CentOS 7 fail2banでwp-login.phpへのアクセスをブロック

wp-login.phpへのアクセスが異常に増えたのでfai2banを導入しました｡

以前もCentOS 5のサーバで導入していましたが､バージョンアップでかなり変わりました｡

Install the Fail2ban on CentOS 5

CentOS 7ではepel repoにあります｡

環境
･CentOS Linux release 7.3.1611 (Core)
･Kernel 3.10.0-514.16.1.el7.x86_64
･firewalld 0.4.3.2-8.1.el7_3.2
･fail2ban 0.9.6-3.el7

CentOS 7からfirewalldが標準になりyumでインストールするとfirewalldを前提に設定ファイルがインストールされます｡

How To Protect SSH With Fail2Ban on CentOS 7
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-centos-7

1. fail2banインストール
Shell

# yum -y install epel-release # yum -y install fail2ban

1 2	# yum -y install epel-release # yum -y install fail2ban

/etc/fail2ban/fail2ban.conf, /etc/fail2ban/jail.confがシステム設定ファイルになります｡

2. firewalldとの連携

firewalldとの連携は/etc/fail2ban/jail.d/00-firewalld.confに記述されています｡
デフォルトではfirewalldとipsetを使用してIPブロックの管理をしています｡

Shell

# cat /etc/fail2ban/jail.d/00-firewalld.conf # This file is part of the fail2ban-firewalld package to configure the use of # the firewalld actions as the default actions. You can remove this package # (along with the empty fail2ban meta-package) if you do not use firewalld [DEFAULT] banaction = firewallcmd-ipset

1 2 3 4 5 6 7

# cat /etc/fail2ban/jail.d/00-firewalld.conf   # This file is part of the fail2ban-firewalld package to configure the use of # the firewalld actions as the default actions.  You can remove this package # (along with the empty fail2ban meta-package) if you do not use firewalld [DEFAULT] banaction = firewallcmd-ipset

もしiptableを利用するなら00-firewalld.conf削除して/etc/fail2ban/action.d/iptables.confをコピーすれば出来そうな気がします｡

3. ローカル設定

jail.confに記載されていますがjail.confは編集しないでjail.localか､あるいはjail.d/ディレクトリに.confファイルを作成してローカル設定の推奨をしています｡
しかし0.9.0から大幅に変更されているようですね｡

# WARNING: heavily refactored in 0.9.0 release. Please review and # customize settings for your setup. # # Changes: in most of the cases you should not modify this # file, but provide customizations in jail.local file, # or separate .conf files under jail.d/ directory, e.g.:

1 2 3 4 5 6

# WARNING: heavily refactored in 0.9.0 release.  Please review and #          customize settings for your setup. # # Changes:  in most of the cases you should not modify this #           file, but provide customizations in jail.local file, #           or separate .conf files under jail.d/ directory, e.g.:

4. jail.localを作成

jail.confをコピーしてもいいのですが､不要な部分が多ければ新たに作成した方がいいと思います｡

Shell

# vi /etc/fail2ban/jail.local # cat /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1/8 192.168.1.0/24 bantime = 600 findtime = 600 maxretry = 5

1 2 3 4 5 6 7 8

# vi /etc/fail2ban/jail.local   # cat /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1/8 192.168.1.0/24 bantime  = 600 findtime  = 600 maxretry = 5

ignoreip: ブロックの対象にしないネットワークを指定します｡
bantime: ブロックの時間を指定します
findtime: 調査対象時間を指定します
findtime: 調査対象時間に何回出現したか指定します｡

この設定では過去10分間に調査ログに指定されたパターン(filter)が5回記録されたらfirewalldにIPを登録して10分間アクセスをブロックします｡

5. filterルールを作成

wp-login.phpへのアクセスのフィルタールールを作成します｡
CentOS 5で利用していたfilter-ruleです｡

Shell

# /etc/fail2ban/filter.d/apache-wplogin.conf # cat /etc/fail2ban/filter.d/apache-wplogin.conf # Fail2Ban configuration file # Author: Cyril Jaquier # $Revision: 728 $ # [Definition] # Option: failregex # Notes.: regex to match the password failure messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Values: TEXT # failregex = ^<HOST>\ \-.*\"POST\ \/wp-login.php HTTP\/1\..*\" ^<HOST>\ \-.*\"GET\ \/wp-login.php HTTP\/1\..*\" # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex =

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

# /etc/fail2ban/filter.d/apache-wplogin.conf # cat /etc/fail2ban/filter.d/apache-wplogin.conf   # Fail2Ban configuration file # Author: Cyril Jaquier # $Revision: 728 $ #   [Definition]   # Option:  failregex # Notes.:  regex to match the password failure messages in the logfile. The #          host must be matched by a group named "host". The tag "<HOST>" can #          be used for standard IP/hostname matching and is only an alias for #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Values:  TEXT # failregex = ^<HOST>\ \-.*\"POST\ \/wp-login.php HTTP\/1\..*\"             ^<HOST>\ \-.*\"GET\ \/wp-login.php HTTP\/1\..*\"   # Option:  ignoreregex # Notes.:  regex to ignore. If this regex matches, the line is ignored. # Values:  TEXT # ignoreregex =

