-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Setup fail2ban to cover wings.md #468
base: master
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,85 @@ | ||
# Fail2ban wings configuration | ||
|
||
Fail2ban is a program that works with iptables to better secure your server and services from brute force login attempts | ||
|
||
### Step 1: instal Fail2Ban | ||
(to my best knowledge, iptables will come with fail2ban when you install it, but if not install that too) | ||
Chronic-Reflexes marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
`apt-get install fail2ban` | ||
|
||
### Step 2: Copy some files, If you already have local files skip this | ||
#### We have to copy .conf to .local files, as Local files will persist through updates | ||
|
||
`cd /etc/fail2ban` | ||
`cp fail2ban.conf fail2ban.local` | ||
`cp jail.conf jail.local` | ||
|
||
### Step 3 Copy some text into the new local files | ||
|
||
`nano /etc/fail2ban/jail.local` | ||
|
||
scroll down until you see the actual jail portion of the file, input this text below the [SSHD] block, save it and exit | ||
``` | ||
[wings] | ||
enabled = true | ||
port = 2022 | ||
logpath = /var/log/pterodactyl/wings.log | ||
maxretry = 4 | ||
findtime = 3600 | ||
bantime = -1 | ||
backend = systemd | ||
``` | ||
|
||
### Step 4: Create the filter file and copy some more text | ||
|
||
`cd /etc/fail2ban/conf.d/` | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. By my side, on Ubuntu 22.04 and Fail2ban 0.11.2-6, the filter file comes into |
||
`touch wings.conf` | ||
`nano wings.conf` | ||
|
||
Copy this text into the newly created file, Save then exit | ||
``` | ||
# Fail2Ban filter for wings (Pterodactyl daemon) | ||
# | ||
# | ||
# | ||
# "WARN: [Sep 8 18:51:00.414] failed to validate user credentials (invalid format) ip=<HOST>:51782 subsystem=sftp username=logout" | ||
# | ||
|
||
[INCLUDES] | ||
|
||
before = common.conf | ||
|
||
[Definition] | ||
|
||
_daemon = wings | ||
|
||
failregex = failed to validate user credentials \([^\)]+\) ip=<HOST>:.* subsystem=sftp username=.*$ | ||
|
||
ignoreregex = | ||
|
||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. As far as I understand, in order to increase the search performance from the |
||
[Init] | ||
|
||
datepattern = \[%%b %%d %%H:%%M:%%S.%%f\] | ||
``` | ||
|
||
### Step 5: Enable Fail2ban service | ||
|
||
`systemctl enable fail2ban` | ||
|
||
|
||
#### Notes: | ||
The rules applied to wings are fairly strict so if you feel like you need to adjust them, the settings are as follows | ||
Max retry is the number of failed attempts someone can do within the time defined in "findtime" before they are banned | ||
|
||
example: maxretry = 4 with findtime = 3600 with bantime = -1 | ||
|
||
this will allow 4 failed login attempts within 3600 seconds (1 hour) before permanently banning someone | ||
There are different time modifiers you can use, Most people will be using dd (day) mm (month) yy (year) | ||
I do suggest you read up on fail2ban docs, you can get highly customised protection from custom configuration | ||
https://manpages.debian.org/testing/fail2ban/jail.conf.5.en.html#TIME_ABBREVIATION_FORMAT | ||
|
||
|
||
|
||
|
||
|
||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It should be
install
here.