Fail2ban/nextcloud - Revision history

Setvadmin at 18:06, 26 September 2016

2016-09-26T18:06:40Z

Setvadmin at 18:05, 26 September 2016

2016-09-26T18:05:24Z

Setvadmin: /* Add nextcloud.conf to filter.d */

2016-09-26T18:04:48Z

‎Add nextcloud.conf to filter.d

Setvadmin at 18:04, 26 September 2016

2016-09-26T18:04:27Z

Setvadmin at 18:03, 26 September 2016

2016-09-26T18:03:35Z

Setvadmin at 17:58, 26 September 2016

2016-09-26T17:58:47Z

Setvadmin at 17:44, 26 September 2016

2016-09-26T17:44:44Z

Setvadmin: Created page with "This quick guide is designed to show you how to enable Fail2Ban on the NextCloud jail. == Set Up IPFW == FreeNAS' jail uses IPFW as the basic firewall. Add this line in:
2016-09-26T17:39:54Z

Created page with "This quick guide is designed to show you how to enable Fail2Ban on the NextCloud jail. == Set Up IPFW == FreeNAS' jail uses IPFW as the basic firewall. Add this line in: <co..."

New page
This quick guide is designed to show you how to enable Fail2Ban on the NextCloud jail.

== Set Up IPFW ==
FreeNAS' jail uses IPFW as the basic firewall.

Add this line in: <code>/etc/rc.conf</code>

Code:
firewall_enable="YES"
firewall_script="/usr/local/etc/ipfw.rules"
fail2ban_enable="YES"
MAKE the ipfw.rules file:

<code>/usr/local/etc/ipfw.rules</code>

edit the ipfw rules file /usr/local/etc/ipfw.rules

Code:

IPF="ipfw -q add"
ipfw -q -f flush
#loopback
$IPF 10 allow all from any to any via lo0
$IPF 20 deny all from any to 127.0.0.0/8
$IPF 30 deny all from 127.0.0.0/8 to any
$IPF 40 deny tcp from any to any frag
# statefull
$IPF 50 check-state
$IPF 60 allow tcp from any to any established
$IPF 70 allow all from any to any out keep-state
$IPF 80 allow icmp from any to any
#firewall rule used by Fail2Ban to block traffic
$IPF 90 deny all from 'table(1)' to any
# open port DNS (53)
# http (80), https (443) etc
$IPF 150 allow tcp from any to any 443 in
$IPF 160 allow tcp from any to any 443 out
$IPF 170 allow udp from any to any 53 in
$IPF 175 allow tcp from any to any 53 in
$IPF 180 allow udp from any to any 53 out
$IPF 185 allow tcp from any to any 53 out
$IPF 200 allow tcp from any to any 80 in
$IPF 210 allow tcp from any to any 80 out
$IPF 220 allow tcp from any to any 22 in
$IPF 230 allow tcp from any to any 22 out
# deny and log everything
$IPF 500 deny log all from any to any

← Older revision		Revision as of 18:06, 26 September 2016
Line 1:		Line 1:
−	This quick guide is designed to show you how to enable Fail2Ban on the NextCloud jail.	+	This quick guide is designed to show you how to enable Fail2Ban on the NextCloud jail. <ref>https://forums.freenas.org/index.php?threads/install-and-setup-fail2ban-on-owncloud-portsjail.19216/</ref><ref>https://forums.freebsd.org/threads/23734/</ref><ref>https://forum.owncloud.org/viewtopic.php?t=28678</ref>

	== Set Up IPFW ==		== Set Up IPFW ==

← Older revision		Revision as of 18:05, 26 September 2016
Line 166:		Line 166:

	Any errors, check <code>/var/log/fail2ban.log</code> for further info, and google what you find.		Any errors, check <code>/var/log/fail2ban.log</code> for further info, and google what you find.
		+	[[Category:SETV Guides]]

@@ Line 91: / Line 91: @@
 <code> nano nextcloud.conf</code>
   [Definition]
-  <code>failregex={"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)","level":2,"time":".*"}</code>
+  failregex={"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)","level":2,"time":".*"}
   ignoreregex =
 ''SAVE''

@@ Line 91: / Line 91: @@
 <code> nano nextcloud.conf</code>
   [Definition]
-  failregex={"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)","level":2,"time":".*"}
+  <code>failregex={"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)","level":2,"time":".*"}</code>
   ignoreregex =
 ''SAVE''