6. filterの有効化

作成したapache-wploginフィルタールールを有効にします｡
これは/etc/fail2ban/jail.localに記述します｡

Shell

# vi /etc/fail2ban/jail.local # cat /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1/8 192.168.1.0/24 bantime = 600 findtime = 600 maxretry = 5 [apache-wplogin] enabled = true port = http,https bantime = 86400 maxretry = 1 logpath = %(apache_access_log)s

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

# vi /etc/fail2ban/jail.local   # cat /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1/8 192.168.1.0/24 bantime  = 600 findtime  = 600 maxretry = 5   [apache-wplogin] enabled  = true port     = http,https bantime  = 86400 maxretry = 1 logpath  = %(apache_access_log)s

この設定では過去10分間に調査ログに指定されたパターン(filter)が1回記録されたらfirewalldにIPを登録してhttp,httpsポートを24時間ブロックします｡

7. 調査対象ログについて

logpath = %(apache_access_log)s はどのファイルで指定しているのか調べてみたらjail.confに

[INCLUDES]

#before = paths-distro.conf
before = paths-fedora.conf

とありました｡/etc/fail2ban/paths-fedora.confにログのパスが明記されています｡他にはdebian,freebsd,opensuse,osxがありました｡

調査するログを明確にするなら

logpath = /var/log/httpd/access_log

と直接記述してもいいですね｡

8. fail2banの起動
Shell

# systemctl enable fail2ban # systemctl start fail2ban # systemctl status fail2ban

1 2 3 4 5

# systemctl enable fail2ban   # systemctl start fail2ban   # systemctl status fail2ban

9. filterの確認

作成したfilterの確認をしてみます｡ 2059行中223(POSTが87,GETが136)行マッチしました｡

Shell

# fail2ban-regex /var/log/httpd/access_log /etc/fail2ban/filter.d/apache-wplogin.conf Running tests ============= Use failregex filter file : apache-wplogin, basedir: /etc/fail2ban Use log file : /var/log/httpd/access_log Use encoding : ANSI_X3.4-1968 Results ======= Failregex: 223 total |- #) [# of hits] regular expression | 1) [87] ^<HOST>\ \-.*\"POST\ \/wp-login.php HTTP\/1\..*\" | 2) [136] ^<HOST>\ \-.*\"GET\ \/wp-login.php HTTP\/1\..*\" `- Ignoreregex: 0 total Date template hits: |- [# of hits] date format | [2059] Day(?P<_sep>[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)? `- Lines: 2059 lines, 0 ignored, 223 matched, 1836 missed [processed in 0.16 sec] Missed line(s): too many to print. Use --print-all-missed to print all 1836 lines

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

# fail2ban-regex /var/log/httpd/access_log /etc/fail2ban/filter.d/apache-wplogin.conf   Running tests =============   Use   failregex filter file : apache-wplogin, basedir: /etc/fail2ban Use         log file : /var/log/httpd/access_log Use         encoding : ANSI_X3.4-1968   Results =======   Failregex: 223 total |-  #) [# of hits] regular expression |   1) [87] ^<HOST>\ \-.*\"POST\ \/wp-login.php HTTP\/1\..*\" |   2) [136] ^<HOST>\ \-.*\"GET\ \/wp-login.php HTTP\/1\..*\" `-   Ignoreregex: 0 total   Date template hits: |- [# of hits] date format |  [2059] Day(?P<_sep>[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)? `-   Lines: 2059 lines, 0 ignored, 223 matched, 1836 missed [processed in 0.16 sec]   Missed line(s): too many to print.  Use --print-all-missed to print all 1836 lines

10. ステータス確認

fail2banで有効なフィルタとそのフィルタでブロックしているIPが表示されます｡
ログに記録されているのにブロックされない場合は設定の確認をして下さい｡

Shell

# fail2ban-client status Status |- Number of jail: 1 `- Jail list: apache-wplogin # fail2ban-client status apache-wplogin Status for the jail: apache-wplogin |- Filter | |- Currently failed: 0 | |- Total failed: 3 | `- File list: /var/log/httpd/access_log /var/log/httpd/ssl_access_log `- Actions |- Currently banned: 3 |- Total banned: 3 `- Banned IP list: xxx.xxx.xxx.205 xxx.xxx.xxx.207 xxx.xxx.xxx.214

