Vim & Vision

[ #215 ] fail2ban on NetBSD for ssh Permalink

NetBSD, SSH Added less than a year ago

Check out fail2ban - it's a great way of securing your system using firewall rules (to block offending IPs) when hack attempts like numerous failed ssh logins occur.

To set it up on NetBSD, install it from source - it's Python so you can just:

$ sudo python setup.py install

Then add an rc script:

#!/bin/sh
#
# PROVIDE: fail2ban
# REQUIRE: NETWORKING syslogd

. /etc/rc.subr

name="fail2ban"
rcvar=$name
command="/usr/pkg/bin/fail2ban-client"
pidfile="/var/run/${name}/${name}.pid"
extra_commands="reload"

fail2ban_start()
{
    if [ -n "${the_fail2ban_pid}" ]; then
        echo "${command} already running as pid ${the_fail2ban_pid}."
        return 1
    fi
    echo "Starting ${name}"
    ${command} start
}

fail2ban_stop()
{
    if [ -z "${the_fail2ban_pid}" ]; then
        echo "${command} not running? (check ${pidfile})."
        return 1
    fi
    echo "Stopping ${name}"
    ${command} stop
}

fail2ban_status()
{
    if [ -z "${the_fail2ban_pid}" ]; then
        echo "${command} is not running? (check ${pidfile})."
    else
        echo "${command} is running as pid ${the_fail2ban_pid}."
    fi
}

fail2ban_reload()
{
    if [ -z "${the_fail2ban_pid}" ]; then
        echo "${command} not running? (check ${pidfile})."
        return 1
    fi
    echo "Reloading fail2ban"
    ${command} reload
}

start_cmd="fail2ban_start"
stop_cmd="fail2ban_stop"
status_cmd="fail2ban_status"
reload_cmd="fail2ban_reload"
the_fail2ban_pid=`check_pidfile ${pidfile} /usr/pkg/bin/python`

load_rc_config $name
run_rc_command "$1"

(don't forget to add fail2ban=YES to your /etc/rc.conf)

And setup your jail.conf with a section like this:

[ssh-ipfilter]

enabled  = true
filter   = sshd
action   = sendmail-whois[name=SSH, dest=youremail@email.com, sender=fail2ban@yourbox]
           ipfilter[name=SSH, port=ssh, protocol=tcp]
logpath  = /var/log/authlog
maxretry = 5

(Read the fail2ban docs or the message after installation to determine where your jail.conf and other conf files are. Mine are in /etc/fail2ban/)

Then start it up like this: