Fail2ban funktioniert nicht

mzips · Jul 12th 2015

Hallo und Guten Tag!

Habe das gefühl das Fail2ban nicht funktioniert, habe eine Clean Install und Fail2ban laut Wiki Installiert.

Hier mal paar auszüge:

auth.log

Jul 12 06:33:48 sv01 postfix/smtpd[16112]: commit transaction
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin Parse the username diablo
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin try and connect to a host
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin trying to open db 'imscp' on host '127.0.0.1:3306'
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin Parse the username diablo
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin try and connect to a host
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin trying to open db 'imscp' on host '127.0.0.1:3306'
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: begin transaction
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin create statement from userPassword diablo sv01.domain.de
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin doing query SELECT mail_pass FROM mail_users WHERE mail_addr$
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin: no result found
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin create statement from cmusaslsecretPLAIN diablo sv01.domain.de
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin doing query SELECT mail_pass FROM mail_users WHERE mail_addr$
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin: no result found
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: commit transaction
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin Parse the username diablo
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin try and connect to a host
Jul 12 06:33:48 sv01 postfix/smtpd[16112]: sql plugin trying to open db 'imscp' on host '127.0.0.1:3306'
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql auxprop plugin using mysql engine
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin Parse the username diamond
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin try and connect to a host
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin trying to open db 'imscp' on host '127.0.0.1:3306'
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: begin transaction
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin create statement from userPassword diamond sv01.domain.de
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin doing query SELECT mail_pass FROM mail_users WHERE mail_addr$
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin: no result found
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: commit transaction
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin Parse the username diamond
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin try and connect to a host
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin trying to open db 'imscp' on host '127.0.0.1:3306'
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin Parse the username diamond
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin try and connect to a host
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin trying to open db 'imscp' on host '127.0.0.1:3306'
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: begin transaction
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin create statement from userPassword diamond sv01.domain.de
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin doing query SELECT mail_pass FROM mail_users WHERE mail_addr$
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin: no result found
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin create statement from cmusaslsecretPLAIN diamond sv01.mzips.$
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin doing query SELECT mail_pass FROM mail_users WHERE mail_addr$
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin: no result found
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: commit transaction
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin Parse the username diamond
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin try and connect to a host
Jul 12 06:57:07 sv01 postfix/smtpd[16573]: sql plugin trying to open db 'imscp' on host '127.0.0.1:3306'
Jul 12 07:20:16 sv01 postfix/smtpd[17211]: sql auxprop plugin using mysql engine
Jul 12 07:20:16 sv01 postfix/smtpd[17211]: sql plugin Parse the username doctor
Jul 12 07:20:16 sv01 postfix/smtpd[17211]: sql plugin try and connect to a host
Jul 12 07:20:16 sv01 postfix/smtpd[17211]: sql plugin trying to open db 'imscp' on host '127.0.0.1:3306'
Jul 12 07:20:16 sv01 postfix/smtpd[17211]: begin transaction

fail2ban.log

Display Spoiler

service fail2ban Status

Display Spoiler

Sehe ich das nun richtig das fail2ban nicht wirklich läuft ? wäre dankbar über hilfe bzw Informationen.

LG

**Cool** · Jul 12th 2015

die fehlermeldungen sagen ja schon alles!

wie sieht deine: jail.conf
aus?

mzips · Jul 12th 2015

so:

Display Spoiler

# Fail2Ban configuration file.
#
# This file was composed for Debian systems from the original one
# provided now under /usr/share/doc/fail2ban/examples/jail.conf
# for additional examples.
#
# Author: Yaroslav O. Halchenko <debian@onerussian.com>
#
# $Revision$
#
# The DEFAULT allows a global definition of the options. They can be overridden
# in each jail afterwards.
[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1/8
findtime = 600
bantime = 600
maxretry = 3
# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto".
# yoh: For some reason Debian shipped python-gamin didn't work as expected
# This issue left ToDo, so polling is default backend for now
backend = auto
#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = root@localhost
#
# ACTIONS
#
# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define
# action_* variables. Can be overridden globally or per
# section within jail.local file
banaction = iptables-multiport
# email action. Since 0.8.1 upstream fail2ban uses sendmail
# MTA for the mailing. Change mta configuration parameter to mail
# if you want to revert to conventional 'mail'.
mta = sendmail
# Default protocol
protocol = tcp
# Specify chain where jumps would need to be added in iptables-* actions
chain = INPUT
#
# Action shortcuts. To be used to define action parameter
# The simplest action to take: ban only
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
# ban & send an e-mail with whois report to the destemail.
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
%(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]
# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
%(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
# Choose default action. To change, just override value of 'action' with the
# interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local
# globally (section [DEFAULT]) or per specific section
action = %(action_)s
#
# JAILS
#
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 6
[ssh-ddos]
enabled = true
port = ssh
filter = sshd-ddos
logpath = /var/log/auth.log
maxretry = 6
#
# HTTP servers i-MSCP customer sites
#
[apache]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache2/*/error.log
maxretry = 6
# default action is now multiport, so apache-multiport jail was left
# for compatibility with previous (<0.7.6-2) releases
[apache-multiport]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache2/*/error.log
maxretry = 6
[apache-noscript]
enabled = true
port = http,https
filter = apache-noscript
logpath = /var/log/apache2/*/error.log
maxretry = 6
[apache-overflows]
enabled = true
port = http,https
filter = apache-overflows
logpath = /var/log/apache2/*/error.log
maxretry = 2

