Bonjour tout le monde, sur ma dedibox, j'ai énormément de tentatives d'accès au serveur smtp (sur sasl) par force brute ou dictionnaire.
extrait de logwatch :
User: abc123 - PAM auth error - 1 Time(s):
User: access - PAM auth error - 1 Time(s):
User: accounts - PAM auth error - 2 Time(s):
User: albert - PAM auth error - 2 Time(s):
User: alex - PAM auth error - 2 Time(s):
User: alexis - PAM auth error - 2 Time(s):
User: amanda - PAM auth error - 2 Time(s):
J'utilise fail2ban, et j'ai ajouté une règle sasl
comme sur ce site pour bannir les prétendants.
$ cat /etc/fail2ban/filter.d/sasl.conf
[Definition]
failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed: \w
ignoreregex =
et la partie du jail.local concernée :
$ cat /etc/fail2ban/jail.local
...
[sasl]
enabled = true
port = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter = sasl
findtime = 600
logpath = /var/log/mail.log
maxretry = 4
...
le filtre semble bien être lancé avec les bons paramètres :
$ fail2ban-client -d | grep sasl
['add', 'sasl', 'auto']
['set', 'sasl', 'addlogpath', '/var/log/mail.log']
['set', 'sasl', 'maxretry', 2]
['set', 'sasl', 'addignoreip', '127.0.0.1/8']
['set', 'sasl', 'findtime', 600]
['set', 'sasl', 'bantime', 86400]
['set', 'sasl', 'addfailregex', '(?i): warning: [-._\\w]+\\[<HOST>\\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed: \\w']
['set', 'sasl', 'addaction', 'iptables-multiport']
['set', 'sasl', 'actionban', 'iptables-multiport', 'iptables -I fail2ban-<name> 1 -s <ip> -j DROP']
['set', 'sasl', 'actionstop', 'iptables-multiport', 'iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>\niptables -F fail2ban-<name>\niptables -X fail2ban-<name>']
['set', 'sasl', 'actionstart', 'iptables-multiport', 'iptables -N fail2ban-<name>\niptables -A fail2ban-<name> -j RETURN\niptables -I <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>']
['set', 'sasl', 'actionunban', 'iptables-multiport', 'iptables -D fail2ban-<name> -s <ip> -j DROP']
['set', 'sasl', 'actioncheck', 'iptables-multiport', 'iptables -n -L <chain> | grep -q fail2ban-<name>']
['set', 'sasl', 'setcinfo', 'iptables-multiport', 'protocol', 'tcp']
['set', 'sasl', 'setcinfo', 'iptables-multiport', 'name', 'sasl']
['set', 'sasl', 'setcinfo', 'iptables-multiport', 'chain', 'INPUT']
['set', 'sasl', 'setcinfo', 'iptables-multiport', 'port', 'smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s']
['start', 'sasl']
et si je lance le filtre sasl.conf :
$ fail2ban-regex /var/log/mail.log /etc/fail2ban/filter.d/sasl.conf
Running tests
=============
Use regex file : /etc/fail2ban/filter.d/sasl.conf
Use log file : /var/log/mail.log
Results
=======
Failregex
|- Regular expressions:
| [1] (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed: \w
|
`- Number of matches:
[1] 907 match(es)
Summary
=======
Addresses found:
[1]
217.160.252.xxx (Sun Sep 07 06:58:21 2014)
217.160.252.xxx (Sun Sep 07 08:01:44 2014)
217.160.252.xxx (Sun Sep 07 09:04:29 2014)
217.160.252.xxx (Sun Sep 07 10:07:30 2014)
217.160.252.xxx (Sun Sep 07 11:07:45 2014)
50.57.66.xxx (Sun Sep 07 13:49:13 2014)
...........
87.106.33.xxx (Fri Sep 12 11:44:09 2014)
82.165.16.xxx (Fri Sep 12 11:45:02 2014)
217.160.20.xxx (Fri Sep 12 12:04:29 2014)
94.158.158.xxx (Fri Sep 12 12:05:53 2014)
Date template hits:
7659 hit(s): MONTH Day Hour:Minute:Second
Success, the total number of match is 907
Tout semble ok, il me trouve bien des les IP à bannir .... hors il ne les bannit pas : ( :
$ fail2ban-client status sasl
Status for the jail: sasl
|- filter
| |- File list: /var/log/mail.log
| |- Currently failed: 4
| `- Total failed: 4
`- action
|- Currently banned: 0
| `- IP list:
`- Total banned: 0
et donc rien dans iptable : (, alors que les autres filtres fail2ban fonctionnent correctement ....
avec vous une idée ??? merci !!!!!!!!!!!!!!!!!!!!!!!!! : )
