Brute-Force Attacke - IP bei Hoster gesperrt

[Jörg Reinholz]

Moin!

Für Wordpress gibt es eine Erweiterung, die liefert das logging und die Einträge für fail2ban-Konfiguration:

Dauerhafte Sperrung in allen Ports:

In ubuntu muss man das nur anpassen, auf Debian-Servern nachtragen:

/etc/fail2ban/jail.conf

…
[recidive]
enabled  = true 
port     = all
filter   = recidive
logpath  = /var/log/fail2ban.log
action   = iptables-allports[name=recidive]
           sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log]
#bantime  = 604800  ; 1 week
bantime  = 86400000 ; 1000 days
findtime = 86400    ; 1 day
maxretry = 3

/etc/fail2ban/filter.d/recidive:

# Fail2Ban filter for repeat bans
#
# This filter monitors the fail2ban log file, and enables you to add long 
# time bans for ip addresses that get banned by fail2ban multiple times.
#
# Reasons to use this: block very persistent attackers for a longer time, 
# stop receiving email notifications about the same attacker over and 
# over again.
#
# This jail is only useful if you set the 'findtime' and 'bantime' parameters 
# in jail.conf to a higher value than the other jails. Also, this jail has its
# drawbacks, namely in that it works only with iptables, or if you use a 
# different blocking mechanism for this jail versus others (e.g. hostsdeny 
# for most jails, and shorewall for this one).

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

_daemon = fail2ban\.actions

# The name of the jail that this filter is used for. In jail.conf, name the 
# jail using this filter 'recidive', or change this line!
_jailname = recidive

failregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions:\s+)WARNING\s+\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+<HOST>\s*$

# Author: Tom Hendrikx, modifications by Amir Caspi 

Wenn es ganz übel kommt, dann holt sich mancher Serverbetreiber noch eine Blacklist:

#!/bin/bash
# Skript holt böse IPs von diversen Listen und blockt diese in der Firewall
# Jörg Reinholz

### SETUP:
urlIList='
https://lists.blocklist.de/lists/strongips.txt
https://www.badips.com/get/list/any/3?age=1d
https://api.blocklist.de/getlast.php?time=24h
';

### Programm:
_chain='BLOCKLIST';
_tmpFile=`mktemp`;

# Holen der bösen IPs
for url in $_urlIList
do
        echo "Action: Hole $url";
        wget -qO- "$url"  >> "$_tmpFile";
        echo "Done: $url geholt."
done

# Test auf Daten, ggf. Abbruch:
if [ 1 -gt `wc -l < $_tmpFile`]        
then
        echo "Es konnten keine Daten empfangen werden";
        exit 2;                            
fi                                                                                               

# Ausfiltern und Liste in Variable laden   
ipList=`sort -u < "$_tmpFile" | grep -P '\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}' | grep -Pv "^[ \t]*$" | tr "\n" ' ';`;                                                                                                                          
#letztes Komma löschen:
ipList=${ipList:0:${#ipList} - 1};                                                                                                                                         
# Alte Liste löschen
/sbin/iptables -D INPUT   -j $_chain 2> /dev/null;
/sbin/iptables -D OUTPUT  -j $_chain 2> /dev/null;
/sbin/iptables -D FORWARD -j $_chain 2> /dev/null;
/sbin/iptables -F $_chain  2> /dev/null;
/sbin/iptables -X $_chain  2> /dev/null;

# Neue chain
/sbin/iptables -N $_chain 2> /dev/null;

# IPs an neue Chain anhängen
for ip in $ipList
do
        /sbin/iptables -A $_chain -s $ip -j DROP;
done

# chain wirksam machen
/sbin/iptables -I INPUT -j $_chain
/sbin/iptables -I OUTPUT -j $_chain
/sbin/iptables -I FORWARD -j $_chain

exit 0

... und manch anderer wirft seine bans dort auch ein.

Jörg Reinholz