mirror of
https://github.com/YunoHost/doc.git
synced 2024-09-03 20:06:26 +02:00
[Anonymous contrib] How to set an IP adress in Fail2ban whitelist (#1014)
* How to set an IP adress in Fail2ban whitelist * Utilisation d'un fichier dédié .local pour fail2ban * Reformulation + linter markdown + typos * Reformulation + typos * Add "whitelist" howto + wording + typos Changes made following french page * Update fail2ban_fr.md Co-Authored-By: Plumf <45500657+Plumf@users.noreply.github.com> * Update fail2ban_fr.md Co-Authored-By: Plumf <45500657+Plumf@users.noreply.github.com> * Update fail2ban_fr.md Co-Authored-By: Plumf <45500657+Plumf@users.noreply.github.com> * Update fail2ban.md Co-Authored-By: Plumf <45500657+Plumf@users.noreply.github.com> * Update fail2ban.md Co-Authored-By: Plumf <45500657+Plumf@users.noreply.github.com> * Update fail2ban.md Co-Authored-By: Plumf <45500657+Plumf@users.noreply.github.com> * Update fail2ban_fr.md Co-Authored-By: Plumf <45500657+Plumf@users.noreply.github.com> * Update fail2ban_fr.md Co-Authored-By: Plumf <45500657+Plumf@users.noreply.github.com> * Change location of "whitelist" config file from 'jail.local' to 'jail.d/yunohost-whitelist.conf' * remove deepl reference * add missing slashs * fix typo in file name * Simplify wording Co-authored-by: Yunobot <simone@yunohost.org> Co-authored-by: Gofannon <17145502+Gofannon@users.noreply.github.com> Co-authored-by: Plumf <45500657+Plumf@users.noreply.github.com>
This commit is contained in:
YunoHost Bot
GitHub
parent
c048eea1c7
commit
06249c5012
2 changed files with 83 additions and 17 deletions
51
fail2ban.md
51
fail2ban.md
|
|
@ -1,17 +1,17 @@
|
|||
# Fail2ban
|
||||
|
||||
Fail2Ban is an intrusion prevention software that protects computer servers from brute-force attacks. It monitors some log files and will ban IP addresses that shows brute-force-like behavior.
|
||||
**Fail2Ban** is an intrusion prevention software that protects computer servers against brute-force attacks. It monitors certain logs and will ban IP addresses that show brute-force-like behavior.
|
||||
|
||||
In particular, Fail2ban monitors SSH connection attempts. After 5 failed login attempts on SSH, Fail2ban will ban the corresponding IP address from connecting through SSH for 10 minutes. If this IP is found to recidive several times, it might get ban for a week.
|
||||
In particular, **Fail2ban** monitors `SSH` connection attempts. After 5 failed SSH connection attempts, Fail2ban will ban the IP address from connecting via SSH for 10 minutes. If this address fails several times, it might get banned for a week.
|
||||
|
||||
## Unban an IP
|
||||
|
||||
To unban an IP from fail2ban, you first need to access your server by some mean (e.g. from another IP by the one being banned).
|
||||
To unblock an IP address, you must first access your server by some means (for example from another IP or from another internet connection than the banned one).
|
||||
|
||||
Then look at fail2ban's log to identify in which jail the IP was put :
|
||||
Then, look at the **fail2ban's log** to identify in which `jail` the IP has been banned:
|
||||
|
||||
```bash
|
||||
$ tail /var/log/fail2ban.log
|
||||
sudo tail /var/log/fail2ban.log
|
||||
2019-01-07 16:24:47 fail2ban.filter [1837]: INFO [sshd] Found 11.22.33.44
|
||||
2019-01-07 16:24:49 fail2ban.filter [1837]: INFO [sshd] Found 11.22.33.44
|
||||
2019-01-07 16:24:51 fail2ban.filter [1837]: INFO [sshd] Found 11.22.33.44
|
||||
|
|
@ -21,12 +21,45 @@ $ tail /var/log/fail2ban.log
|
|||
2019-01-07 16:24:57 fail2ban.filter [1837]: NOTICE [recidive] Ban 11.22.33.44
|
||||
```
|
||||
|
||||
Here, the IP `11.22.33.44` was banned in the `sshd` and `recidive` jails.
