Das wären die Fail2Ban-Einstellungen, wie sie aktuell auf meinem privaten Server im Einsatz sind.
Das ist kein Shared Server und so Sachen wie Mail etc. wird nur von einer handvoll Personen genutzt.
/etc/fail2ban/jail.d/keyhelp
Code: Select all
# Created by KeyHelp.
#
# DO NOT CHANGE ANYTHING IN THIS FILE,
# CHANGES WILL BE LOST ON NEXT UPDATE!
# SSH
[sshd]
enabled = true
port = ssh
backend = systemd
maxretry = 2
findtime = 60m
# Web server
[kh-apache]
enabled = true
port = http,https
filter = apache-auth
logpath = /home/users/*/logs/*/error.log
maxretry = 2
# Mail server
[kh-postfix]
enabled = true
#mode = aggressive
port = smtp,ssmtp,smtps,submission,submissions
filter = postfix
backend = systemd
maxretry = 3
[kh-postfix-sasl]
enabled = true
filter = postfix[mode=auth]
port = smtp,ssmtp,smtps,submission,submissions
backend = systemd
maxretry = 2
findtime = 60m
[kh-dovecot]
enabled = true
port = pop3,pop3s,imap,imaps,submission,submissions,sieve
filter = dovecot
backend = systemd
maxretry = 4
# FTP server
[kh-ftp]
enabled = true
port = ftp,ftp-data,ftps,ftps-data
filter = proftpd
backend = systemd
maxretry = 2
# Database server
[kh-database]
enabled = true
port = mysql
filter = keyhelp-mariadb
backend = systemd
maxretry = 2
# Tools
[kh-phpmyadmin]
enabled = true
port = http,https
filter = keyhelp-phpmyadmin
# https://github.com/fail2ban/fail2ban/wiki/Upgrading-to-v0.10.5-Breaks-WP-Fail2ban-and-Other-Jails
backend = systemd[journalflags=1]
maxretry = 2
[kh-roundcube]
enabled = true
port = http,https
filter = roundcube-auth
# https://github.com/fail2ban/fail2ban/wiki/Upgrading-to-v0.10.5-Breaks-WP-Fail2ban-and-Other-Jails
backend = systemd[journalflags=1]
maxretry = 3
[kh-snappymail]
enabled = true
port = http,https
filter = keyhelp-snappymail
# https://github.com/fail2ban/fail2ban/wiki/Upgrading-to-v0.10.5-Breaks-WP-Fail2ban-and-Other-Jails
backend = systemd[journalflags=1]
maxretry = 3
# Misc
# !!! WARNING !!!
# Make sure that your loglevel specified in fail2ban.conf/.local
# is not at DEBUG level -- which might then cause fail2ban to fall into
# an infinite loop constantly feeding itself with non-informative lines
[kh-recidive]
enabled = true
filter = recidive
logpath = /var/log/fail2ban.log
action = iptables-allports[name=recidive]
maxretry = 2
bantime = 360d
findtime = 1d
Zusätzlich habe ich noch die folgenden Dateien mit folgendem Inhalt überschrieben:
/etc/fail2ban/filter.d/postfix.conf
Code: Select all
#
# These file is from Fail2Ban 1.1.0 and is installed by KeyHelp for older Fail2Ban versions.
#
# Fail2Ban filter for selected Postfix SMTP rejections
#
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf
[Definition]
_daemon = postfix(-\w+)?/[^/\[:\s]+(?:/smtp[ds])?
_port = (?::\d+)?
_pref = [A-Z]{4}
prefregex = ^%(__prefix_line)s<mdpr-<mode>> <F-CONTENT>.+</F-CONTENT>$
# Extended RE for normal mode to match reject by unknown users or undeliverable address, can be set to empty to avoid this:
exre-user = |[Uu](?:ser unknown|ndeliverable address) ; pragma: codespell-ignore
mdpr-normal = (?:\w+: (?:milter-)?reject:|(?:improper command pipelining|too many errors) after \S+)
mdre-normal=^%(_pref)s from [^[]*\[<HOST>\]%(_port)s: [45][50][04] [45]\.\d\.\d+ (?:(?:<[^>]*>)?: )?(?:(?:Helo command|(?:Sender|Recipient) address) rejected: )?(?:Service unavailable|Access denied|(?:Client host|Command|Data command) rejected|Relay access denied|Malformed DNS server reply|(?:Host|Domain) not found|need fully-qualified hostname|match%(exre-user)s)\b
^from [^[]*\[<HOST>\]%(_port)s:?