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

# fail2ban-client status Status |- Number of jail:      1 `- Jail list:   apache-wplogin   # fail2ban-client status apache-wplogin Status for the jail: apache-wplogin |- Filter |  |- Currently failed: 0 |  |- Total failed:     3 |  `- File list:        /var/log/httpd/access_log /var/log/httpd/ssl_access_log `- Actions    |- Currently banned: 3    |- Total banned:     3    `- Banned IP list:   xxx.xxx.xxx.205 xxx.xxx.xxx.207 xxx.xxx.xxx.214

11. ipsetでの確認

firewallcmd-ipsetでbanしているのでipsetでも確認できます｡

Shell

# ipset --list Name: fail2ban-apache-wplogin Type: hash:ip Revision: 1 Header: family inet hashsize 1024 maxelem 65536 timeout 86400 Size in memory: 16592 References: 1 Members: xxx.xxx.xxx.205 timeout 86248 # ipset --list Name: fail2ban-apache-wplogin Type: hash:ip Revision: 1 Header: family inet hashsize 1024 maxelem 65536 timeout 86400 Size in memory: 16656 References: 1 Members: xxx.xxx.xxx.205 timeout 85447 xxx.xxx.xxx.207 timeout 86038 # ipset --list Name: fail2ban-apache-wplogin Type: hash:ip Revision: 1 Header: family inet hashsize 1024 maxelem 65536 timeout 86400 Size in memory: 16720 References: 1 Members: xxx.xxx.xxx.205 timeout 78471 xxx.xxx.xxx.207 timeout 79061 xxx.xxx.xxx.214 timeout 85827

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

# ipset --list Name: fail2ban-apache-wplogin Type: hash:ip Revision: 1 Header: family inet hashsize 1024 maxelem 65536 timeout 86400 Size in memory: 16592 References: 1 Members: xxx.xxx.xxx.205 timeout 86248   # ipset --list Name: fail2ban-apache-wplogin Type: hash:ip Revision: 1 Header: family inet hashsize 1024 maxelem 65536 timeout 86400 Size in memory: 16656 References: 1 Members: xxx.xxx.xxx.205 timeout 85447 xxx.xxx.xxx.207 timeout 86038   # ipset --list Name: fail2ban-apache-wplogin Type: hash:ip Revision: 1 Header: family inet hashsize 1024 maxelem 65536 timeout 86400 Size in memory: 16720 References: 1 Members: xxx.xxx.xxx.205 timeout 78471 xxx.xxx.xxx.207 timeout 79061 xxx.xxx.xxx.214 timeout 85827

12. ブロックの解除

通常は指定時間が経過すれば解除されるのですが､誤って登録された場合はコマンドで解除できます｡
# fail2ban-client set <jail> unbanip <ip>

Shell

# fail2ban-client set apache-wplogin unbanip 192.168.1.10

1	# fail2ban-client set apache-wplogin unbanip 192.168.1.10

13. ログ

fail2banのログは/var/log/fail2ban.logに記録されます｡

2017-05-01 17:53:25,207 fail2ban.actions [16929]: NOTICE [apache-wplogin] Ban xxx.xxx.xxx.205 2017-05-01 18:03:15,608 fail2ban.filter [16929]: INFO [apache-wplogin] Found xxx.xxx.xxx.207 2017-05-01 18:03:15,954 fail2ban.actions [16929]: NOTICE [apache-wplogin] Banxxx.xxx.xxx.207 2017-05-01 19:56:01,053 fail2ban.filter [16929]: INFO [apache-wplogin] Found xxx.xxx.xxx.214 2017-05-01 19:56:01,302 fail2ban.actions [16929]: NOTICE [apache-wplogin] Ban xxx.xxx.xxx.214 2017-05-01 19:56:02,055 fail2ban.filter [16929]: INFO [apache-wplogin] Found xxx.xxx.xxx.214 2017-05-01 19:56:02,406 fail2ban.actions [16929]: NOTICE [apache-wplogin] xxx.xxx.xxx.214 already banned

1 2 3 4 5 6 7

2017-05-01 17:53:25,207 fail2ban.actions        [16929]: NOTICE  [apache-wplogin] Ban xxx.xxx.xxx.205 2017-05-01 18:03:15,608 fail2ban.filter         [16929]: INFO    [apache-wplogin] Found xxx.xxx.xxx.207 2017-05-01 18:03:15,954 fail2ban.actions        [16929]: NOTICE  [apache-wplogin] Banxxx.xxx.xxx.207 2017-05-01 19:56:01,053 fail2ban.filter         [16929]: INFO    [apache-wplogin] Found xxx.xxx.xxx.214 2017-05-01 19:56:01,302 fail2ban.actions        [16929]: NOTICE  [apache-wplogin] Ban xxx.xxx.xxx.214 2017-05-01 19:56:02,055 fail2ban.filter         [16929]: INFO    [apache-wplogin] Found xxx.xxx.xxx.214 2017-05-01 19:56:02,406 fail2ban.actions        [16929]: NOTICE  [apache-wplogin] xxx.xxx.xxx.214 already banned

取り敢えず大丈夫そうなので､これで様子をみます｡