Eine kompatible ufw-multiport Action schaut so aus:
/etc/fail2ban/action.d/ufw-multiport.conf
# Fail2Ban configuration file
#
# Author: Xela
#
# Based on the work of Cyril Jaquier and Guilhem Lettron
#
[Definition
]
# Option: actionstart
# Notes.: command executed once at the start of Fail2Ban.
# Values: CMD
#
actionstart =
# Option: actionstop
# Notes.: command executed once at the end of Fail2Ban
# Values: CMD
#
actionstop =
# Option: actioncheck
# Notes.: command executed once before each actionban command
# Values: CMD
#
actioncheck =
# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <failures> number of failures
# <time> unix timestamp of the ban time
# Values: CMD
#
actionban = ufw insert
1 deny log proto <protocol> from <ip> to any port <port>
# Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <failures> number of failures
# <time> unix timestamp of the ban time
# Values: CMD
#
actionunban = ufw delete deny log proto <protocol> from <ip> to any port <port>
[Init
]
# Option: port
# Values: [ NUM ] comma separated list or single port
#
port =
22
# Option: protocol
# Values: [ tcp | udp ]
#
protocol = tcp
So kann die action z.B. verwendet werden:
(in /etc/fail2ban/jail.local)
[sasl]
enabled = true
filter = sasl
maxretry = 4
bantime = 300
findtime = 120
action = ufw-multiport[port="25,465", protocol=tcp]
logpath = /var/log/mail.log
Zu beachten: die Ports der
action Parameter müssen zwingend numerisch angegeben werden.
Wie testen wir das Ergebnis?
Eine Möglichkeit wäre, den Login wie
hier beschrieben von einer unwichtigen IP aus mehrmals nacheinander zu vergeigen, also statt den mime encoded Zugangsdaten irgendwas zu schreiben.