fail2ban sur le host + rsyslog guests->host

Hello,

j'ai un serveur Debian avec une configuration similaire:
- les containers LXC (LXC guests dans mon readme) ont chacun un sous réseau en 10.0.N.0/24, avec N > 1
- le Linux natifs (LXC host dans mon readme) a une IP LAN en 192.X.Y.Z et un sous réseau 10.0.0.0/24 avec l'ip 10.0.0.254 sur une interface "dummy".
- le traffic IP est routé entre les LXC guests/host/LAN et quelques règles iptables permettent de rediriger le traffic de l'IP LAN vers les containers + autoriser certains traffics entre les containers + masquerading éventuel

Chaque container fait tourner son fail2ban, avec ses règles/jails à lui; mais les fail2ban (et les rsyslog) dans les containers sont configurés pour ne rien faire à part générer les logs de détection d'intrusion et renvoyer ces logs vers le Linux natif/host.

Le host fait lui aussi tourner fail2ban (qui, lui, ban vraiment) en parsant les logs du hosts, mais aussi les logs générés par les fail2ban des containers.

De cette façon, les règles fail2ban sont définies dans les containers (i.e. au même endroit que les services qui tournent/à surveiller); mais les actions sont exécutés par le host, qui est le seul à pouvoir vraiment bloquer le traffic des attaquants. Bien sur, pour les containers derrière un reverse proxy web (par exemple), il faut prendre soin de configurer le reverse/front et le backend pour que ce soit l'IP du client/attaquant qui apparaisse dans les logs du container backend, et non pas l'IP du reverse proxy.

readme perso, à adapter pour son besoin :

