Difference between revisions of "FAQ english"

From Fail2ban
Jump to: navigation, search
(Configuration)
(Undo revision 2361 by 121.52.49.218 (Talk))
Line 1: Line 1:
comment2
+
== '''Configuration''' ==
http://7.luvacuwi.com/jppe.html money cheats for need for speed
+
 
http://3.wesaxyum.com/z4wc1.html two weeks notice cast
+
=== What is the main configuration file for {{Fail2ban}}? ===
http://4.puhalaky.com/8td82j.html blue executive chair
+
 
http://1.safohesy.com/ws21.html thaiger room seattle wa
+
{{Fail2ban}} configuration process is rather simple. There is only one configuration file, where {{Fail2ban}} can be fully configured, this file is located at:
http://2.pumilanu.com/ykau5n7.html navy officer development
+
<tt>/etc/fail2ban/fail2ban.conf</tt>
http://7.luvacuwi.com/e0kngr0.html strawberry bananna smoothie recipes
+
 
http://7.puhalaky.com/1z0mzko.html diy summer houses
+
You are able to edit this file using any editor you want: vim, emacs, joe, ae...
http://7.gichuref.com/ql0s.html milton keynes hospital jobs
+
 
http://11.safohesy.com/p6nat6h.html the life of a high mass star
+
Configuration file must be edited by '''root'''.
http://7.luvacuwi.com/9o8x3cs.html 2nd grade lesson plans
+
 
http://6.vohereco.com/pxlko.html weather of michigan
+
=== How can {{Fail2ban}} be configured? ===
http://6.safohesy.com/tpzdm8.html weather march 2 2008
+
 
http://10.luvacuwi.com/9rj8.html chickasaw native americans
+
This step is fully detailed at [[HOWTOs]] chapter
http://10.luvacuwi.com/9q87v7.html cromarty post office
+
 
http://11.safohesy.com/e4tvirr.html mach7 serial number
+
=== Can I exclude failed logins for selected users from resulting in a ban? ===
http://4.mydywudy.com/6pfgre.html talan from laguna beach
+
 
http://8.bylyvupa.com/af0w8an.html weather lascassas tn 37085
+
(I don't know, perhaps that's a feature request.)
http://1.nocowodi.com/i687vz7.html dragonball z budokai 2 wii cheats
+
 
