Fail2ban

Whether or not the fail2ban config files appear on the TB edit config page is immaterial to whether or not fail2ban is enabled.

iptables -L -v will give you a good, solid indication of if you're running. And of course, the best option would be to simulate an attack on the system yourself by generating a handful of incorrect SIP registration attempts. Nothing better than actually seeing it work for yourself.

Josh

Also--we included a script in the new beta (you can download it from the downloads page) which can auto-install and configure fail2ban for you! It uses strict, but reasonable default settings to help keep your server secure. If you'd like to use the script after installing the beta of trixbox, simply run

install-fail2ban

and that's it! Enjoy :)

The script is built into all current trixbox releases. If you are running 2.6.2.3 or later, just type 'install-fail2ban' from the command line.

Looks like your download was corrupted. Do the following and try again:

rm /usr/src/fail*

Had iptables installed and configured first and fail2ban installed ok I think. But I don't see a rule for it in iptables. Should I see a rule for fail2ban?

# Accept traffic from internal interfaces
-A INPUT ! -i eth1 -j ACCEPT
# Accept traffic with the ACK flag set
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
# Allow incoming data that is part of a connection we established
-A INPUT -m state --state ESTABLISHED -j ACCEPT
# Allow data that is related to existing connections
-A INPUT -m state --state RELATED -j ACCEPT
# Accept responses to DNS queries
-A INPUT -p udp -m udp --dport 1024:65535 --sport 53 -j ACCEPT
# Accept responses to our pings
-A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT
# Accept notifications of unreachable hosts
-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j ACCEPT
# Accept notifications to reduce sending speed
-A INPUT -p icmp -m icmp --icmp-type source-quench -j ACCEPT
# Accept notifications of lost packets
-A INPUT -p icmp -m icmp --icmp-type time-exceeded -j ACCEPT
# Accept notifications of protocol problems
-A INPUT -p icmp -m icmp --icmp-type parameter-problem -j ACCEPT
# Accept incoming hamachi
-A INPUT -p udp -m udp --dport 12976 -j ACCEPT
COMMIT

never mind my question, this is how you check for fail2ban:
[trixbox1.localdomain sysconfig]# iptables -L -v
Chain INPUT (policy DROP 1 packets, 265 bytes)
pkts bytes target prot opt in out source destination
0 0 fail2ban-ProFTPD tcp -- any any anywhere anywhere tcp dpt:ftp
12112 1532K fail2ban-ASTERISK all -- any any anywhere anywhere
558 51749 fail2ban-BadBots tcp -- any any anywhere anywhere multiport dports http,https
370 31280 fail2ban-SSH tcp -- any any anywhere anywhere tcp dpt:ssh
9677 1061K ACCEPT all -- !eth1 any anywhere anywhere
93 4836 ACCEPT tcp -- any any anywhere anywhere tcp flags:ACK/ACK
2374 469K ACCEPT all -- any any anywhere anywhere state ESTABLISHED
0 0 ACCEPT all -- any any anywhere anywhere state RELATED
0 0 ACCEPT udp -- any any anywhere anywhere udp spt:domain dpts:1024:65535
0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-reply
0 0 ACCEPT icmp -- any any anywhere anywhere icmp destination-unreachable
0 0 ACCEPT icmp -- any any anywhere anywhere icmp source-quench
0 0 ACCEPT icmp -- any any anywhere anywhere icmp time-exceeded
0 0 ACCEPT icmp -- any any anywhere anywhere icmp parameter-problem
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:12976

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 11735 packets, 2466K bytes)
pkts bytes target prot opt in out source destination

Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
12112 1532K RETURN all -- any any anywhere anywhere

Chain fail2ban-BadBots (1 references)
pkts bytes target prot opt in out source destination
558 51749 RETURN all -- any any anywhere anywhere

Chain fail2ban-ProFTPD (1 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all -- any any anywhere anywhere

Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination
370 31280 RETURN all -- any any anywhere anywhere

Ronald,

Fail2Ban only adds IPtables rules when an IP has been banned. You won't see any additional rules in your IPtables listing unless something has been banned. The way fail2ban works is it parses logfiles for various services (like asterisk, sshd, etc) and looks for repeated attempts to access the system unsuccessfully. Depending on the rules implemented, it will then ban those IP addresses accordingly.

There is a new revison: http://www.fail2ban.org/wiki/index.php/ChangeLog. You should be able to find it at sourceforge.net

Ronald Cherry

I cant seam to download fail2ban also, getting the above errors and not in the repo of 2.6.2.3

The easiest way to get it going is to fix the script that's included in trixbox

ssh into your trixbox machine go to /usr/local/sbin

nano install-fail2ban

edit the download line so it now says

DOWNLOAD=http://downloads.sourceforge.net/project/fail2ban/fail2ban-stable/fail2ban-0.8.4/fail2ban-0.8.4.tar.bz2

Ctrl X to edit nano

Then run setup-fail2ban and it will install

It's anybody's guess why nobody has bothered to update this script in the latest releases, 0.8.4 has been around for a long time now.

I have fail to ban installed but it never seems to ban anything.
I have tried from my home to get banned registering a bad extension, but it never appears.
I do not have my home ip in the ignore list.

Btsteve- You may want to make sure it is installed correctly and running. I get ban notification emails on a daily basis.