Sharing of fail2ban banned IPs

fail2ban

I'm using fail2ban on all servers with publicly visible services and I wonder:

  1. Is there an easy way to share banned IPs between hosts I control?
  2. Is there a service out there collecting and publishing that data?

I've been getting countless login attempts since day 1 of setting up this server.

Best Answer

I once saw a system for centralizing fail2ban data on this site, and created a modified version. The database is the same, bu I changed and created some scripts.

My system have 4 components:

  1. fail2ban database

    It's a MySQL database containing only one table: erp_core_fail2ban:

    CREATE TABLE IF NOT EXISTS 'erp_core_fail2ban' (
  'id' bigint(20) unsigned NOT NULL AUTO_INCREMENT,
  'hostname' varchar(255) COLLATE utf8_unicode_ci DEFAULT NULL,
  'created' datetime NOT NULL,
  'name' text COLLATE utf8_unicode_ci NOT NULL,
  'protocol' varchar(16) COLLATE utf8_unicode_ci NOT NULL,
  'port' varchar(32) COLLATE utf8_unicode_ci NOT NULL,
  'ip' varchar(64) COLLATE utf8_unicode_ci NOT NULL,
  PRIMARY KEY ('id'),
  KEY 'hostname' ('hostname','ip')
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

  2. fail2ban.php

    Every time a host is banned, it will populate the database:

    
<?php
require_once("/etc/fail2ban/phpconfig.php");

$name = $_SERVER["argv"][1];
$protocol = $_SERVER["argv"][2];
$port = $_SERVER["argv"][3];
if (!preg_match('/^\d{1,5}$/', $port))
    $port = getservbyname($_SERVER["argv"][3], $protocol);
$ip = $_SERVER["argv"][4];

$hostname = gethostname();

$query = "INSERT INTO 'erp_core_fail2ban' set hostname='" . addslashes($hostname) . "', name='" . addslashes($name) ."', protocol='" . addslashes($protocol) . "', port='" . addslashes($port) . "', ip='" . addslashes($ip) . "', created=NOW()";
$result = mysql_query($query) or die('Query failed: ' . mysql_error());
mysql_close($link);
exit;
?>

  3. cron2ban

    You put this to run on crontab, every minute. It will retrieve the last added hosts, and ban them.

    
<?php
// phpconfig.php will have database configuration settings
require_once("/etc/fail2ban/phpconfig.php");

// file with only a line, containing the last id banned
$lastbanfile="/etc/fail2ban/lastban";

$lastban = file_get_contents($lastbanfile);

// select only hosts banned after last check
$sql = "select id, ip from erp_core_fail2ban where id > $lastban";
$result = mysql_query($sql) or die('Query failed: ' . mysql_error());
mysql_close($link);

while ($row = mysql_fetch_array($result)) {
        //
        $id = $row['id'];
        $ip = $row['ip'];


        exec("fail2ban-client set $jail banip $ip");

    

}

// $id contains the last banned host, add it to the config file
file_put_contents($lastbanfile, $id);
?>

  4. phpconfig

    This file goes to /etc/fail2ban and have database configuration and jail selection.

    
<?php
// jail to be used
$jail = "ssh";

// file to keep the last ban
$lastbanfile="/etc/fail2ban/lastban";

// database configuration
$dbserver="localhost";
$dbuser="root";
$dbpass="root";
$dbname="fail2ban";

// connect to database
$link = mysql_connect($dbserver, $dbuser, $dbpass) or die('Could not connect: ' . mysql_error());
mysql_select_db($dbname) or die('Could not select database');

?>

Create those files and change the configuration from fail2ban:

After the line with actionban = ..... a new row inserted to invoke the PHP script:

/root/fail2ban.php <name> <protocol> <port> <ip>

Using this structure on all your servers will assure that every time one host gets banned on one server, all the other servers will ban it too.

Related Topic