http://5.wesaxyum.com/gr7u2h.html hairdressers portsmouth uk
+
Edit: Cause fail2ban didn't know anything of the username format logged in the specific file(s) (if usernames even get logged), it is only possible to exclude selected users in the regex of the service section.
http://8.luvacuwi.com/ldc5y.html pistol by cybergun
+
http://3.luvacuwi.com/0yod50p.html officejet j6400 ink
+
http://4.puhalaky.com/e6m9pkk.html plan a route by train
+
http://9.luvacuwi.com/0ny2y.html p5pe vm bios update
+
http://9.luvacuwi.com/rrhx.html find a job in the usa
+
http://2.mydywudy.com/iykuue1.html get update offline
+
http://11.safohesy.com/fswgj6c.html rustic family rooms
+
http://10.pumilanu.com/7lzqds.html nhl 2008 playoffs dates
+
http://4.vohereco.com/fj6m.html japanese traditional recipes
+
http://10.nocowodi.com/lw0w.html recipe with applesauce
+
http://9.wesaxyum.com/nut0fr.html service jobs dallas tx
+
http://4.gichuref.com/yxy1o.html tiesto club life 48
+
http://6.pumilanu.com/tdqan7.html law office of harris zide
+
http://9.puhalaky.com/3mjrens.html planted aquarium forums
+
http://6.pumilanu.com/anpd.html homedics shiatsu massage chair pad
+
http://2.mydywudy.com/38s2.html gunners by robert westall
+
http://9.luvacuwi.com/r9llpk1.html naruto pictures and videos
+
http://11.gichuref.com/qcrgan.html departementale de l agriculture
+
http://7.pumilanu.com/h25kil.html of rachel carsons life
+
http://1.gichuref.com/l1vndp.html air tickets cheapest
+
http://9.nocowodi.com/gixl.html understanding earth grotzinger used
+
http://10.nocowodi.com/3ozo9.html a walk down abbey road
+
http://5.pumilanu.com/idta3ey.html soap world magazine
+
http://5.luvacuwi.com/jxf3n3.html ciencia en la segunda
+
http://10.pumilanu.com/c54lt.html offices to let in exeter
+
http://4.nocowodi.com/ms5r.html acdsee 10 0 238 en crack
+
http://11.puhalaky.com/o9iw12.html american tourist travel
+
http://4.luvacuwi.com/wl4iz.html goth halloween ideas
+
http://2.safohesy.com/rjr9qk.html amatuer picture posting
+
http://8.gichuref.com/afhvi.html onion gratin recipe
+
http://2.mydywudy.com/dqmh3.html lalbaugcha raja wallpaper
+
http://6.bylyvupa.com/e6ib4hg.html banana yogurt recipe
+
http://11.vohereco.com/qb1w.html rosie odonnel craft book
+
http://1.puhalaky.com/fcxr2of.html buy dolce and gabbana watches
+
http://11.vohereco.com/89w2e.html weather in dauphin
+
http://5.luvacuwi.com/m6eos.html how to get even with a cheater
+
http://11.gichuref.com/n6l7v.html office season 3 hd
+
http://11.gichuref.com/7njfhs.html adamo ruggiero pictures
+
http://4.puhalaky.com/r8pr.html pictures of injured cats
+
http://7.luvacuwi.com/eph4.html names with scottish
+
http://10.wesaxyum.com/i8mrl.html secretarial job in london
+
http://7.pumilanu.com/kms4.html everybodies working for the weekend
+
http://11.gichuref.com/spwame4.html picture of palaces
+
http://5.bylyvupa.com/bljio.html biore hair minimizing
+
http://4.puhalaky.com/66rmc.html breuners arizona kids room
+
http://2.puhalaky.com/gn11ay5.html african road signs
+
http://5.pumilanu.com/qaono6.html kaiser hospitals jobs
+
http://4.puhalaky.com/cano5uv.html life of a black man
+
http://3.mydywudy.com/2z80.html used boat parts california
+
http://2.mydywudy.com/2uum.html cristiano ronaldo wallpaper 2008
+
http://6.pumilanu.com/0low.html broadcomm wireless lan
+
http://2.safohesy.com/dogf2k.html working tax credits backdated
+
http://4.bylyvupa.com/s774r.html do bookkeepers make in
+
http://3.wesaxyum.com/z7qgg4c.html troll name generator
+
http://3.bylyvupa.com/3kcdh.html nottingham university reading week
+
http://6.gichuref.com/zy08hkf.html pictures of black males
+
http://6.wesaxyum.com/ngoz.html most highly paid jobs
+
http://4.wesaxyum.com/76w9pv.html free private chatrooms
+
http://3.puhalaky.com/37dyv.html crocodile pictures for children
+
http://6.bylyvupa.com/dqrjlpx.html arm chair general magazine
+
http://2.vohereco.com/q8flml.html morphgear 2.4 0.9 keygen
+
http://3.puhalaky.com/ni430nw.html broadcast 2000 video
+
http://7.nocowodi.com/yd3bj.html ultrasound 18 weeks
+
http://4.vohereco.com/zf0s.html weather agay france
+
http://9.wesaxyum.com/z1kwlc.html officer krupke song
+
http://10.gichuref.com/5bqjx.html bill o reilly new book
+
http://9.luvacuwi.com/cwcxri1.html microsoft office x service pack
+
http://5.nocowodi.com/gje6d.html supper cookbook recipes
+
http://9.bylyvupa.com/bua0.html barrys tickets los angeles
+
http://10.bylyvupa.com/62vz1jq.html gowan dun laoghaire
+
http://4.nocowodi.com/vc1qi.html used to love jay sean
+
http://5.luvacuwi.com/ihf7.html rj11 to serial adapter
+
http://1.bylyvupa.com/ooyi.html hair color magazine
+
http://9.bylyvupa.com/cnz8b.html cuban cigars in america
+
http://2.mydywudy.com/8o2tg.html fatesoft free picture finder v3 16
+
http://1.puhalaky.com/iziwq0.html watch sex and the city season 2
+
http://8.luvacuwi.com/g5bc.html plastic side chair
+
http://5.safohesy.com/z8hm7o.html off road buggy forum
+
http://7.bylyvupa.com/v60rxr.html jobs in tumwater washington
+
http://5.mydywudy.com/ghefggl.html pictures of ann pflug
+
http://2.mydywudy.com/s05kg5.html free naked wallpapers
+
http://6.safohesy.com/m5i16.html how much money do dog groomers make
+
http://10.mydywudy.com/x6y66.html sister machine gun sins of the flesh
+
http://9.gichuref.com/y55tq.html world book 2007 encyclopedia
+
http://6.mydywudy.com/mk9j4f.html fair and weathered
+
http://5.mydywudy.com/wp6by.html the smithsonian folklife festival
+
http://1.gichuref.com/64ckc.html mechanical transplanter company
+
http://9.gichuref.com/ds0pgqe.html security jobs in france
+
http://11.wesaxyum.com/kivrx.html walkie talkie wristwatch
+
http://3.puhalaky.com/qavr3it.html iso hair straightner
+
http://7.luvacuwi.com/hjxfxb6.html american english people
+
http://2.gichuref.com/pduajw.html first date tips for teens
+
http://8.luvacuwi.com/wko4.html chelsea arsenal tickets
+
http://8.luvacuwi.com/lfzc.html ducati 999s wallpaper
+
http://11.bylyvupa.com/9zb68.html farm oshu gun crystal
+
http://7.bylyvupa.com/nqaio.html 1345 avenue of the americas ny ny
+
http://1.safohesy.com/483l.html fear persus mandate system
+
http://2.bylyvupa.com/38gqkf.html marylin monroe real name
+
http://3.luvacuwi.com/1d2wq.html minister for planning
+
http://6.nocowodi.com/a5fyce.html san diego charger tickets
+
http://4.puhalaky.com/4xeo.html unreal tournament frag
+
  
 
== '''Security''' ==
 
== '''Security''' ==

Revision as of 17:12, 24 February 2009

Configuration

What is the main configuration file for Fail2ban?

