Ubuntu 14.04でfail2banを設定する

アタックしてきた送信元を自動的にブロックしれくれるfail2banを設定します。
fail2banはiptablesを使用するので事前にufwの設定をしておきます。
【参考】：Ubuntu 14.04でufwを設定する

fail2banがインストールされていなければインストールします。

$ sudo aptitude search fail2ban
p fail2ban - ban hosts that cause multiple authenticati

$ sudo aptitude install fail2ban

fail2banの設定をします。
デフォルトだとsshに対してログインアタックを一定回数行うとブロックしてくれます。
メール通知設定などもここでできるので適宜変更します。

/etc/fail2ban/fail2ban.conf

[DEFAULT]
fail2banの除外設定
信頼する送信元を指定しておきます
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1/8 xxx.xxx.xxx.xxx/32

ブロックする時間（秒）
600秒間ブロックする
# "bantime" is the number of seconds that a host is banned.
bantime = 600

リトライ回数
600秒間に3回条件に合致したらfail2ban発動
# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 600
maxretry = 3

メール通知先
#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
#destemail = root@localhost
destemail = fail2ban@example.com

メールタイトル
#
# Name of the sender for mta actions
sendername = Fail2Ban

#
# ACTIONS
#

fail2banの条件に合致したときのアクション
# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define
# action_* variables. Can be overridden globally or per
# section within jail.local file
banaction = iptables-multiport

# email action. Since 0.8.1 upstream fail2ban uses sendmail
# MTA for the mailing. Change mta configuration parameter to mail
# if you want to revert to conventional 'mail'.
mta = sendmail

# Default protocol
protocol = tcp

# Specify chain where jumps would need to be added in iptables-* actions
chain = INPUT

#
# Action shortcuts. To be used to define action parameter

# The simplest action to take: ban only
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

# ban & send an e-mail with whois report to the destemail.
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
%(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s", sendername="%(sendername)s"]

# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
%(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"]

banactionの実行のほかにメール送信も行う場合は action_mw か action_mwl を指定
# Choose default action. To change, just override value of 'action' with the
# interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local
# globally (section [DEFAULT]) or per specific section
#action = %(action_)s
action = %(action_mwl)s

#
# JAILS
#

# Next jails corresponds to the standard configuration in Fail2ban 0.6 which
# was shipped in Debian. Enable any defined here jail by including
#
# [SECTION_NAME]
# enabled = true

SSHに関連する設定
/var/log/auth.log内にフィルター（sshd）に合致する文字列が3回記録されるとfail2banが動く
他の設定はenabled=falseになっているので必要に応じてtrueに変更する
[ssh]

enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 3

これでfail2banを起動すればOKです。

$ sudo service fail2ban start
* Starting authentication failure monitor fail2ban [ OK ]

$ tail /var/log/fail2ban.log
2018-03-24 11:29:39,168 fail2ban.server : INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.11
2018-03-24 11:29:39,168 fail2ban.jail : INFO Creating new jail 'ssh'
2018-03-24 11:29:39,336 fail2ban.jail : INFO Jail 'ssh' uses pyinotify
2018-03-24 11:29:39,390 fail2ban.jail : INFO Initiated 'pyinotify' backend
2018-03-24 11:29:39,391 fail2ban.filter : INFO Added logfile = /var/log/auth.log
2018-03-24 11:29:39,392 fail2ban.filter : INFO Set maxRetry = 3
2018-03-24 11:29:39,394 fail2ban.filter : INFO Set findtime = 600
2018-03-24 11:29:39,395 fail2ban.actions: INFO Set banTime = 600
2018-03-24 11:29:39,491 fail2ban.jail : INFO Jail 'ssh' started

OS起動時の自動実行も設定しておきます。

$ sudo sysv-rc-conf --list |grep fail2ban
fail2ban 0:off 1:off 2:off 3:off 4:off 5:off 6:off

$ sudo sysv-rc-conf fail2ban on

$ sudo sysv-rc-conf --list |grep fail2ban
fail2ban 0:off 1:off 2:on 3:on 4:on 5:on 6:off

試しにsshに対してログインを失敗してみます。

$ sudo tail -f /var/log/auth.log
Mar 24 21:04:24 ubuntu sshd[16925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=spxxx-xxx-xxx-xxx.msb.spmode.ne.jp user=fail2bantest
Mar 24 21:04:25 ubuntu sshd[16925]: Failed password for fail2bantest from xxx.xxx.xxx.xxx port 51433 ssh2
Mar 24 21:04:25 ubuntu sshd[16925]: Received disconnect from xxx.xxx.xxx.xxx: 11: Normal Shutdown [preauth]

1回のログイン失敗が記録されています。
$ sudo fail2ban-client status ssh
Status for the jail: ssh
|- filter
| |- File list: /var/log/auth.log
| |- Currently failed: 1
| `- Total failed: 1
`- action
|- Currently banned: 0
| `- IP list:
`- Total banned: 0

設定した回数失敗してみます。
ブロックされました。

$ sudo fail2ban-client status ssh
Status for the jail: ssh
|- filter
| |- File list: /var/log/auth.log
| |- Currently failed: 0
| `- Total failed: 3
`- action
|- Currently banned: 1
| `- IP list: xxx.xxx.xxx.xxx
`- Total banned: 1

$ tail /var/log/fail2ban.log
2018-03-24 21:09:27,269 fail2ban.actions: WARNING [ssh] Ban xxx.xxx.xxx.xxx

$ sudo iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
fail2ban-ssh tcp -- anywhere anywhere multiport dports 22

Chain fail2ban-ssh (1 references)
target prot opt source destination
REJECT all -- spxxx-xxx-xxx-xxx.msb.spmode.ne.jp anywhere reject-
with icmp-port-unreachable
RETURN all -- anywhere anywhere