Difference between revisions of "Fail2ban/nextcloud"
From SETV Springfield Technical Wiki
(Created page with "This quick guide is designed to show you how to enable Fail2Ban on the NextCloud jail. == Set Up IPFW == FreeNAS' jail uses IPFW as the basic firewall. Add this line in: <co...") |
m |
||
| Line 14: | Line 14: | ||
<code>/usr/local/etc/ipfw.rules</code> | <code>/usr/local/etc/ipfw.rules</code> | ||
| − | + | === Edit IPFW Rules === | |
| + | Edit rules file <code>/usr/local/etc/ipfw.rules</code> | ||
Code: | Code: | ||
| Line 20: | Line 21: | ||
IPF="ipfw -q add" | IPF="ipfw -q add" | ||
ipfw -q -f flush | ipfw -q -f flush | ||
| − | #loopback | + | <nowiki>#</nowiki>loopback |
$IPF 10 allow all from any to any via lo0 | $IPF 10 allow all from any to any via lo0 | ||
$IPF 20 deny all from any to 127.0.0.0/8 | $IPF 20 deny all from any to 127.0.0.0/8 | ||
$IPF 30 deny all from 127.0.0.0/8 to any | $IPF 30 deny all from 127.0.0.0/8 to any | ||
$IPF 40 deny tcp from any to any frag | $IPF 40 deny tcp from any to any frag | ||
| − | # statefull | + | <nowiki>#</nowiki> statefull |
$IPF 50 check-state | $IPF 50 check-state | ||
$IPF 60 allow tcp from any to any established | $IPF 60 allow tcp from any to any established | ||
$IPF 70 allow all from any to any out keep-state | $IPF 70 allow all from any to any out keep-state | ||
$IPF 80 allow icmp from any to any | $IPF 80 allow icmp from any to any | ||
| − | #firewall rule used by Fail2Ban to block traffic | + | <nowiki>#</nowiki>firewall rule used by Fail2Ban to block traffic |
$IPF 90 deny all from 'table(1)' to any | $IPF 90 deny all from 'table(1)' to any | ||
| − | # open port DNS (53) | + | <nowiki>#</nowiki> open port DNS (53) |
| − | # http (80), https (443) etc | + | <nowiki>#</nowiki> http (80), https (443) etc |
$IPF 150 allow tcp from any to any 443 in | $IPF 150 allow tcp from any to any 443 in | ||
$IPF 160 allow tcp from any to any 443 out | $IPF 160 allow tcp from any to any 443 out | ||
| Line 44: | Line 45: | ||
$IPF 220 allow tcp from any to any 22 in | $IPF 220 allow tcp from any to any 22 in | ||
$IPF 230 allow tcp from any to any 22 out | $IPF 230 allow tcp from any to any 22 out | ||
| − | # deny and log everything | + | <nowiki>#</nowiki> deny and log everything |
$IPF 500 deny log all from any to any | $IPF 500 deny log all from any to any | ||
| + | |||
| + | == Set Up Fail2Ban == | ||
| + | |||
| + | === Install Fail2Ban === | ||
| + | <code>pkg install security/py-fail2ban</code> | ||
| + | |||
| + | === Configuration === | ||
| + | cd /usr/local/etc/fail2ban | ||
| + | cp fail2ban.conf fail2ban.local | ||
| + | cp jail.conf jail.local | ||
| + | |||
| + | Edit jail.local | ||
| + | |||
| + | Insert at very bottom: | ||
| + | |||
| + | enabled = true | ||
| + | filter = nextcloud | ||
| + | action = ipfw-nextcloud | ||
| + | logpath = /usr/local/www/apache24/data/nextcloud/data/nextcloud.log | ||
| + | maxretry = 3 | ||
| + | port = 80,443 | ||
| + | protocol = tcp | ||
Revision as of 17:44, 26 September 2016
This quick guide is designed to show you how to enable Fail2Ban on the NextCloud jail.
Set Up IPFW
FreeNAS' jail uses IPFW as the basic firewall.
Add this line in: /etc/rc.conf
Code:
firewall_enable="YES" firewall_script="/usr/local/etc/ipfw.rules" fail2ban_enable="YES"
MAKE the ipfw.rules file:
/usr/local/etc/ipfw.rules
Edit IPFW Rules
Edit rules file /usr/local/etc/ipfw.rules
Code:
IPF="ipfw -q add" ipfw -q -f flush #loopback $IPF 10 allow all from any to any via lo0 $IPF 20 deny all from any to 127.0.0.0/8 $IPF 30 deny all from 127.0.0.0/8 to any $IPF 40 deny tcp from any to any frag # statefull $IPF 50 check-state $IPF 60 allow tcp from any to any established $IPF 70 allow all from any to any out keep-state $IPF 80 allow icmp from any to any #firewall rule used by Fail2Ban to block traffic $IPF 90 deny all from 'table(1)' to any # open port DNS (53) # http (80), https (443) etc $IPF 150 allow tcp from any to any 443 in $IPF 160 allow tcp from any to any 443 out $IPF 170 allow udp from any to any 53 in $IPF 175 allow tcp from any to any 53 in $IPF 180 allow udp from any to any 53 out $IPF 185 allow tcp from any to any 53 out $IPF 200 allow tcp from any to any 80 in $IPF 210 allow tcp from any to any 80 out $IPF 220 allow tcp from any to any 22 in $IPF 230 allow tcp from any to any 22 out # deny and log everything $IPF 500 deny log all from any to any
Set Up Fail2Ban
Install Fail2Ban
pkg install security/py-fail2ban
Configuration
cd /usr/local/etc/fail2ban cp fail2ban.conf fail2ban.local cp jail.conf jail.local
Edit jail.local
Insert at very bottom:
enabled = true filter = nextcloud action = ipfw-nextcloud logpath = /usr/local/www/apache24/data/nextcloud/data/nextcloud.log maxretry = 3 port = 80,443 protocol = tcp
