 / SA-CORE-2018-002) */

2018-08-31T15:44:57Z

Drupal 7 (CVE-2018-7600 / SA-CORE-2018-002)

← Edição anterior		Edição das 12h44min de 31 de agosto de 2018
Linha 179:		Linha 179:
	^<HOST>.GET.(?i)passthru&name.*		^<HOST>.GET.(?i)passthru&name.*
	ignoreregex =		ignoreregex =

			* https://github.com/dreadlocked/Drupalgeddon2
			* https://github.com/pimps/CVE-2018-7600
			* https://www.drupal.org/forum/support/post-installation/2018-04-21/drupalgeddon-hacks-are-starting-to-show-up
			* https://wojnowski.net.pl/main/index/dissecting-mister-spy-bot-website-hack

Banto Palmarino: /* x00 */

2018-08-31T15:42:34Z

x00

← Edição anterior		Edição das 12h42min de 31 de agosto de 2018
Linha 158:		Linha 158:
	* https://serverfault.com/questions/772833/fail2ban-regex-to-block-x00-requests		* https://serverfault.com/questions/772833/fail2ban-regex-to-block-x00-requests


			== Drupal 7 (CVE-2018-7600 / SA-CORE-2018-002) ==

			/etc/fail2ban/jail.local
			[drupalgeddon2]
			enabled = true
			filter = drupalgeddon2
			port = http,https
			action = iptables-multiport[name=drupalgeddon2, port="http,https", protocol=tcp]
			#logpath = /var/log/apache2/*.log
			logpath = /var/log/nginx/*.log
			bantime = 84600
			maxretry = 1


			em /etc/fail2ban/filter.d/drupalgeddon2.conf

			[Definition]
			failregex = ^<HOST> .* ".passthru&name." .*$
			^<HOST>.GET.(?i)passthru&name.*
			ignoreregex =

Banto Palmarino: /* x00 */

2018-08-23T19:41:51Z

x00

← Edição anterior		Edição das 16h41min de 23 de agosto de 2018
Linha 153:		Linha 153:

	failregex = ^<HOST> .* ".\\x." .*$		failregex = ^<HOST> .* ".\\x." .*$

	ignoreregex =		ignoreregex =

Banto Palmarino em 13h19min de 6 de janeiro de 2018

2018-01-06T13:19:28Z

← Edição anterior		Edição das 10h19min de 6 de janeiro de 2018
Linha 148:		Linha 148:
	maxretry = 1		maxretry = 1

	~~and in~~ /etc/fail2ban/filter.d/nginx-x00.conf		e em /etc/fail2ban/filter.d/nginx-x00.conf

	[Definition]		[Definition]
Linha 154:		Linha 154:
	failregex = ^<HOST> .* ".\\x." .*$		failregex = ^<HOST> .* ".\\x." .*$

			ignoreregex =

	* https://serverfault.com/questions/772833/fail2ban-regex-to-block-x00-requests		* https://serverfault.com/questions/772833/fail2ban-regex-to-block-x00-requests

Banto Palmarino: /* proteção contra ataque sqlinject */

2018-01-06T13:18:40Z

proteção contra ataque sqlinject

@@ Linha 100: / Linha 100: @@
 == proteção contra ataque sqlinject ==
   [sqlinject]
@@ Linha 136: / Linha 137: @@
+  #
   ignoreregex =

Banto Palmarino em 21h25min de 25 de novembro de 2017

2017-11-25T21:25:40Z

← Edição anterior		Edição das 18h25min de 25 de novembro de 2017
Linha 1:		Linha 1:
	Instalando Apache e Fail2Ban		Instalando Apache e Fail2Ban

	<source lang="bash">		<source lang="bash">
	apt-get install fail2ban apache2		apt-get install fail2ban apache2
Linha 6:		Linha 5:

	ajustes básico		ajustes básico

	<source lang="bash">		<source lang="bash">
	cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local		cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Linha 14:		Linha 12:
	sed -i '111s/action_/action_mwl/g' /etc/fail2ban/jail.local		sed -i '111s/action_/action_mwl/g' /etc/fail2ban/jail.local
	</source>		</source>