|
||||
Here, the `11.22.33.44` IP has been banned in the `sshd` and `recidive` jails.
|
||||
|
||||
Then unban the IP with the following commands :
|
||||
Then deban the IP address with the following commands:
|
||||
|
||||
```bash
|
||||
$ fail2ban-client set sshd unbanip 11.22.33.44
|
||||
$ fail2ban-client set recidive unbanip 11.22.33.44
|
||||
sudo fail2ban-client set sshd unbanip 11.22.33.44
|
||||
sudo fail2ban-client set recidive unbanip 11.22.33.44
|
||||
```
|
||||
|
||||
## Whitelist an IP
|
||||
|
||||
If you don't want a "legitimate" IP address to be blocked by **YunoHost** anymore, then you have to fill it in the whitelist of the `jail` configuration file.
|
||||
|
||||
When updating the **Fail2ban** software, the original `/etc/fail2ban/jail.conf` file is overwritten. So it is on a new dedicated file that we will store the changes. They will thus be preserved over time.
|
||||
|
||||
1. Start by creating the new jail configuration file which will be called `yunohost-whitelist.conf`:
|
||||
|
||||
```bash
|
||||
sudo touch /etc/fail2ban/jail.d/yunohost-whitelist.conf
|
||||
```
|
||||
|
||||
2. Edit this new file with your favorite editor:
|
||||
|
||||
```bash
|
||||
sudo nano /etc/fail2ban/jail.d/yunohost-whitelist.conf
|
||||
```
|
||||
|
||||
3. Paste the following content into the file and adapt the IP address `XXX.XXX.XXX.XXX` :
|
||||
|
||||
```bash
|
||||
[DEFAULT]
|
||||
|
||||
ignoreip = 127.0.0.1/8 XXX.XXX.XXX.XXX #<= the IP address (you can put more than one, separated by a space) that you want to whitelist
|
||||
```
|
||||
|
||||
4. Save the file and reload the fail2ban configuration:
|
||||
|
||||
```bash
|
||||
sudo fail2ban-client reload
|
||||
```
|
||||
|
||||
Congratulations, no more risks of banning yourself from your own YunoHost server!
|
||||
|
|
|
|||
|
|
@ -1,17 +1,17 @@
|
|||
# Fail2ban
|
||||
|
||||
Fail2Ban est un logiciel de prévention des intrusions qui protège les serveurs informatiques contre les attaques de brute-force. Il surveille certains journaux et bannira les adresses IP qui montrent un comportement de brute-forcing.
|
||||
**Fail2Ban** est un logiciel de prévention des intrusions qui protège les serveurs informatiques contre les attaques de brute-force. Il surveille certains journaux et bannira les adresses IP qui montrent un comportement de brute-forcing.
|
||||
|
||||
En particulier, Fail2ban surveille les tentatives de connexion SSH. Après 5 tentatives de connexion échouées sur SSH, Fail2ban banniera l'IP de se connecter via SSH pendant 10 minutes. Si cette adresse récidive plusieurs fois, elle peut être bannie pendant une semaine.
|
||||
En particulier, **Fail2ban** surveille les tentatives de connexion `SSH`. Après 5 tentatives de connexion échouées sur SSH, Fail2ban banniera l'adresse IP de se connecter via SSH pendant 10 minutes. Si cette adresse récidive plusieurs fois, elle peut être bannie pendant une semaine.
|
||||
|
||||
## Débannir une IP
|
||||
|
||||
Pour débloquer une IP de fail2ban, vous devez d'abord accéder à votre serveur par un moyen quelconque (par exemple à partir d'une autre IP que celle bannie).
