Topic: [solved] Fail2Ban contrib :: 30Service25httpd

[piran]

Anyone have this fragment enabled in SME8.1 and ...is it biting?

I have the 30Service20qpsmtpd fragment enabled in SME8.1 and
it's biting well on spam email traffic and sends me f2b emails etc.

I am assuming I have done a configuration error or few as I have
had nothing 'biting' - with respect to the httpd/www stuff ...at all.

The fail2ban daemon log shows no errors.

Have a messages log tail running onscreen. I see nothing for the
http/www stuff of Fail2Ban, though I do see its qpsmtpd stuff.

The fail2ban-regex tester CLI gives matches testing 'my' filter(s)
though I have zero experience with Python. However when I run
the given filters' through the same tester CLI they fail so the test
facility hasn't given me much confidence in itself.

Until *SOMETHING* actually bites (httpd/www) I'm a little baffled:-/
Log level issue? Unknown log configuration?

PostEdit: now resolved :: see notes at the bottom
of http://wiki.contribs.org/Fail2ban#default_jail.conf

[piran]

(I've put some help notes here in the 8.1 contribs,  as they were 'pulled' from the wiki)

With many thanks to the author for his work templating the install of Fail2Ban into SME8/9 here are some notes for introduction:

* F2B adds to SMEserver's own high security after SME has already reported forbidden access, file not found or a relaying denied error. F2B filters read appropriate logs and associated jails implement timed bans (by dropping all packets arriving from the culprit IP). Another F2B action sends a notifying email.

* Restarting the contrib clears existing bans but a suitable 'findtime' results in a reban. Be aware that the restart delay can be unexpectedly lengthy, I've noticed a variation of between a few seconds to one that extended to nearly 40 minutes! YMMV

* The 'out of the box' install's given filters are *already* completely capable of detecting most problems without any user templating being necessary.

* Parameters are passed using db commands. On my SME8.1 and with only www & email expectations (no SSH) I used:

db configuration setprop qpsmtpd Fail2Ban enabled

db configuration setprop httpd-e-smith Fail2Ban enabled

config setprop fail2ban MailRecipient root

config setprop fail2ban FindTime 1200

config setprop fail2ban BanTime 604800

config setprop fail2ban MaxRetry 1

signal-event fail2ban-conf

* don't use MaxTry=0 (apparently it is a special Perl value)

* required www triggers need to have appeared in /var/log/httpd/error_log

* required email triggers need to have appeared in /var/log/*qpsmtpd/current

I amended the master template and made the internal multipliers ($MaxRetry/$max) equivalent to unity.
The expanded jail.conf then showed only my own db command value for MaxRetry=1:
see /etc/e-smith/templates/ect/fail2ban/jail.conf/*

On installation and eventual configuration I have observed automatic immediate bans
for all 'relaying denied' email and iterations of semalt referer spam within 'findtime'

[guest22]

(I've put some help notes here in the 8.1 contribs,  as they were 'pulled' from the wiki)

Piran,

your notes were not pulled from the wiki. They were simply put on the discussions page of the fail2ban how-to so it could be formatted, and remove the first person writing and blog style. Then it could be added to the how-to page making it more complete in a consistent style.

Your (valuable) wiki notes are still in the history of the discussion page, and maybe you want to revert them back and help us out with the formatting?

Thanks,
guest

[piran]

Semantics. Leaving the words here will do fine. I wrote them in the manner
of what I would've liked to have read before I started what turned out to
be an excessively long introduction (aka learning curve). Must've lost too
many grey cells lately. Changing 'the words I would've wanted to have
read...' to what, patently obviously to me, over on the wiki didn't
fully get me up to speed wouldn't really fit the bill now would it RequestedDeletion?
Changing the sense of the words - to fit a publishing style (that didn't
get me up the learning curve) - might be considered to be tantamount
to the tail wagging the dog. If these words help somebody else get their
own site up with Fail2Ban (F2B) to speed then that would be fine.