Difference between revisions of "Fail2ban/nextcloud"
From SETV Springfield Technical Wiki
(Created page with "This quick guide is designed to show you how to enable Fail2Ban on the NextCloud jail. == Set Up IPFW == FreeNAS' jail uses IPFW as the basic firewall. Add this line in: <co...") |
m |
||
| Line 14: | Line 14: | ||
<code>/usr/local/etc/ipfw.rules</code> | <code>/usr/local/etc/ipfw.rules</code> | ||
| − | + | === Edit IPFW Rules === | |
| + | Edit rules file <code>/usr/local/etc/ipfw.rules</code> | ||
Code: | Code: | ||
| Line 20: | Line 21: | ||
IPF="ipfw -q add" | IPF="ipfw -q add" | ||
ipfw -q -f flush | ipfw -q -f flush | ||
| − | #loopback | + | <nowiki>#</nowiki>loopback |
$IPF 10 allow all from any to any via lo0 | $IPF 10 allow all from any to any via lo0 | ||
$IPF 20 deny all from any to 127.0.0.0/8 | $IPF 20 deny all from any to 127.0.0.0/8 | ||
$IPF 30 deny all from 127.0.0.0/8 to any | $IPF 30 deny all from 127.0.0.0/8 to any | ||
$IPF 40 deny tcp from any to any frag | $IPF 40 deny tcp from any to any frag | ||
| − | # statefull | + | <nowiki>#</nowiki> statefull |
$IPF 50 check-state | $IPF 50 check-state | ||
$IPF 60 allow tcp from any to any established | $IPF 60 allow tcp from any to any established | ||
$IPF 70 allow all from any to any out keep-state | $IPF 70 allow all from any to any out keep-state | ||
$IPF 80 allow icmp from any to any | $IPF 80 allow icmp from any to any | ||
| − | #firewall rule used by Fail2Ban to block traffic | + | <nowiki>#</nowiki>firewall rule used by Fail2Ban to block traffic |
$IPF 90 deny all from 'table(1)' to any | $IPF 90 deny all from 'table(1)' to any | ||
| − | # open port DNS (53) | + | <nowiki>#</nowiki> open port DNS (53) |
| − | # http (80), https (443) etc | + | <nowiki>#</nowiki> http (80), https (443) etc |
$IPF 150 allow tcp from any to any 443 in | $IPF 150 allow tcp from any to any 443 in | ||
$IPF 160 allow tcp from any to any 443 out | $IPF 160 allow tcp from any to any 443 out | ||
| Line 44: | Line 45: | ||
$IPF 220 allow tcp from any to any 22 in | $IPF 220 allow tcp from any to any 22 in | ||
$IPF 230 allow tcp from any to any 22 out | $IPF 230 allow tcp from any to any 22 out | ||
| − | # deny and log everything | + | <nowiki>#</nowiki> deny and log everything |
$IPF 500 deny log all from any to any | $IPF 500 deny log all from any to any | ||
| + | |||
| + | == Set Up Fail2Ban == | ||
| + | |||
| + | === Install Fail2Ban === | ||
| + | <code>pkg install security/py-fail2ban</code> | ||
| + | |||
| + | === Configuration === | ||
| + | cd /usr/local/etc/fail2ban | ||
| + | cp fail2ban.conf fail2ban.local | ||
| + | cp jail.conf jail.local | ||
| + | |||
| + | Edit jail.local | ||
| + | |||
| + | Insert at very bottom: | ||
| + | |||
| + | enabled = true | ||
| + | filter = nextcloud | ||
| + | action = ipfw-nextcloud | ||
| + | logpath = /usr/local/www/apache24/data/nextcloud/data/nextcloud.log | ||
| + | maxretry = 3 | ||
| + | port = 80,443 | ||
| + | protocol = tcp | ||
Revision as of 17:44, 26 September 2016
This quick guide is designed to show you how to enable Fail2Ban on the NextCloud jail.
Contents
[hide]Set Up IPFW
FreeNAS' jail uses IPFW as the basic firewall.
Add this line in: /etc/rc.conf
Code:
firewall_enable="YES" firewall_script="/usr/local/etc/ipfw.rules" fail2ban_enable="YES"
MAKE the ipfw.rules file:
/usr/local/etc/ipfw.rules
Edit IPFW Rules
Edit rules file /usr/local/etc/ipfw.rules
Code:
IPF="ipfw -q add" ipfw -q -f flush #loopback $IPF 10 allow all from any to any via lo0 $IPF 20 deny all from any to 127.0.0.0/8 $IPF 30 deny all from 127.0.0.0/8 to any $IPF 40 deny tcp from any to any frag # statefull $IPF 50 check-state $IPF 60 allow tcp from any to any established $IPF 70 allow all from any to any out keep-state $IPF 80 allow icmp from any to any #firewall rule used by Fail2Ban to block traffic $IPF 90 deny all from 'table(1)' to any # open port DNS (53) # http (80), https (443) etc $IPF 150 allow tcp from any to any 443 in $IPF 160 allow tcp from any to any 443 out $IPF 170 allow udp from any to any 53 in $IPF 175 allow tcp from any to any 53 in $IPF 180 allow udp from any to any 53 out $IPF 185 allow tcp from any to any 53 out $IPF 200 allow tcp from any to any 80 in $IPF 210 allow tcp from any to any 80 out $IPF 220 allow tcp from any to any 22 in $IPF 230 allow tcp from any to any 22 out # deny and log everything $IPF 500 deny log all from any to any
Set Up Fail2Ban
Install Fail2Ban
pkg install security/py-fail2ban
Configuration
cd /usr/local/etc/fail2ban cp fail2ban.conf fail2ban.local cp jail.conf jail.local
Edit jail.local
Insert at very bottom:
enabled = true filter = nextcloud action = ipfw-nextcloud logpath = /usr/local/www/apache24/data/nextcloud/data/nextcloud.log maxretry = 3 port = 80,443 protocol = tcp
