Mudanças entre as edições de "Fail2ban"
De MochilaWiki
Ir para navegaçãoIr para pesquisar| Linha 100: | Linha 100: | ||
== proteção contra ataque sqlinject == | == proteção contra ataque sqlinject == | ||
| + | |||
[sqlinject] | [sqlinject] | ||
| Linha 136: | Linha 137: | ||
# | # | ||
ignoreregex = | ignoreregex = | ||
| + | |||
| + | == x00 == | ||
| + | |||
| + | [nginx-x00] | ||
| + | enabled = true | ||
| + | port = http,https | ||
| + | filter = nginx-x00 | ||
| + | logpath = /var/log/nginx/access.log | ||
| + | bantime = 3600 | ||
| + | maxretry = 1 | ||
| + | |||
| + | and in /etc/fail2ban/filter.d/nginx-x00.conf | ||
| + | |||
| + | [Definition] | ||
| + | |||
| + | failregex = ^<HOST> .* ".*\\x.*" .*$ | ||
| + | |||
| + | |||
| + | * https://serverfault.com/questions/772833/fail2ban-regex-to-block-x00-requests | ||
| + | |||
| + | |||
Edição das 13h18min de 6 de janeiro de 2018
Instalando Apache e Fail2Ban
apt-get install fail2ban apache2
ajustes básico
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sed -i '30s/600/3600/g' /etc/fail2ban/jail.local
sed -i '34s/600/3600/g' /etc/fail2ban/jail.local
sed -i '35s/3/6/g' /etc/fail2ban/jail.local
sed -i '111s/action_/action_mwl/g' /etc/fail2ban/jail.local
proteção contra ataque no phpmyadmin
Acrescentar em /etc/fail2ban/jail.local
[phpmyadmin] enabled = true filter = phpmyadmin port = http,https logpath = /var/log/apache2/access.log action = iptables-multiport[name=phpmyadmin, port="http,https", protocol=tcp] maxretry = 2 bantime = 84600
criar um arquivo em /etc/fail2ban/filter.d/phpmyadmin.conf com conteúdo:
[Definition]
failregex = \[client <HOST>\] File does not exist:.*(?i)phpmyadmin.*
\[client <HOST>\] File does not exist:.*(?i)manager.*
\[client <HOST>\] File does not exist:.*(?i)setup.*
\[client <HOST>\] File does not exist:.*(?i)mysql.*
\[client <HOST>\] File does not exist:.*(?i)sqlweb.*
\[client <HOST>\] File does not exist:.*(?i)webdb.*
\[client <HOST>\] File does not exist:.*(?i)pma.*
\[client <HOST>\] File does not exist:.*(?i)vtigercrm.*
^<HOST>.*GET.*(?i)phpmyadmin.*
^<HOST>.*GET.*(?i)manager.*
^<HOST>.*GET.*(?i)setup.*
^<HOST>.*GET.*(?i)mysql.*
^<HOST>.*GET.*(?i)sqlweb.*
^<HOST>.*GET.*(?i)webdb.*
^<HOST>.*GET.*(?i)pma.*
^<HOST>.*GET.*(?i)vtigercrm.*
ignoreregex =
Reiniciar o fail2ban
service fail2ban restart
Aplicar regras para ações já realizadas
fail2ban-regex /var/log/apache2/access.log /etc/fail2ban/filter.d/phpmyadmin.conf
desbloqueando IP
fail2ban-client set phpmyadmin unbanip 192.168.100.9
lista os filtros
fail2ban-client status
lista o status do filtro
fail2ban-client status phpmyadmin
proteção contra ataque ao wordpress
acrescentar em /etc/fail2ban/jail.local
[wordpress] enabled = true filter = wordpress port = http,https action = iptables-multiport[name=wordpress, port="http,https", protocol=tcp] logpath = /var/log/apache2/access.log bantime = 84600 maxretry = 6
e crie o /etc/fail2ban/filter.d/wordpress.conf com o conteúdo
[Definition]
failregex = ^<HOST> .* "POST .*xmlrpc\.php
^<HOST> .* "POST .*wp-cron\.php.*
^<HOST> .* "POST .*wp-login\.php
ignoreregex =
proteção contra ataque sqlinject
[sqlinject] enabled = true filter = sqlinject port = http,https action = iptables-multiport[name=sqlinject, port="http,https", protocol=tcp] logpath = /var/log/apache2/access.log bantime = 84600 maxretry = 6
e crie o /etc/fail2ban/filter.d/sqlinject.conf com o conteúdo
# Fail2Ban configuration file # # Author: TrogloGeek (Damien VERON) # # $Revision: 1 $ # [Definition] sqlfragments_generic = select.*from|delete.*from|update.*set|insert.*into|replace.*(value|set) sqlfragments_havij = and(\+|%%20)ascii%%28substring|and(\+|%%20)Length|union(\+|%%20)all(\+|%%20)select|and(\+|%%20)1%%3C1|and(\+|%%20)1%%3D1|and(\+|%%20)1%%3E1|and(\+|%%20)%%27.%%27%%3D%%27|%%2F\*%%21[0-9]+((\+|%%20)[0-9]*)?\*%%2F # Option: failregex # Notes.: Regex to try to detect SQL injection trials # Values: TEXT # failregex = ^<HOST> -[^"]*"[A-Z]+\s+/[^"]*\?[^"]*(?:%(sqlfragments_generic)s|%(sqlfragments_havij)s)[^"]*HTTP[^"]*" # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex =
x00
[nginx-x00] enabled = true port = http,https filter = nginx-x00 logpath = /var/log/nginx/access.log bantime = 3600 maxretry = 1
and in /etc/fail2ban/filter.d/nginx-x00.conf
[Definition] failregex = ^<HOST> .* ".*\\x.*" .*$
Referências
