openmediavault-fail2ban first version now available for testing

    @tinh_x7


    I don't know, test one file, if it doesn't work test the other file ...

    I don't why my Fail2Ban is keep ban my subnet router ip.
    Everything is working though.


    OMV v5.0
    Asus Z97-A/3.1; i3-4370
    32GB RAM Corsair Vengeance Pro

    Because i think Fai2ban see in log files "/var/log/nginx/access.log /var/log/nginx/openmediavault-webgui_access.log /var/log/nginx/6d535d5a-81ad-401e-aa01-eb0723e5f168-access.log" fail auth from 192.168.1.3
    This is for test ?
    Inspect your files and delete the line or add 192.168.1.3 to IgnoreIp


    To unban :
    root:/# fail2ban-client get nginx-404 actionunban 192.168.1.3

    restart the service


    root:/# service fail2ban restart


    or


    root:/# fail2ban-client stop
    root:/# fail2ban-client start


    or
    root:/# fail2ban-client reload


    Now, it's good ?

    I used these commands, clear the log, restart OMV, still same error:


    fail2ban-client get nginx-404 actionunban 192.168.1.3
    fail2ban-client stop
    fail2ban-client start






    OMV v5.0
    Asus Z97-A/3.1; i3-4370
    32GB RAM Corsair Vengeance Pro

    EDIT: I add my customized port to nginix-404 jail, then the autoban is stop.
    i.e. http,https,[customized port]







    OMV v5.0
    Asus Z97-A/3.1; i3-4370
    32GB RAM Corsair Vengeance Pro

    2 Mal editiert, zuletzt von tinh_x7 ()

    @Bambuleee
    > Is it possible to unban IPs?
    Yes manualy like : iptables -D fail2ban-XXXX -s IP -j DROP
    Change XXX and IP
    You need to clean your log file, if you don't want to be reban ...


    To see iptables rules :
    iptables -L -n


    >It is possible to cinfigure fail2ban, that I only get an email at actually an IP is banned and not when server is started (I get mails like "The jail nginx-404 has been started successfully.")
    "server" is started in same time as your host, and when your host run a lot of time, you don't receice email server is started beacause it is ever started ....


    You can check your inbox mail where you restart fail2ban service :
    Root# service fail2ban restart

    I install fail2ban 1.1.4
    I got error message when I click "Service" - "Fail2ban"


    And Fail2Ban show red cycle in Service tab.
    I must use "/etc/init.d/fail2ban restart" command to restart fail2ban.

    When enabled I get the following error from daily cronjob,


    Code
    /etc/cron.daily/logrotate:error: error running non-shared postrotate script for /var/log/fail2ban.log of '/var/log/fail2ban.log 'run-parts: /etc/cron.daily/logrotate exited with return code 1


    The fail2ban plugin is enabled but obviously not running, does the plugin actually start the service? (solved this by starting the service manually)

    Zitat von Bambuleee

    It is possible to cinfigure fail2ban, that I only get an email at actually an IP is banned and not when server is started (I get mails like "The jail nginx-404 has been started successfully.")


    I've reduced the e-mails I get by editing these files:
    /etc/fail2ban/action.d/sendmail.conf
    /etc/fail2ban/action.d/sendmail-buffered.conf
    /etc/fail2ban/action.d/sendmail-whois.conf
    /etc/fail2ban/action.d/sendmail-whois-lines.conf

    Do not start service when apply save button on setting tab ( do not appear the apply warning), but start when change anything on jails tab and push the save button (in this case appears the apply warning).


    Perhaps some bug in latest OMV ( see my spec. on my signature).

    Hello,


    There is no plugin for OpenVPN.


    I have added one but there is no protocol option in the GUI so I have to edit the fail2ban file manually.


    1) Create a file


    /etc/fail2ban/filter.d/openvpn.conf


    [Definition]


    failregex = <HOST>:\d{1,5} TLS Auth Error
    <HOST>:\d{1,5} VERIFY ERROR:
    <HOST>:\d{1,5} TLS Error: TLS handshake failed
    <HOST>:\d{1,5} [ECONNREFUSED]: Connection refused





    I have added the rule "<HOST>:\d{1,5} [ECONNREFUSED]: Connection refused" to what I saw on Internet because on my tests with a wrong key I had that error.
    2) Edit the file


    /etc/fail2ban/jail.conf


    The line protocol = udp is not there. When it is not there the rule doesn't work.


    I have to add the line manually (Only the field is missing when I configure a jail). I have taken the port 1294 instead of 1194


    [OpenVPN]
    enabled = yes
    protocol = udp
    port = 1294
    filter = openvpn
    logpath = /var/log/openvpn.log
    bantime = -1
    maxretry = 3


    3) After that, I must restart the service fail2bal


    service fail2ban stop
    service fail2ban start



    Is it possible to add the rule automatically in fail2ban (or to add the option to chose the protocol)?
    Thank you
    Marc

    The general steps are:


    1) Figure out in what file it is logging failures.
    2) Create a regular expression based on the failures.
    3) Create a filter file with the above regular expression.
    4) Enter the information in the plugin.


    From your post it's impossible to tell what you've done so far.

Jetzt mitmachen!

Sie haben noch kein Benutzerkonto auf unserer Seite? Registrieren Sie sich kostenlos und nehmen Sie an unserer Community teil!

Benutzerkonto erstellen Anmelden