#
# HTTP servers i-MSCP Control Panel
#
[imscp]
enabled = true
port = http,https
filter = nginx-auth
logpath = /var/log/nginx/*error.log
maxretry = 6
# default action is now multiport, so apache-multiport jail was left
# for compatibility with previous (<0.7.6-2) releases
[imscp-multiport]
enabled = true
port = http,https
filter = nginx-auth
logpath = /var/log/nginx/*error.log
maxretry = 6
[imscp-noscript]
enabled = true
port = http,https
filter = nginx-noscript
logpath = /var/log/nginx/*error.log
maxretry = 6
[imscp-overflows]
enabled = true
port = http,https
filter = nginx-overflows
logpath = /var/log/nginx/*error.log
maxretry = 2

#
# FTP servers
#
[proftpd]
enabled = true
port = ftp,ftp-data,ftps,ftps-data
filter = proftpd
logpath = /var/log/auth.log
maxretry = 6

#
# Mail servers
#
#
# Mail servers authenticators: might be used for smtp,pop3,imap servers, so
# all relevant ports get banned
#
[dovecot]
enabled = true
port = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter = dovecot
logpath = /var/log/mail.log
maxretry = 8

#
# Webmail
#
#
# Webmail authenticators: Don't forget to comment the unused webmailers out
#
[roundcube]
enabled = true
port = http,https
filter = roundcube
logpath = /var/www/imscp/gui/public/tools/webmail/logs/errors
maxretry = 6
[rainloop]
enabled = true
port = http,https
filter = rainloop
logpath = /var/log/nginx/*access.log
maxretry = 6

**Cool** · Jul 12th 2015

ich kann meine zeit besser verschwenden als dieses unformatierte zeugs durchzugehen.

deaktiviere alles in fail2ban und aktiviere dann eins nach dem anderen was du brauchst.
mach jeweils einen restart von fail2ban und schaue wo es dann aussteigt.

mzips · Jul 12th 2015

Es ist ja genau der Code der in der Wiki steht denke mal das die Wiki in dem Bereich noch nicht up2date ist gerade weil der nginx als frontend läuft.

mafioso · Jul 12th 2015

Hast du auch den Roundcube Filter hinzugefügt?

mzips · Jul 12th 2015

Ja habe ich und das Problem liegt daran das keine Filter für nginx vorhanden sind es fehlen:

nginx-auth.conf
nginx-noscript.conf
nginx-Overflows.conf

habe jetzt mal folgendes versucht:

in der jail.local die filter nginx-* durch apache-* ersetzt.

und:

touch /var/www/imscp/gui/public/tools/webmail/logs/errors

chown vu2000:vu2000 /var/www/imscp/gui/public/tools/webmail/logs/Errors

zumindest gibt es keine fehler mehr:

service fail2ban Status:

● fail2ban.service - LSB: Start/stop fail2ban

Loaded: loaded (/etc/init.d/fail2ban)

Active: active (running) since So 2015-07-12 13:06:22 CEST; 3s ago

Process: 24631 ExecStop=/etc/init.d/fail2ban stop (code=exited, status=0/SUCCESS)

Process: 24659 ExecStart=/etc/init.d/fail2ban start (code=exited, status=0/SUCCESS)

CGroup: /system.slice/fail2ban.service
└─24669 /usr/bin/python /usr/bin/fail2ban-server -b -s /var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail2ban.pid

schauen wir mal ob es funktioniert

mzips · Jul 12th 2015

Kann es durchaus sein das alle die Fail2Ban wie in der Wiki beschrieben Installiert haben überhaupt kein laufendes Fail2Ban haben ?

mafioso · Jul 12th 2015

Welches OS verwendest du? Evt werden die nginx-Filter z.b. mit einer anderen Version mitgeliefert...

PS: Fail2Ban hat nichts mit i-MSCP zu tun, die wichtigsten Einträge befinden sich im Wiki, sollten paar Filter oder Sonstiges fehlen, können diese selber eingetragen werden.

mzips · Jul 13th 2015

Ich benutze debian 8.1
Ich weiß doch das fail2ban nichts mit imscp zu tun hat.

Gesendet von meinem DARKSIDE mit Tapatalk

Fail2ban funktioniert nicht

Share

Daily visitors