@@ Line 49: / Line 49: @@
   <nowiki>#</nowiki> deny and log everything
   $IPF 500 deny log all from any to any
-SAVE
+''SAVE''
 == Set Up Fail2Ban ==
@@ Line 60: / Line 60: @@
   cp jail.conf jail.local
-Edit jail.local
+==== Edit jail.local ====
 Insert at very bottom:
@@ Line 71: / Line 70: @@
   port = 80,443
   protocol = tcp
-SAVE
+''SAVE''
 Now we need to enable SSH Fail2Ban
 <code>cd /usr/local/etc/fail2ban/jail.d</code>
@@ Line 83: / Line 84: @@
   ignoreip = [insert SSD net IPs]
   maxretry = 3
-SAVE
+''SAVE''
 <code>cd /usr/loca/etc/fail2ban/filter.d</code>
 <code> nano nextcloud.conf</code>
   [Definition]
   failregex={"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)","level":2,"time":".*"}
   ignoreregex =
-SAVE
+''SAVE''
 <code>cd /usr/local/etc/fail2ban/action.d</code>
   cp /usr/local/etc/fail2ban/action.d/ipfw.conf /usr/local/etc/fail2ban/action.d/ipfw-nextcloud.conf
@@ Line 95: / Line 102: @@
 in each new *.conf file
 FIND:
 <code>actionban =</code>
 ADD AFTER '=' (replacing anything already there)
 <code>ipfw table 1 add <ip></code>
-FIND:
+'''FIND:'''
 <code>actionunban =</code>
 ADD AFTER '=' (replacing anything already there)
 <code>ipfw table 1 delete <ip></code>
 Lastly, enable SSH and Nextcloud logging:
@@ Line 114: / Line 130: @@
 Change:
   # Logging
-  # obsoletes QuietMode and FascistLogging
+  <nowiki>#</nowiki> obsoletes QuietMode and FascistLogging
-  # SyslogFacility AUTH
+  <nowiki>#</nowiki> SyslogFacility AUTH
-  # LogLevel INFO
+  <nowiki>#</nowiki> LogLevel INFO
 TO:
@@ Line 123: / Line 139: @@
   SyslogFacility AUTH
   LogLevel INFO
-SAVE
+''SAVE''
 <code> cd /usr/local/www/apache24/data/nextcloud/config</code>
 <code> nano config.php </code>
 FIND:
 <code> 'logtimezone' </code>
 ABOVE THAT LINE ADD:
 <code>  'log_authfailip' => true, </code>
 SAVE
-Restart services
+== Restart services ==
   service apache24 restart
   service sshd restart

@@ Line 4: / Line 4: @@
 FreeNAS' jail uses IPFW as the basic firewall.
-Add this line in: <code>/etc/rc.conf</code>
+Add these lines at the bottom of: <code>/etc/rc.conf</code>
 Code:
@@ Line 10: / Line 10: @@
   firewall_script="/usr/local/etc/ipfw.rules"
   fail2ban_enable="YES"
 MAKE the ipfw.rules file:
@@ Line 47: / Line 49: @@
   <nowiki>#</nowiki> deny and log everything
   $IPF 500 deny log all from any to any
+SAVE
 == Set Up Fail2Ban ==
@@ Line 69: / Line 71: @@
   port = 80,443
   protocol = tcp

@@ Line 14: / Line 14: @@
 <code>/usr/local/etc/ipfw.rules</code>
-edit the ipfw rules file /usr/local/etc/ipfw.rules
+=== Edit IPFW Rules ===
 Code:
@@ Line 20: / Line 21: @@
   IPF="ipfw -q add"
   ipfw -q -f flush
-  #loopback
+  <nowiki>#</nowiki>loopback
   $IPF 10 allow all from any to any via lo0
   $IPF 20 deny all from any to 127.0.0.0/8
   $IPF 30 deny all from 127.0.0.0/8 to any
   $IPF 40 deny tcp from any to any frag
-  # statefull
+  <nowiki>#</nowiki> statefull
   $IPF 50 check-state
   $IPF 60 allow tcp from any to any established
   $IPF 70 allow all from any to any out keep-state
   $IPF 80 allow icmp from any to any
-  #firewall rule used by Fail2Ban to block traffic
+  <nowiki>#</nowiki>firewall rule used by Fail2Ban to block traffic
   $IPF 90 deny all from 'table(1)' to any
-  # open port DNS (53)
+  <nowiki>#</nowiki> open port DNS (53)
-  # http (80), https (443) etc
+  <nowiki>#</nowiki> http (80), https (443) etc
   $IPF 150 allow tcp from any to any 443 in
   $IPF 160 allow tcp from any to any 443 out
@@ Line 44: / Line 45: @@
   $IPF 220 allow tcp from any to any 22 in
   $IPF 230 allow tcp from any to any 22 out
-  # deny and log everything
+  <nowiki>#</nowiki> deny and log everything
   $IPF 500 deny log all from any to any