[Help Request] How to integrate ElkArte and fail2ban?

December 25, 2016, 09:33:53 pm

Hi, are there anyone that tried to integrate ElkArte and fail2ban? I want to prevent someone bruteforcing the login page. While the forum will ban multiple failed login but it still get processed by php. I want to take it further that the bot is blocked at network level, so it doesn't affect performance badly. yesterday my wordpress blog login page got hammered, and i must disabled php-fpm to access my vps.

this is what i use to mitigate the bruteforce in wordpress: https://github.com/thebrandonallen/wp-fail2ban-redux/

i searched google if there is someone that already integrate it with smf but none i found are useful or my search skill sucks.

thanks!

Re: [Help Request] How to integrate ElkArte and fail2ban?

Reply #1 – December 25, 2016, 09:41:55 pm

It's kinda server related right? I think if your server enabled it then you may use it.

Re: [Help Request] How to integrate ElkArte and fail2ban?

Reply #2 – December 25, 2016, 10:06:03 pm

Quote from: ahrasis – December 25, 2016, 09:41:55 pmIt's kinda server related right? I think if your server enabled it then you may use it.

yep, but by default it only filtered known/popular application like ssh. as example wordpress is not included, so you must install that plugin in wordpress and add the filter definition to fail2ban configuration. fail2ban will block the ip by parsing /var/log/auth.log

Re: [Help Request] How to integrate ElkArte and fail2ban?

Reply #3 – December 26, 2016, 12:12:06 pm

I don't know of a specific addon for this, but basically it addon would have to use the php openlog functions to log failed access attempts that fail2ban could then scan. The general idea is that you are only logging the failed attempts.

However you could also simply look for any attempts in your access.log file, and make the assumption that if the same IP is logging many attempts in a short period, they are attempt to hack. This approach should work with your current log files.

Since I only use Nginx these days, I'll post what I would do as a quick stop on that setup.

I use a separate log file per "site" in the server definition. If you only have one site on a VPS then using the master Nginx access.log file would be fine. Be sure to use logrotate, you don't want to scan an access log that contains weeks of data. It is this access.log file that will be scanned with fail2ban

I use a specific log format for my nginx logs (nginx.conf) it looks like

Code: [Select]

        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" "$http_x_forwarded_for"';

which gives me entries like the following in the Access.log files

Code: [Select]

xxx.xxx.xxx.xxx - - [25/Dec/2016:07:02:36 -0600] "GET /index.php?action=login HTTP/1.1" 200 5538 "http://www.yoursite.tld/index. php?action=forum" "Mozilla/5.0 (iPad; CPU OS 10_1_1 like Mac OS X) AppleWebKit/602.2.14 (KHTML, like Gecko) Version/10.0        Mobile/14B100 Safari/602.1" "-"

using a fail2ban regex like

Code: [Select]

^<HOST>.*GET /index.php\?action=login\s.*$

will find all the login attempts per IP for this log style, if your log file is different, just update the regex to accomidate. So a basic elkarte-login.conf that you would place in your fail2ban filter.d directory would look like

Code: [Select]

#
# Login filter /etc/fail2ban/filter.d/elkarte-login.conf:
#
# Blocks IPs that attempt to authenticate to often
#
# Scan access log for attempts to login or login2
[Definition]
failregex = ^<HOST>.*GET /index.php\?action=login\s.*$
            ^<HOST>.*GET /index.php\?action=login2;quicklogin\s.*$
            ^<HOST>.*POST /index.php\?action=login2;quicklogin\s.*$
ignoreregex =

You can test that file works by running

Code: [Select]

 fail2ban-regex /var/log/nginx/access.log /etc/fail2ban/filter.d/elkarte-login.conf

will show the number of lines found (not the number it would ban, its just a test of the conf file)

Then in your jail.local file, something like (make sure you point to the directory of your sites access log in the logpath=) something like this. so anyone who has attempted to login > 6 times in 4 mins (240 seconds) is blocked for 10 min (600 seconds).

Code: [Select]

# Block anyone failing to authenticate using our applications log in page
[elkarte-login]

enabled = true
filter = elkarte-login
action = iptables-multiport[name=NoLoginFailures, port="http,https"]
logpath = /var/log/nginx*/*access*.log
findtime = 240
bantime = 600
maxretry = 6

UNTESTED !!!!

Re: [Help Request] How to integrate ElkArte and fail2ban?

Reply #4 – December 26, 2016, 12:24:00 pm

And if you are running Nginx, look into using limit_req_zone commands. You will need to enable the ngx_http_limit_conn_module.

With this you can limit the number of connections a single IP can make to the server, limit the number of requests that an single IP can make in a given timeframe, and limit the number of PHP requests it makes. If someone is hammering a server from an IP, this will stop them. Plus you can also use this in conjunction with fail2ban to block them at the iptable level, so once the web server finds the issue, it gets passed off earlier in the stack.

Re: [Help Request] How to integrate ElkArte and fail2ban?

Reply #5 – December 26, 2016, 10:24:04 pm

thanks @Spuds ! will try it later.

I'm using nginx too and already using rate limiting.