# Purpose:
# Define filters/jails in each LXC guest; but delegate the actual IP blocking to the LXC host.
# Indeed, each LXC guest knows what services it exposes, and what logs/regex to watch.
# But IPs should be blocked at the LXC host level because some guests can't directly protect themselves (ex: those behind a reverse proxy).
#
# How it works:
# fail2ban, in LXC guests, is configured to do nothing (except logging any filter match, which is the default behaviour) :
# - the LXC guests default action is changed to a custom action file which does nothing
# - the logging destination is changed from direct file to syslog.
# Then, rsyslog is configured to forward logs generated by fail2ban to the LXC host.
# On the LXC host, rsyslog is configured to receive logs from LXC guests and store them to /var/log/fail2ban-remotes.log
# It's fail2ban is configured to monitor and block the IPs found in this file.
On LXC host
##############
# Install fail2ban
sudo apt-get install fail2ban
# Configure rsyslogd to receive and store Fail2ban logs from our LXC guests.
sudo vi /etc/rsyslog.d/fail2ban_server.conf
---
# Listen for fail2ban logs coming from LXC guests
# and save them in a specific file for our Fail2ban.
ruleset(name="f2b-remotes") {
 action(type="omfile" file="/var/log/fail2ban-remotes.log")
 stop
}
module(load="imtcp")
input(type="imtcp" Port="514" Address="10.0.0.254" ruleset="f2b-remotes")
---
sudo /etc/init.d/rsyslog restart
# Configure logrotate for the file /var/log/fail2ban-remotes.log
# now filled by rsyslogd
sudo vi /etc/logrotate.d/rsyslog_fail2ban_server
---
# Rotate Fail2ban logs coming from LXC guests
# Better rotate weekly rather than daily so that Fail2ban
# can have bantimes >= 24h
/var/log/fail2ban-remotes.log
{
 rotate 4
 weekly
 missingok
 notifempty
 delaycompress
 compress
 postrotate
 /usr/lib/rsyslog/rsyslog-rotate
 endscript
}
---
# Install fail2ban
sudo apt-get install fail2ban
# Unfortunately, the iptables-allports.conf action have the "filter" table hardcoded.
# Add this new action file so that with now have the table as a parameter, allowing
# the creation of rules into the "raw" table.
# raw/PREROUTING is processed before filter/INPUT (packets for the host) and filter/FORWARD
# (packets for LXC Guests, or hosts behind the router). Using raw/PREROUTING let us
# filter both cases with a single rule.
sudo tee /etc/fai2ban/actions.d/iptables-allports-gfa.conf >/dev/null << "---EOF---"
# Fail2Ban configuration file
#
# Author: Cyril Jaquier
# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
# made active on all ports from original iptables.conf
# GFA
# adapted from iptables-allports.conf, adding the <table>
# parameter
#
#
[INCLUDES]
before = iptables-common.conf
[Definition]
# Option: actionstart
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
# Values: CMD
#
actionstart = <iptables> -t <table> -N f2b-<name>
 <iptables> -t <table> -A f2b-<name> -j <returntype>
 <iptables> -t <table> -I <chain> -p <protocol> -j f2b-<name>
# Option: actionstop
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
# Values: CMD
#
actionstop = <iptables> -t <table> -D <chain> -p <protocol> -j f2b-<name>
 <actionflush>
 <iptables> -t <table> -X f2b-<name>
# Option: actioncheck
# Notes.: command executed once before each actionban command
# Values: CMD
#
actioncheck = <iptables> -t <table> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
actionban = <iptables> -t <table> -I f2b-<name> 1 -s <ip> -j <blocktype>
# Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: See jail.conf(5) man page
# Values: CMD
#
actionunban = <iptables> -t <table> -D f2b-<name> -s <ip> -j <blocktype>
[Init]
# GFA
# Should ideally be moved to iptables-common.conf
# ---
# Option: table
# Notes specifies the iptables table to which the Fail2Ban rules should be
# added
# Values: STRING Default: filter
table = filter
---EOF---
# Change default action to iptables-allport via the "raw" table, "PREROUTING" chain
sudo tee /etc/fail2ban/jail.local >/dev/null << "---EOF---"
[DEFAULT]
action = iptables-allports-gfa[table=raw, chain=PREROUTING, protocol=all, blocktype=DROP]
---EOF---
# Create filter for remote fail2bans
sudo tee /etc/fail2ban/filter.d/fail2ban-remotes.conf >/dev/null << "---EOF---"
# Fail2Ban filter for remote fail2bans
#
# GFA
# Inpired from filter.d/recidive.conf
# Detect all <HOST> found by remote fail2ban instances.
[INCLUDES]
before = common.conf
[Definition]
failregex = ^%(__prefix_line)s(?:\s*fail2ban\.filter\s*%(__pid_re)s?:\s+)?INFO\s+\[[^\]]*\]\s+Found\s+<HOST>\s
ignoreregex =
---EOF---
# Create jail for remote fail2bans
sudo tee /etc/fail2ban/jail.d/fail2ban-remotes.conf >/dev/null << "---EOF---"
[fail2ban-remotes]
enabled = yes
logpath = /var/log/fail2ban-remotes.log
---EOF---
sudo systemctl restart fail2ban
On LXC guest
##############
# Install fail2ban
sudo apt-get install fail2ban
# Configure Fail2ban to output logs via syslog. Then, we will configure
# rsyslog to send them to the LXC host.
#
# The purpose is make them available to the LXC host fail2ban daemon so that
# the host can block attacks detected by the guests. This way, all guests
# fail2ban detections will be merged on the host, and the host can ban
# offending IPs for the itself and all routed hosts (guests, LAN).
# Configure rsyslog to forward Fail2ban logs to the LXC host
sudo vi /etc/rsyslog.d/fail2ban.conf
---
# GFA
# Send fail2ban logs to the LXC host so that the host
# can block bad IPs for us.
# Requires a modified fail2ban config:
# /etc/fail2ban/fail2ban.conf:logtarget = SYSLOG
if $programname startswith 'fail2ban' then {
 # Local logging
 # Don't forget to configure *logrotate* accordingly if uncommented.
 # If commented, fail2ban logs will still be available in /var/log/syslog files
 #action(type="omfile" file="/var/log/fail2ban-syslog.log")
 # Remote logging
 @@10.0.0.254
}
---
 sudo /etc/init.d/rsyslog restart
# Configure fail2ban to send logs over syslog
sudo vi /etc/fail2ban/fail2ban.local
---
# GFA
[Definition]
# Send logs over rsyslog so that rsyslog can send them to the LXC host
logtarget = SYSLOG
---
sudo /etc/init.d/fail2ban restart
# Stops logrotate to handle /var/log/fail2ban.log since this file
# is not created anymore.
sudo vi /etc/logrotate.d/fail2ban
---
# GFA:
# Fail2ban is configured to dispatch logs through syslog,
# so we don't need to logrotate this file anymore.
#/var/log/fail2ban.log {
#
# weekly
# rotate 4
# compress
#
# delaycompress
# missingok
# postrotate
# fail2ban-client flushlogs 1>/dev/null
# endscript
#
# # If fail2ban runs as non-root it still needs to have write access
# # to logfiles.
# # create 640 fail2ban adm
# create 640 root adm
#}
---
sudo rm -rf /var/log/fail2ban.log
# Create a do-nothing target. We just need to generate syslog found/ban entries.
# This is the host which is responsible for actually banning IPs.
sudo tee /etc/fail2ban/action.d/do-nothing.conf >/dev/null << "---EOF---"
# Fail2Ban configuration file
#
# GFA
# Adapted from the dummy.conf action
[Definition]
actionstart =
actionflush =
actionstop =
actioncheck =
actionban =
actionunban =
---EOF---
# Change default action to do-nothing.conf
sudo tee /etc/fail2ban/jail.local >/dev/null << "---EOF---"
[DEFAULT]
# Do nothing except logging offenders with "Found <ip>"
action = do-nothing
# Don't ban offenders to avoid polluting logs with
# "Ban/Unban/Ignore <ip>" entries...
# Didn't find a propre way to disable banning, so use these timings to ban
# if more than 10 tries in the same second.
maxretry = 10
bantime = 0
findtime = 0
---EOF---
sudo /etc/init.d/fail2ban restart

Je n'ai pas fini de le tester, il y a surement de petites coquilles qui trainent par-ci par-là :)