Fail2ban configuration process is rather simple. There is only one configuration file, where Fail2ban can be fully configured, this file is located at: /etc/fail2ban/fail2ban.conf

You are able to edit this file using any editor you want: vim, emacs, joe, ae...

Configuration file must be edited by root.

How can Fail2ban be configured?

This step is fully detailed at HOWTOs chapter

Can I exclude failed logins for selected users from resulting in a ban?

(I don't know, perhaps that's a feature request.)

Edit: Cause fail2ban didn't know anything of the username format logged in the specific file(s) (if usernames even get logged), it is only possible to exclude selected users in the regex of the service section.

Security

What do I have to consider when using Fail2ban?

Especially on systems which provide SSH/CGI/PHP services to unknown users, it is possible to block other users from ssh and probably other services. How would a user do so? The user could issue:

logger -p auth.warning -t 'sshd[123]' 'Illegal user user1 from 1.2.3.4'

Or the malicious user may write via PHP's openlog()/syslog() to syslog.

Solution #1: This security hazard can be handled via ownership/permissions of /dev/log, which allows logging to all the users by default. Just add a group log, add all daemons and root to that group and be happy.

What about log injection?

Fail2ban parses log files of other services and thus it can be vulnerable to log injection. Daniel B. Cid describes this kind of issues in Attacking Log analysis tools. I strongly suggest that you read this article. We will always try to provide safe configuration files. However, you can use fail2ban-regex to test your configuration files against forged log lines.

Troubleshooting

I have Postfix on my system but no "mail" command. How can I get e-mail notifications?

As of version 0.8.1, "mail" actions are deprecated. Please use the "sendmail" ones instead. E.g. sendmail-whois instead of mail-whois in your jail.[conf|local].

You probably have the sendmail command. Copy /etc/fail2ban/action.d/mail-whois.conf to /etc/fail2ban/action.d/mail-whois.local, edit this file and replace mail with sendmail. Here is an example:

actionban = echo -en "From:root <fail2ban>
            To: <dest>
            Subject: [Fail2Ban] <name>: banned <ip>
            Hi,\n
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n\n
            Here are more information about <ip>:\n
            `whois <ip>`\n
            Regards,\n
            Fail2Ban"|sendmail -t  

mail.conf can be modified too.

Why do my CVS users using SSH getting blocked?

If you are using the Eclipse CVS integration with SSH, then each access of the CVS results in a failed access before a valid one is done. As a consequence your CVS users get banned from time to time.

I get the error "Please check the format and your locale settings"

The error looks like this:

ERROR: time data did not match format: data=Mar 21 10:00:50 fmt=%b %d %H:%M:%S
ERROR: Please check the format and your locale settings.

This is a known bug. Since 0.6.1, Fail2ban uses your locale settings for date and time format. However, some daemons do not take care of locale and write their log messages using the POSIX standard. Please look at this bug for more details.

You can try to override the LANG variable:

# LANG=en_US /etc/init.d/fail2ban restart

You can get all the available locale with:

# locale -a

How do I increase verbosity?

In order to increase the verbosity of Fail2ban, use the command line option -vvv for fail2ban-client and fail2ban (only for 0.6.x). Set loglevel to 4 in /etc/fail2ban/fail2ban.conf (only for > 0.6.x).

Fail2ban is running but not banning SSH bruteforce

NB:This example is based on a Debian system, but can be easily done on any distro.

The package is well installed:

# dpkg -l |grep fail                                               
ii  fail2ban                      0.8.1-2                         bans IPs that 
cause multiple authentication

The service is running:

# /etc/init.d/fail2ban status                                      
Status of authentication failure monitor: fail2ban is running

SSH jail is set up and ready:

# fail2ban-client status                                           
Status                                                                          
|- Number of jail:      1                                                       
`- Jail list:           ssh

SSH bruteforce logs are identified by fail2ban:

# fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
....
Success, the total number of match is 30

So, check that all your logs are synchronized: all logs files (auth.log, syslog,..) must use the same time reference (if your server is not very busy, there will probably be an important difference between the output of [1]date command and the last event logged in syslog. You can force to generate a log in syslog using the logger command and check then with the output of date command)

# date                                                             
Wed Nov 28 13:49:02 CET 2007                                                    
# tail -2 /var/log/auth.log                                        
Nov 28 13:39:12 <SERVERNAME> sudo: pam_unix(sudo:session): session opened for user roo
t by <user>(uid=0)                                                              
Nov 28 13:39:12 <SERVERNAME> sudo: pam_unix(sudo:session): session closed for user roo
t

If time reference is not the same everywhere, then fail2ban won't ban any IP!