Current time: 07-09-2020, 05:25 PM Hello There, Guest! (LoginRegister)


Post Reply 
[HowTo] FTP Brute Force
Author Message
ArcAiN6 Offline
Junior Member
*

Posts: 37
Joined: Apr 2007
Reputation: 0
Post: #1
[HowTo] FTP Brute Force
Recently i noticed some of my servers going a bit haywire, when i checked the logs, i noticed the auth.log was extremely large. After peeking into it, i found that my FTP was under almost constant brute force attempts.

I found a solution that seemed to stop it dead in it's tracks, and can be used for many other services as well. Following is the tutorial i used..

You can peruse the original tutorial here: http://www.howtoforge.com/fail2ban_debian_etch
-------------------------------------------------------------------------
Preventing Brute Force Attacks With Fail2ban On Debian Etch

Version 1.0
Author: Falko Timme <ft [at] falkotimme [dot] com>
Last edited 04/24/2007

In this article I will show how to install and configure fail2ban on a Debian Etch system. Fail2ban is a tool that observes login attempts to various services, e.g. SSH, FTP, SMTP, Apache, etc., and if it finds failed login attempts again and again from the same IP address or host, fail2ban stops further login attempts from that IP address/host by blocking it with an iptables firewall rule.

This document comes without warranty of any kind! I want to say that this is not the only way of setting up such a system. There are many ways of achieving this goal but this is the way I take. I do not issue any guarantee that this will work for you!

In this example I will configure fail2ban to monitor login attempts to the SSH server, the Proftpd server, login attempts to .htaccess/.htpasswd protected web sites, to Courier POP3 and Courier IMAP, and to SASL (for sending emails). I will install the fail2ban package that is available for Debian Etch. It comes with a default configuration, but unfortunately that configuration doesn't quite work for most of the aforementioned services. Therefore I will create a customized fail2ban configuration that I have tested and that works for me.


Installing fail2ban

Fail2ban can be installed as follows on Debian Etch:
Code:
apt-get install fail2ban
Afterwards, you will find all fail2ban configuration files in the /etc/fail2ban directory.

Configuring fail2ban

The default behaviour of fail2ban is configured in the file /etc/fail2ban/jail.conf. Take a look at it, it's not hard to understand. There's a [DEFAULT] section that applies to all other sections unless the default options are overriden in the other sections.

I explain some of the configuration options here:

* ignoreip: This is a space-separated list of IP addresses that cannot be blocked by fail2ban. For example, if the computer from which you're connecting to the server has a static IP address, you might want to list it here.
* bantime: Time in seconds that a host is blocked if it was caught by fail2ban (600 seconds = 10 minutes).
* maxretry: Max. number of failed login attempts before a host is blocked by fail2ban.
* filter: Refers to the appropriate filter file in /etc/fail2ban/filter.d.
* logpath: The log file that fail2ban checks for failed login attempts.

As suggested by a comment at the top of /etc/fail2ban/jail.conf, we don't modify /etc/fail2ban/jail.conf itself to adjust it to our needs, but override it by creating a new configuration file, /etc/fail2ban/jail.local.

This is what my /etc/fail2ban/jail.local file looks like:
Code:
[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1 192.168.0.99
bantime  = 600
maxretry = 3

# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto".
# yoh: For some reason Debian shipped python-gamin didn't work as expected
#      This issue left ToDo, so polling is default backend for now
backend = polling

#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = root@localhost

# Default action to take: ban only
action = iptables[name=%(__name__)s, port=%(port)s]


[ssh]

enabled = true
port    = ssh
filter  = sshd
logpath  = /var/log/auth.log
maxretry = 5


[apache]

enabled = true
port    = http
filter  = apache-auth
logpath = /var/log/apache*/*error.log
maxretry = 5


[apache-noscript]

enabled = false
port    = http
filter  = apache-noscript
logpath = /var/log/apache*/*error.log
maxretry = 5


[vsftpd]

enabled  = false
port     = ftp
filter   = vsftpd
logpath  = /var/log/auth.log
maxretry = 5


[proftpd]

enabled  = true
port     = ftp
filter   = proftpd
logpath  = /var/log/auth.log
failregex = proftpd: \(pam_unix\) authentication failure; .* rhost=<HOST>
maxretry = 5


[wuftpd]

enabled  = false
port     = ftp
filter   = wuftpd
logpath  = /var/log/auth.log
maxretry = 5


[postfix]

enabled  = false
port     = smtp
filter   = postfix
logpath  = /var/log/mail.log
maxretry = 5


[courierpop3]

enabled  = true
port     = pop3
filter   = courierlogin
failregex = courierpop3login: LOGIN FAILED.*ip=\[.*:<HOST>\]
logpath  = /var/log/mail.log
maxretry = 5


[courierimap]

enabled  = true
port     = imap2
filter   = courierlogin
failregex = imapd: LOGIN FAILED.*ip=\[.*:<HOST>\]
logpath  = /var/log/mail.log
maxretry = 5


[sasl]

enabled  = true
port     = smtp
filter   = sasl
failregex = warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed
logpath  = /var/log/mail.log
maxretry = 5
My client computer has the static IP address 192.168.0.99, and because I don't want to be locked out, I've added it to the ignoreip list. I've set the max. number of failed login attempts to 5 for all services, and I've created two new sections, [courierpop3] and [courierimap], so that fail2ban can block login attempts to my Courier-POP3 and Courier-IMAP server.

