{"id":60,"date":"2013-09-18T23:32:03","date_gmt":"2013-09-18T21:32:03","guid":{"rendered":"http:\/\/yves.laedis.ch\/cms\/?p=60"},"modified":"2016-01-03T21:15:14","modified_gmt":"2016-01-03T20:15:14","slug":"proxmox-3-install-and-setup-fail2ban","status":"publish","type":"post","link":"https:\/\/yves.laedis.ch\/cms\/proxmox-3-install-and-setup-fail2ban\/","title":{"rendered":"Proxmox 3 + 4 – install and setup fail2ban"},"content":{"rendered":"

to Prevent Brute-forcing of logins<\/p>\n

<\/p>\n

install fail2ban<\/h2>\n
apt-get install fail2ban<\/pre>\n
\u00a0create the proxmox.local regex file<\/h2>\n
nano \/etc\/fail2ban\/filter.d\/proxmox.local<\/pre>\n
 <\/p>\n
# Fail2Ban configuration file\r\n#\r\n# Author: eXtremeSHOK.com\r\n#\r\n# $Revision: 201 $\r\n#\r\n\r\n[Definition]\r\n\r\n# Option: failregex\r\n# Notes.: regex to match the password failure messages in the logfile. The\r\n# host must be matched by a group named \"host\". The tag \"\" can\r\n# be used for standard IP\/hostname matching and is only an alias for\r\n# (?:::f{4,6}:)?(?P\\S+)\r\n# Values: TEXT\r\n#\r\n\r\nfailregex = pvedaemon\\[.*authentication failure; rhost=<HOST> user=.*msg=.*\r\n\r\n# Option: ignoreregex\r\n# Notes.: regex to ignore. If this regex matches, the line is ignored.\r\n# Values: TEXT\r\n#\r\n\r\nignoreregex =<\/pre>\n
 <\/p>\n
\u00a0Create fail2ban config for proxmox<\/h2>\n
We are also adding SSH and SSH DDOS protections
\nadd the following to the bottom of the\u00a0\/etc\/fail2ban\/jail.local<\/em>\u00a0file<\/p>\n
##### PROXMOX START######\r\n[proxmox]\r\nenabled = true \r\nport = 8006\r\nfilter = proxmox\r\nlogpath = \/var\/log\/syslog\r\nmaxretry = 5\r\nbantime = 86400 #24hours\r\n##### PROXMOX3: END#####\r\n\r\n###### SSH: START######\r\n[ssh]\r\nenables = true\r\nport = ssh\r\nfilter = sshd\r\nlogpath = \/var\/log\/auth.log\r\nmaxretry = 5\r\nbantime = 86400 #24hours\r\n##### SSH: END######\r\n\r\n##### SSH ANTI-DDOS: START######\r\n[ssh-ddos]\r\nenabled = true\r\nport = ssh\r\nfilter = sshd-ddos\r\nlogpath = \/var\/log\/auth.log\r\nmaxretry = 5\r\n##### SSH ANTI-DDOS: END######<\/pre>\n
Optional:<\/em>\u00a0Test fail2ban<\/strong><\/h2>\n
\n
\n
\n
\u00a0fail2ban-regex \/var\/log\/syslog \/etc\/fail2ban\/filter.d\/proxmox.local<\/pre>\n
Restart fail2ban to apply the setting<\/strong><\/p>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\u00a0service fail2ban restart<\/pre>\n
 <\/p>\n<\/div>\n<\/div>\n<\/div>\n
Removing a banned ip<\/strong><\/h2>\n
\n
\n
\n
iptables -L fail2ban-proxmox -n -v --line-numbers<\/pre>\n
iptables -D fail2ban-proxmox 1<\/pre>\n
Viewing banned ip\u2019s and the status of the filter<\/strong><\/h2>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\u00a0fail2ban-client status proxmox<\/pre>\n
 <\/p>\n
Quellen:<\/p>\n
http:\/\/forum.proxmox.com\/threads\/3583-How-To-implement-Fail2Ban-on-Host<\/a><\/p>\n
https:\/\/extremeshok.com\/2012\/07\/23\/proxmox-2-proxmox-3-server-security-post-installation-fail2ban-sysctl-hosts-ip-spoofing-iptables-for-openvz-containers\/<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
to Prevent Brute-forcing of logins<\/p>
Weiterlesen<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[4],"tags":[13,10],"class_list":["post-60","post","type-post","status-publish","format-standard","hentry","category-computers","tag-fail2ban","tag-proxmox","item-wrap"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4ixHP-Y","_links":{"self":[{"href":"https:\/\/yves.laedis.ch\/cms\/wp-json\/wp\/v2\/posts\/60","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yves.laedis.ch\/cms\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yves.laedis.ch\/cms\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yves.laedis.ch\/cms\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/yves.laedis.ch\/cms\/wp-json\/wp\/v2\/comments?post=60"}],"version-history":[{"count":17,"href":"https:\/\/yves.laedis.ch\/cms\/wp-json\/wp\/v2\/posts\/60\/revisions"}],"predecessor-version":[{"id":265,"href":"https:\/\/yves.laedis.ch\/cms\/wp-json\/wp\/v2\/posts\/60\/revisions\/265"}],"wp:attachment":[{"href":"https:\/\/yves.laedis.ch\/cms\/wp-json\/wp\/v2\/media?parent=60"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yves.laedis.ch\/cms\/wp-json\/wp\/v2\/categories?post=60"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yves.laedis.ch\/cms\/wp-json\/wp\/v2\/tags?post=60"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}