|
||||
Pour débloquer une addresse IP, vous devez d'abord accéder à votre serveur par un moyen quelconque (par exemple à partir d'une autre adresse IP ou d'une autre connexion internet que celle bannie).
|
||||
|
||||
Ensuite, regardez le journal de fail2ban pour identifier dans quelle 'prison' (jail) l'IP a été bannie :
|
||||
Ensuite, regardez le **journal de fail2ban** pour identifier dans quelle `prison` ou `jail` l'adresse IP a été bannie :
|
||||
|
||||
```bash
|
||||
$ tail /var/log/fail2ban.log
|
||||
sudo tail /var/log/fail2ban.log
|
||||
2019-01-07 16:24:47 fail2ban.filter [1837]: INFO [sshd] Found 11.22.33.44
|
||||
2019-01-07 16:24:49 fail2ban.filter [1837]: INFO [sshd] Found 11.22.33.44
|
||||
2019-01-07 16:24:51 fail2ban.filter [1837]: INFO [sshd] Found 11.22.33.44
|
||||
|
|
@ -23,10 +23,43 @@ $ tail /var/log/fail2ban.log
|
|||
|
||||
Ici, l'IP `11.22.33.44` a été bannie dans les jails `sshd` et `recidive`.
|
||||
|
||||
Puis débanissez l'IP avec les commandes suivantes :
|
||||
Puis débanissez l'adresse IP avec les commandes suivantes :
|
||||
|
||||
```bash
|
||||
$ fail2ban-client set sshd unbanip 11.22.33.44
|
||||
$ fail2ban-client set recidive unbanip 11.22.33.44
|
||||
sudo fail2ban-client set sshd unbanip 11.22.33.44
|
||||
sudo fail2ban-client set recidive unbanip 11.22.33.44
|
||||
```
|
||||
|
||||
## Passer une IP en liste blanche / whitelist
|
||||
|
||||
Si vous ne voulez plus qu'une adresse IP "légitime" soit bloquée par **YunoHost**, alors il faut la renseigner dans la liste blanche ou whitelist du fichier de configuration de la `prison`.
|
||||
|
||||
Lors d'une mise à jour du logiciel **Fail2ban**, le fichier d'origine `/etc/fail2ban/jail.conf` est écrasé. C'est donc dans un nouveau fichier que nous allons stocker les modifications. Elles seront ainsi conservées dans le temps.
|
||||
|
||||
1. Commencez par créer le nouveau fichier de configuration des prisons qui s’appelera `yunohost-whitelist.conf` :
|
||||
|
||||
```bash
|
||||
sudo touch /etc/fail2ban/jail.d/yunohost-whitelist.conf
|
||||
```
|
||||
|
||||
2. Éditez ce nouveau fichier avec votre éditeur préféré :
|
||||
|
||||
```bash
|
||||
sudo nano /etc/fail2ban/jail.d/yunohost-whitelist.conf
|
||||
```
|
||||
|
||||
3. Coller le contenu suivant dans le fichier et adapter l'adresse IP `XXX.XXX.XXX.XXX` :
|
||||
|
||||
```bash
|
||||
[DEFAULT]
|
||||
|
||||
ignoreip = 127.0.0.1/8 XXX.XXX.XXX.XXX #<= l'adresse IP (on peut en mettre plusieurs, séparées par un espace) que vous voulez passer en liste blanche / whitelist
|
||||
```
|
||||
|
||||
4. Sauvegardez le fichier et rechargez la configuration de fail2ban :
|
||||
|
||||
```bash
|
||||
sudo fail2ban-client reload
|
||||
```
|
||||
|
||||
Félicitations, plus de risques de se bannir de son propre serveur YunoHost!
|
||||
|
|
|
|||
Loading…
Reference in a new issue