fail2ban is freaking awesome

[drebo]

So I've been having DoS flood attacks semi-regularly hit my DNS servers. They were built on Windows 2003, so there's no real effective way to proactively filter out the offending IP addresses. So, I decided to redeploy the DNS servers as BIND on Linux boxes. To fascilitate automatic banning of IPs, I employed fail2ban. It monitors my BIND access logs and automagically bans (via IPTables) anyone who queries more than 200 times in 10 seconds (safe level, based on realistic usage of our name servers and the domains we host).

It's also got pretty cool features such as:

Hi,

The IP 59.175.146.230 has just been banned by Fail2Ban after
4 attempts against SSH.


Here are more information about 59.175.146.230:

[Querying whois.apnic.net]
[whois.apnic.net]
% [whois.apnic.net node-1]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 59.174.0.0 - 59.175.255.255
netname: CHINANET-HB
descr: CHINANET Hubei province network
descr: Data Communication Division
descr: China Telecom
country: CN
admin-c: CH93-AP
tech-c: CHA1-AP
mnt-by: APNIC-HM
mnt-lower: MAINT-CN-CHINANET-HB
status: ALLOCATED PORTABLE
remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
remarks: This object can only be updated by APNIC hostmasters.
remarks: To update this object, please contact APNIC
remarks: hostmasters and include your organisation's account
remarks: name in the subject line.
remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+
changed: hm-changed@apnic.net 20070420
source: APNIC

role: CHINANET HB ADMIN
address: 8th floor of JinGuang Building
address: #232 of Macao Road
address: HanKou Wuhan Hubei Province
address: P.R.China
country: CN
phone: +86 27 82862199
fax-no: +86 27 82861499
e-mail: ip_admin_hb@public.wh.hb.cn
trouble: send spam reports to spam_hb@public.wh.hb.cn
trouble: and abuse reports to abuse_hb@public.wh.hb.cn
trouble: Please include detailed information and
trouble: times in GMT+8
admin-c: YZ83-AP
admin-c: ZC77-AP
tech-c: YZ83-AP
tech-c: ZC77-AP
nic-hdl: CHA1-AP
notify: ip_admin_hb@public.wh.hb.cn
mnt-by: MAINT-CN-CHINANET-HB
changed: zhangyl68@public.wh.hb.cn 20031114
source: APNIC

person: Chinanet Hostmaster
nic-hdl: CH93-AP
e-mail: anti-spam@ns.chinanet.cn.net
address: No.31 ,jingrong street,beijing
address: 100032
phone: +86-10-58501724
fax-no: +86-10-58501724
country: CN
changed: dingsy@cndata.com 20070416
mnt-by: MAINT-CHINANET
source: APNIC

Regards,

Fail2Ban

Monitors SSH logs and automatically bans anyone who fails authentication more than 4 times in 10 minutes, and then emails me the IP and whois information.

Only drawbacks are the latency of the log file monitoring. For instance, I had one IP yesterday effect 500,000 DNS requests, which so overloaded the system that fail2ban took almost 10 minutes to kick off and block it. Fail2ban then proceeded to attempt to block it roughly 2000 more times. It's got some quirks, but it's a hell of a lot more helpful than waiting for DNS to stop responding and then using wireshark to find the IP and filter it at the firewall.

Anyway, just a PSA that everyone here should know about.

 

[VinylxScratches]

Question, I have a Debian file server that has SSH exposed.... could I use this tool for that for extra security?

 

[heymrdj]

Question, I have a Debian file server that has SSH exposed.... could I use this tool for that for extra security?

Yes you can, it will lock down SSH so that if someone tries and fails to authenticate against it x amount of times, it will IP block them for awhile, helping to keep your server safe.

http://www.howtoforge.com/fail2ban_debian_etch

There's a good article for Debian 4 (Etch), but the procedure is pretty much the same for 5 (Lenny).

 

[drebo]

Question, I have a Debian file server that has SSH exposed.... could I use this tool for that for extra security?

You can use fail2ban for any application that outputs a logfile. It's fully scriptable using regular expressions.

It comes prepackaged with a couple of useful scripts, like the one for SSH. I had to write the one for BIND flooding, but it was quite easy.