	== proteção contra ataque no phpmyadmin ==		== proteção contra ataque no phpmyadmin ==
Linha 147:		Linha 142:
	* https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04		* https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04
	* https://github.com/TrogloGeek/fail2ban-apache-sqlinject		* https://github.com/TrogloGeek/fail2ban-apache-sqlinject



	* http://ittipsoftheday.blogspot.com.br/2016/01/how-to-remove-ip-from-iredmail.html
	* http://www.the-art-of-web.com/system/fail2ban-log/
	* https://github.com/fail2ban/fail2ban/issues/132
	* https://www.raspberrypi.org/forums/viewtopic.php?t=67934&p=496490
	* http://serverfault.com/questions/285256/how-to-unban-an-ip-properly-with-fail2ban

Banto Palmarino: /* proteção contra ataque sqlinject */

2017-11-25T21:24:29Z

proteção contra ataque sqlinject

← Edição anterior		Edição das 18h24min de 25 de novembro de 2017
Linha 106:		Linha 106:
	== proteção contra ataque sqlinject ==		== proteção contra ataque sqlinject ==

			[sqlinject]
	[sqlinject]		enabled = true
	enabled = true		filter = sqlinject
	filter = sqlinject		port = http,https
	port = http,https		action = iptables-multiport[name=sqlinject, port="http,https", protocol=tcp]
	action = iptables-multiport[name=sqlinject, port="http,https", protocol=tcp]		logpath = /var/log/apache2/access.log
	logpath = /var/log/apache2/access.log		bantime = 84600
	bantime = 84600		maxretry = 6
	maxretry = 6


	e crie o /etc/fail2ban/filter.d/sqlinject.conf com o conteúdo		e crie o /etc/fail2ban/filter.d/sqlinject.conf com o conteúdo

	# Fail2Ban configuration file		# Fail2Ban configuration file
	#		#
	# Author: TrogloGeek (Damien VERON)		# Author: TrogloGeek (Damien VERON)
	#		#
	# $Revision: 1 $		# $Revision: 1 $
	#		#

	[Definition]		[Definition]

	sqlfragments_generic = select.from\|delete.from\|update.set\|insert.into\|replace.*(value\|set)		sqlfragments_generic = select.from\|delete.from\|update.set\|insert.into\|replace.*(value\|set)
	sqlfragments_havij = and(\+\|%%20)ascii%%28substring\|and(\+\|%%20)Length\|union(\+\|%%20)all(\+\|%%20)select\|and(\+\|%%20)1%%3C1\|and(\+\|%%20)1%%3D1\|and(\+\|%%20)1%%3E1\|and(\+\|%%20)%%27.%%27%%3D%%27\|%%2F\%%21[0-9]+((\+\|%%20)[0-9])?\*%%2F		sqlfragments_havij = and(\+\|%%20)ascii%%28substring\|and(\+\|%%20)Length\|union(\+\|%%20)all(\+\|%%20)select\|and(\+\|%%20)1%%3C1\|and(\+\|%%20)1%%3D1\|and(\+\|%%20)1%%3E1\|and(\+\|%%20)%%27.%%27%%3D%%27\|%%2F\%%21[0-9]+((\+\|%%20)[0-9])?\*%%2F

	# Option: failregex		# Option: failregex
	# Notes.: Regex to try to detect SQL injection trials		# Notes.: Regex to try to detect SQL injection trials
	# Values: TEXT		# Values: TEXT
	#		#
	failregex = ^<HOST> -[^"]"[A-Z]+\s+/[^"]\?[^"](?:%(sqlfragments_generic)s\|%(sqlfragments_havij)s)[^"]HTTP[^"]*"		failregex = ^<HOST> -[^"]"[A-Z]+\s+/[^"]\?[^"](?:%(sqlfragments_generic)s\|%(sqlfragments_havij)s)[^"]HTTP[^"]*"

