vicidial.org

Reply with quote

VICIBOX 8 FAIL2BAN SETUP - 100 % WORKING

by dito » Sat Feb 17, 2018 11:49 am

Hi all,
saw some confused posts turning around firewall and security on vicibox server.
Fail2ban is a log-parsing application that monitors system logs for symptoms of an automated attack on your Vicibox.
When an attempted compromise is located, using the defined parameters, Fail2ban will add a new rule to iptables to block the IP address of the attacker, either for a set amount of time or permanently. Fail2ban can also alert you through email that an attack is occurring.
Steps To setup fail2ban working on your system, this will protect from ATTACKS AGAINST ASTERISK, APACHE, AND SSH:

1- fail2ban install:

Code: Select all: yast2 -i fail2ban

2 - configure fail2ban:

Code: Select all: vi /etc/fail2ban/jail.local

add those lines:

# Do all your modifications to the jail's configuration in jail.local!

Code: Select all: [DEFAULT] ignoreip = 127.0.0.1 bantime = 6048000 findtime = 600 maxretry = 5 backend = auto [asterisk-iptables] enabled = true filter = asterisk action = iptables-allports[name=SIP, protocol=all] sendmail[name=VICIBOX-ASTERISK-DETECTOR, dest=support@crm.tn, sender=vicibox@crm.tn] logpath = /var/log/asterisk/messages maxretry = 3 bantime = 6048000 [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail[name=VICIBOX-SSH-DETECTOR, dest=yourmail, sender=yourmail] logpath = /var/log/messages maxretry = 3 bantime = 6048000 [apache-tcpwrapper] enabled = true filter = apache-auth action = iptables-allports[name=apache-auth, port=http, protocol=tcp] sendmail[name=VICIBOX-APACHE-DETECTOR, dest=yourmail, sender=yourmail] logpath = /var/log/apache2/error_log maxretry = 3 [apache-badbots] enabled = true filter = apache-badbots action = iptables-multiport[name=BadBots, port="http,https"] sendmail[name=VICIBOX-BadBots-DETECTOR, dest=yourmail, sender=yourmail] logpath = /var/log/apache2/*access_log bantime = 6048000 maxretry = 1 # Jail for more extended banning of persistent abusers # !!! WARNING !!! # Make sure that your loglevel specified in fail2ban.conf/.local # is not at DEBUG level -- which might then cause fail2ban to fall into # an infinite loop constantly feeding itself with non-informative lines [recidive] enabled = true filter = recidive logpath = /var/log/fail2ban.log* action = iptables-allports[name=recidive, protocol=all] sendmail[name=VICIBOX-BADBOY-DETECTOR, dest=yourmail, sender=yourmail] bantime = 6048000 ; 10 weeks #findtime = 60480000 ; 5 hours findtime = 43200 ; 12 hours maxretry = 5

3 - launch and check fail2ban
launch fail2ban :

Code: Select all: service fail2ban start

check if jails are on:

Code: Select all: fail2ban-client status

you will have to see sth like this:

Code: Select all: Status |- Number of jail: 5 `- Jail list: apache-badbots, apache-tcpwrapper, asterisk-iptables, recidive, ssh-iptables

check your mailbox if all is ok you will recieve sth like this:

Advice: add your own ip as ignoreip to avoid risk getting banned from your own server
Code: Select all
ignoreip = 127.0.0.1 ignoreip = yourserverip ignoreip = yourofficeip

VoIP TUNISIE
support@crm.tn - https://crm.tn

dito: Posts: 49; Joined: Wed Nov 11, 2015 9:29 pm

Who is online