mdpr-auth = warning:
mdre-auth = ^[^[]*\[<HOST>\]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed:(?! Connection lost to authentication server| Invalid authentication mechanism)
mdre-auth2= ^[^[]*\[<HOST>\]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed:(?! Connection lost to authentication server)
# todo: check/remove "Invalid authentication mechanism" from ignore list, if gh-1243 will get finished (see gh-1297).
# Mode "rbl" currently included in mode "normal", but if needed for jail "postfix-rbl" only:
mdpr-rbl = %(mdpr-normal)s
mdre-rbl = ^%(_pref)s from [^[]*\[<HOST>\]%(_port)s: [45]54 [45]\.7\.1 Service unavailable; Client host \[\S+\] blocked\b
# Mode "rbl" currently included in mode "normal" (within 1st rule)
mdpr-more = %(mdpr-normal)s
mdre-more = %(mdre-normal)s
# Includes some of the log messages described in
# <http://www.postfix.org/POSTSCREEN_README.html>.
mdpr-ddos = (?:lost connection after (?!(?:DATA|AUTH)\b)[A-Z]+|disconnect(?= from \S+(?: \S+=\d+)* auth=0/(?:[1-9]|\d\d+))|(?:PREGREET \d+|HANGUP) after \S+|COMMAND (?:TIME|COUNT|LENGTH) LIMIT)
mdre-ddos = ^from [^[]*\[<HOST>\]%(_port)s:?
mdpr-extra = (?:%(mdpr-auth)s|%(mdpr-normal)s)
mdre-extra = %(mdre-auth)s
%(mdre-normal)s
mdpr-aggressive = (?:%(mdpr-auth)s|%(mdpr-normal)s|%(mdpr-ddos)s)
mdre-aggressive = %(mdre-auth2)s
%(mdre-normal)s
mdpr-errors = too many errors after \S+
mdre-errors = ^from [^[]*\[<HOST>\]%(_port)s$
failregex = <mdre-<mode>>
# Parameter "mode": more (default combines normal and rbl), auth, normal, rbl, ddos, extra or aggressive (combines all)
# Usage example (for jail.local):
# [postfix]
# mode = aggressive
#
# # or another jail (rewrite filter parameters of jail):
# [postfix-rbl]
# filter = postfix[mode=rbl]
#
# # jail to match "too many errors", related postconf `smtpd_hard_error_limit`:
# # (normally included in other modes (normal, more, extra, aggressive), but this jail'd allow to ban on the first message)
# [postfix-many-errors]
# filter = postfix[mode=errors]
# maxretry = 1
#
mode = more
ignoreregex =
[Init]
journalmatch = _SYSTEMD_UNIT=postfix.service _SYSTEMD_UNIT=postfix@-.service
# Author: Cyril Jaquier
Code: Select all
#
# These file is from Fail2Ban 1.1.0 and is installed by KeyHelp for older Fail2Ban versions.
#
# Generic configuration items (to be used as interpolations) in other
# apache filters.
[INCLUDES]
before = common.conf
# Load customizations if any available
after = apache-common.local
[DEFAULT]
# Apache logging mode:
# all - universal prefix (logfile, syslog)
# logfile - logfile only
# syslog - syslog only
# Use `filter = apache-auth[logging=syslog]` to get more precise regex if apache logs into syslog (ErrorLog syslog).
# Use `filter = apache-auth[logging=all]` to get universal regex matches both logging variants.
logging = logfile
# Apache logging prefixes (date-pattern prefix, server, process etc.):
apache-prefix-syslog = %(__prefix_line)s
apache-prefix-logfile = \[\]\s
apache-prefix-all = (?:%(apache-prefix-logfile)s|%(apache-prefix-syslog)s)?
# Setting for __prefix_line (only `logging=syslog`):
_daemon = (?:apache\d*|httpd(?:/\w+)?)
apache-prefix = <apache-prefix-<logging>>
apache-pref-ignore =
_apache_error_client = <apache-prefix>\[(:?error|<apache-pref-ignore>\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[(?:client|remote) <HOST>(:\d{1,5})?\]
datepattern = {^LN-BEG}
# Common prefix for [error] apache messages which also would include <HOST>
# Depending on the version it could be
# 2.2: [Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4]
# 2.4: [Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 1.2.3.4:46652]
# 2.4 (perfork): [Mon Dec 23 07:49:01.981912 2013] [:error] [pid 3790] [client 204.232.202.107:46301] script '/var/www/timthumb.php' not found or unable to
#
# Reference: https://github.com/fail2ban/fail2ban/issues/268
#
# Author: Yaroslav Halchenko
Mit freundlichen Grüßen / Best regards
Alexander Mahr
**************************************************************
Keyweb AG - Die Hosting Marke
Neuwerkstr. 45/46, 99084 Erfurt / Germany
http://www.keyweb.de -
http://www.keyhelp.de
**************************************************************
Aber nur wenn es Änderungen seitens fail2ban in der File gab, wenn du selbst was geändert hast, sollten die bestehen bleiben, sofern sie nicht im Update Package sind.