	# Option: ignoreregex		# Option: ignoreregex
	# Notes.: regex to ignore. If this regex matches, the line is ignored.		# Notes.: regex to ignore. If this regex matches, the line is ignored.
	# Values: TEXT		# Values: TEXT
	#		#
	ignoreregex =		ignoreregex =













	Referências		Referências
	https://www.fail2ban.org/wiki/index.php/HOWTO_apache_myadmin_filter		* https://www.fail2ban.org/wiki/index.php/HOWTO_apache_myadmin_filter
	https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04		* https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04
	https://github.com/TrogloGeek/fail2ban-apache-sqlinject		* https://github.com/TrogloGeek/fail2ban-apache-sqlinject





Linha 170:		Linha 155:
	* https://www.raspberrypi.org/forums/viewtopic.php?t=67934&p=496490		* https://www.raspberrypi.org/forums/viewtopic.php?t=67934&p=496490
	* http://serverfault.com/questions/285256/how-to-unban-an-ip-properly-with-fail2ban		* http://serverfault.com/questions/285256/how-to-unban-an-ip-properly-with-fail2ban


	~~<source lang="bash">~~
	~~iptables -D fail2ban-NAME -s IP -j DROP~~
	~~</source>~~

Banto Palmarino em 21h22min de 25 de novembro de 2017

2017-11-25T21:22:25Z

← Edição anterior		Edição das 18h22min de 25 de novembro de 2017
Linha 55:		Linha 55:


	~~---~~ Reiniciar o fail2ban		Reiniciar o fail2ban
			<source lang="bash">
	service fail2ban restart		service fail2ban restart
			</source>

	~~---~~ Aplicar regras para ações já realizadas		Aplicar regras para ações já realizadas
	fail2ban-regex /var/log/apache2/access.log /etc/fail2ban/filter.d/~~apache-myadmin~~.conf		<source lang="bash">
			fail2ban-regex /var/log/apache2/access.log /etc/fail2ban/filter.d/phpmyadmin.conf
			</source>

			desbloqueando IP
			<source lang="bash">
			fail2ban-client set phpmyadmin unbanip 192.168.100.9
			</source>

	~~--- desbloqueando IP~~		lista os filtros
	~~fail2ban-client set apache-myadmin unbanip 192.168.100.9~~		<source lang="bash">


	~~---~~ lista os filtros
	fail2ban-client status		fail2ban-client status
			</source>

	~~---~~ lista o status do filtro		lista o status do filtro
	fail2ban-client status ~~apache-myadmin~~		<source lang="bash">
			fail2ban-client status phpmyadmin
			</source>

	~~***********************~~ proteção contra ataque ao wordpress		== proteção contra ataque ao wordpress ==

	acrescentar em /etc/fail2ban/jail.local		acrescentar em /etc/fail2ban/jail.local

	[wordpress]		[wordpress]
	enabled = true		enabled = true
	filter = wordpress		filter = wordpress
	port = http,https		port = http,https
	action = iptables-multiport[name=wordpress, port="http,https", protocol=tcp]		action = iptables-multiport[name=wordpress, port="http,https", protocol=tcp]
	logpath = /var/log/apache2/access.log		logpath = /var/log/apache2/access.log
	bantime = 84600		bantime = 84600
	maxretry = 6		maxretry = 6


	e crie o /etc/fail2ban/filter.d/wordpress.conf com o conteúdo		e crie o /etc/fail2ban/filter.d/wordpress.conf com o conteúdo

	[Definition]		[Definition]
	failregex = ^<HOST> .* "POST .*xmlrpc\.php		failregex = ^<HOST> .* "POST .*xmlrpc\.php
	^<HOST> .* "POST .wp-cron\.php.		^<HOST> .* "POST .wp-cron\.php.
	^<HOST> .* "POST .*wp-login\.php		^<HOST> .* "POST .*wp-login\.php
	ignoreregex =		ignoreregex =



	~~***********************~~ proteção contra ataque sqlinject		== proteção contra ataque sqlinject ==

Banto Palmarino em 21h18min de 25 de novembro de 2017

2017-11-25T21:18:52Z

Mostrar alterações