Fail2Ban doing its thing

    Just a post informing the accuracy of fail2ban when doing what is suppose to do.

    For those concerned about safety, if things are properly configured, it is (almost) safe.

    Just got an email informing that an IP was banned while trying to access SSH with user root and after, with user admin

    The info on the email is quite detailed:



    What I didn't like was the fact that my SSH port is non-conventional so, how the heck was it found? (NOTE: rethorical question, :D )


    After this, I just changed the port to another one.

    was it easy to set up soma? I don't use it. Should I? my omv ssh is not allowed outside my lan.

    Plugins - compose, cputemp, omv-extras, sharerootfs.

    Drives - 1tb nvme Data, 2TB nvme Leeching, 24TB (8tbx 3 merg) Media,

    Docker - nginx-proxy-manager, plex, prowlarr, qbittorrentvpn, radarr, sonarr, watchtower.

    Zitat von BlueCoffee

    was it easy to set up soma?

    Everything is already available on the GUI. All it takes is to configure it as you want.




    Zitat von BlueCoffee

    Should I? my omv ssh is not allowed outside my lan.

    The resources it take are minimum. Even if you only use SSH on the LAN, it makes sense to me, to have it enabled.

    All it takes is for someone to enter your LAN by any other means available (docker, services, devices, whatever) to jump in to other LAN devices.


    And what also makes sense to me is to have a complete different port for it, NOT the default 22.

    What setting do you use Soma I don't want to lock myself out.

    Plugins - compose, cputemp, omv-extras, sharerootfs.

    Drives - 1tb nvme Data, 2TB nvme Leeching, 24TB (8tbx 3 merg) Media,

    Docker - nginx-proxy-manager, plex, prowlarr, qbittorrentvpn, radarr, sonarr, watchtower.

    Zitat von BlueCoffee

    What setting do you use Soma I don't want to lock myself out.

    This is the basic setting:




    Even if you lock yourself out, the ban is lifted after 600 seconds (10 minutes).

    You can set what time you consider best.


    Also, you can unban the IP via CLI with:

    fail2ban-client set YOURJAILNAMEHERE unbanip IPADDRESSHERE

    Thanks soma do you have anything other than the default setting in the jails part?


    Plugins - compose, cputemp, omv-extras, sharerootfs.

    Drives - 1tb nvme Data, 2TB nvme Leeching, 24TB (8tbx 3 merg) Media,

    Docker - nginx-proxy-manager, plex, prowlarr, qbittorrentvpn, radarr, sonarr, watchtower.

    also would my ip be lan or wan? or even both?

    Plugins - compose, cputemp, omv-extras, sharerootfs.

    Drives - 1tb nvme Data, 2TB nvme Leeching, 24TB (8tbx 3 merg) Media,

    Docker - nginx-proxy-manager, plex, prowlarr, qbittorrentvpn, radarr, sonarr, watchtower.

    Zitat von BlueCoffee

    other than that I mean.

    No.


    The containers I run from Linuxserver have also fail2ban integrated on them (SWAG, jellyfin, nextcloud)

    Zitat von BlueCoffee

    also would my ip be lan or wan? or even both?

    On the Ignore IP?

    Leave it as it is: 127.0.0.1

    This is to exclude the loopback internal IP from getting locked out. Otherwise, you could be blocked even while connected locally.


    You can add IPs there (LAN or WAN) but fail2ban won't block them in case of brute force.

    Furthermore, when I click on services fail2ban again got

    Code
    Error
Failed to execute command 'export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; export LANG=C.UTF-8; export LANGUAGE=; fail2ban-client status 2>&1' with exit code '255': 2023-12-16 14:21:18,771 fail2ban [567394]: ERROR Failed to access socket path: /var/run/fail2ban/fail2ban.sock. Is fail2ban running?
    Zitat von Nefertiti

    Furthermore, when I click on services fail2ban again got

    Code
    Error
Failed to execute command 'export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; export LANG=C.UTF-8; export LANGUAGE=; fail2ban-client status 2>&1' with exit code '255': 2023-12-16 14:21:18,771 fail2ban [567394]: ERROR Failed to access socket path: /var/run/fail2ban/fail2ban.sock. Is fail2ban running?

    Start by checking the PATH that is showing:


    ls -al /var/run/fail2ban/


    Code
    pi@panela:~ $ ls -al /var/run/fail2ban/
total 4
drwxr-xr-x  2 root root   80 Dec  9 10:05 .
drwxr-xr-x 35 root root 1160 Dec 17 11:00 ..
-rw-------  1 root root    7 Dec  9 10:05 fail2ban.pid
srwx------  1 root root    0 Dec  9 10:05 fail2ban.sock


    If it doesn't show nothing:


    Try to disable the service, uninstall the plugin, install again.

    Before enabling it, start by enabling the Jails first, accepting the Yellow Banner when it shows.

    Only after the Jails are enabled, then enable the Service on the Settings Page.


    If any error happens, post any info, screenshots or the settings you are applying.


    Also, the outputs of:

    sudo fail2ban-client -x start

    sudo fail2ban-client status

    sudo systemctl status fail2ban.service

    scusate per la mia ignoranza. Ma a cosa serve Fail2Ban?

    Zitat von opennas

    scusate per la mia ignoranza. Ma a cosa serve Fail2Ban?

    please use google: https://www.google.com/search?…&sourceid=chrome&ie=UTF-8

Jetzt mitmachen!

Sie haben noch kein Benutzerkonto auf unserer Seite? Registrieren Sie sich kostenlos und nehmen Sie an unserer Community teil!

Benutzerkonto erstellen Anmelden