I want to control login attempts to ssh, apache, proftpd, courierpop3, courierimap, and sasl, so I've set enabled to true for these services and to false for all other services.

If you compare the file with /etc/fail2ban/jail.conf, you'll also notice that I've changed some log files because the log files in /etc/fail2ban/jail.conf are not correct for Debian Etch. In addition to that, I've added a failregex line to some services because the regular expressions in the appropriate filter files in the /etc/fail2ban/filter.d directory do not work for Debian Etch. The failregex line overrides the filter rule in the appropriate file in /etc/fail2ban/filter.d.

Whenever we modify the fail2ban configuration, we must restart fail2ban, so this is what we do now:
Code:
/etc/init.d/fail2ban restart

That's it already. Fail2ban logs to /var/log/fail2ban.log, so you can check that file to find out if/what hosts got blocked. If a host got blocked by fail2ban, it looks like this:

2007-04-24 17:49:09,466 fail2ban.actions: WARNING [apache] Ban 1.2.3.4
2007-04-24 18:08:33,213 fail2ban.actions: WARNING [sasl] Ban 1.2.3.4
2007-04-24 18:26:37,769 fail2ban.actions: WARNING [courierlogin] Ban 1.2.3.4
2007-04-24 18:39:06,765 fail2ban.actions: WARNING [courierimap] Ban 1.2.3.4


You can also check your firewall to see if any hosts are currently blocked. Simply run:
Code:
iptables -L

----------------------------------------------------------------------

I hope this has been of some use to some of you Smile
I wouldn't mind something like this being implimented into ispcp in the future. Smile
(This post was last modified: 03-15-2008 03:25 AM by BeNe.)
03-14-2008 01:48 AM
Find all posts by this user Quote this message in a reply
gOOvER Offline
Banned

Posts: 3,561
Joined: Jul 2007
Post: #2
RE: FTP Brute Force...
I mean there is allready a Howto for fail2ban. But thank you. Maybe other Users won't find the first Howto.
03-14-2008 01:53 AM
Visit this user's website Find all posts by this user Quote this message in a reply
BeNe Offline
Moderator
*****
Moderators

Posts: 5,899
Joined: Jan 2007
Reputation: 68
Post: #3
RE: [HowTo] FTP Brute Force
We have already a HowTo about it...but thanks for work.
--> Moved!

Greez BeNe
03-15-2008 03:26 AM
Visit this user's website Find all posts by this user Quote this message in a reply
ArcAiN6 Offline
Junior Member
*

Posts: 37
Joined: Apr 2007
Reputation: 0
Post: #4
RE: [HowTo] FTP Brute Force
hrm... i cannot find any reference in the documentation section about this, that's why i posted it. Perhaps it got lost.
03-18-2008 12:45 AM
Find all posts by this user Quote this message in a reply
mafia Offline
Banned

Posts: 170
Joined: May 2008
Post: #5
RE: [HowTo] FTP Brute Force
hello

error

/etc/init.d/fail2ban restart
Restarting authentication failure monitor: fail2banTraceback (most recent call last):
File "/usr/bin/fail2ban-client", line 401, in <module>
if client.start(sys.argv):
File "/usr/bin/fail2ban-client", line 370, in start
return self.__processCommand(args)
File "/usr/bin/fail2ban-client", line 180, in __processCommand
ret = self.__readConfig()
File "/usr/bin/fail2ban-client", line 374, in __readConfig
self.__configurator.readAll()
File "/usr/share/fail2ban/client/configurator.py", line 58, in readAll
self.__jails.read()
File "/usr/share/fail2ban/client/jailsreader.py", line 41, in read
ConfigReader.read(self, "jail")
File "/usr/share/fail2ban/client/configreader.py", line 59, in read
SafeConfigParserWithIncludes.read(self, [bConf, bLocal])
File "/usr/share/fail2ban/client/configparserinc.py", line 105, in read
fileNamesFull += SafeConfigParserWithIncludes.getIncludes(filename)
File "/usr/share/fail2ban/client/configparserinc.py", line 76, in getIncludes
parser.read(resource)
File "/usr/lib/python2.5/ConfigParser.py", line 267, in read
self._read(fp, filename)
File "/usr/lib/python2.5/ConfigParser.py", line 490, in _read
raise e
ConfigParser.ParsingError: File contains parsing errors: /etc/fail2ban/jail.local
[line 225]: ' enabled = true\n'
[line 226]: ' port = pop3\n'
[line 227]: ' filter = courierlogin\n'
[line 228]: ' failregex = courierpop3login: LOGIN FAILED.*ip=\\[.*:<HOST>\\]\n'
[line 229]: ' logpath = /var/log/mail.log\n'
[line 230]: ' maxretry = 2\n'
[line 234]: ' enabled = true\n'
[line 235]: ' port = imap2\n'
[line 236]: ' filter = courierlogin\n'
[line 237]: ' failregex = imapd: LOGIN FAILED.*ip=\\[.*:<HOST>\\]\n'
[line 238]: ' logpath = /var/log/mail.log\n'
[line 239]: ' maxretry = 2\n'
failed!
05-09-2010 05:38 AM
Find all posts by this user Quote this message in a reply
Post Reply 


Forum Jump:


User(s) browsing this thread: 1 Guest(s)