I wan to write an Articlle about this Topic because I havent found one what is including all I want and have to Figure it Out by myself.
At first wen need a Folder and get our Docker Compose File running
mkdir fail2ban
cd fail2ban
vi docker-compose.yml
Paste the following text into the editor:
version: "3"
services:
fail2ban:
container_name: fail2ban
hostname: fail2ban
cap_add:
- NET_ADMIN
- NET_RAW
environment:
- TZ=Europe/Berlin
- F2B_DB_PURGE_AGE=14d
- SSMTP_HOST=<your-mail-server>
- SSMTP_PORT=25
- SSMTP_HOSTNAME=<hostname-of-your-container>
image: crazymax/fail2ban:latest
network_mode: host
restart: unless-stopped
volumes:
- /root/fail2ban/data:/data
- /root/ngix-proxy-manager/data/logs:/var/log/npm
- /var/log:/var/log/varlog
Save the file and start the Container with
docker-compose up -d
The Fail2ban Container will be loaded and is starting. There should be a data dir now with 4 folders
action.d
db
filter.d
jail.d
The db Folder can be ignored, now we need to create a jail.local in jail.d
vi jail.d/jail.local
Paste the following in there.:
[DEFAULT]
# "bantime.increment" allows to use database for searching of previously banned ip's to increase a
# default ban time using special formula, default it is banTime * 1, 2, 4, 8, 16, 32...
bantime.increment = true
# "bantime.rndtime" is the max number of seconds using for mixing with random time
# to prevent "clever" botnets calculate exact time IP can be unbanned again:
bantime.rndtime = 2048
# following example can be used for small initial ban time (bantime=60) - it grows more aggressive at begin,
# for bantime=60 the multipliers are minutes and equal: 1 min, 5 min, 30 min, 1 hour, 5 hour, 12 hour, 1 day, 2 day
bantime.multipliers = 1 5 30 60 300 720 1440 2880
#Ban without sending E-Mail
#action = %(action_)s
#Ban and send E-Mail
action = %(action_mw)s
destemail = <dest email>
sender = <from email>
mta = sendmail
[npm]
# bots that trigger too many 403 or 404
# logs are comming from reverse proxy "nginx proxy manager"
enabled = true
ignoreip = 127.0.0.0/8 10.0.0.0/8 172.0.0.0/8 192.168.0.0/16
filter = npm-filter
chain = DOCKER-USER
logpath = /var/log/npm/proxy-host-*_access.log
maxretry = 5
findtime = 60
bantime = 600
[sshd]
enabled = true
port = ssh
filter = sshd
ignoreip = 127.0.0.0/8 10.0.0.0/8 172.27.0.0/16 192.168.0.0/16
chain = INPUT
logpath = /var/log/varlog/auth.log
findtime = 10m
maxretry = 5
bantime = -1
we Monitor the NPM and the Systems sshd here, thats why we mapped the Volume from local logs into the fail2ban container.
Next Step is to add filter Rules in filter.d for our NPM
vi filter.d/npm-filter.conf
[INCLUDES]
[Definition]
failregex = ^.+ (405|404|403|401|\-) (405|404|403|401) - .+ [Client <HOST>] [Length .+] .+ [Sent-to <F-CONTAINER>.+</F-CONTAINER>] <F-USERAGENT>".+"</F-USERAGENT> .+$
ignoreregex = ^.+ (404|\-) (404) - .+".+(\.png|\.txt|\.jpg|\.ico|\.js|\.css)[/]" [Client <HOST>] [Length .+] ".+" .+$
Now we have everything set up and we can restart the container with
docker-compose restart
Now we want to see what fail2ban is doing. We can check the logs by doing docker ps to show the running containers and docker logs <container-id> --follow
Thats it, feel Free to ask if you have problems with this Setup
