Greetings all;
Is there someone familiar with fail2ban here?
I just installed it and started it with the installation defaults, which I do not know since the init script has no "dump" option.
However that bit of hungry guard dog only protects this machine, leaving the other 4 or sometimes 5 on my local network still open.
So specifically, is there a way to broadcast the rules it applies to the other 4 or 5 machines, protecting them at the same time?
Or possibly broadcast them to the router, which is running dd-wrt, and which is considered one of the more bulletproof reflash's about. I may be lucky, but since I do have a port forward to allow my web server, there is a potential attack point.
Advice to a fail2ban new bee?
Thank you.
Cheers, Gene Heskett
On Sat, Aug 27, 2016 at 10:46:31AM -0400, Gene Heskett wrote:
Greetings all;
Is there someone familiar with fail2ban here?
I'm not an expert, but I do run it myself.
I just installed it and started it with the installation defaults, which I do not know since the init script has no "dump" option.
Look at the default config file:
less /etc/fail2ban/fail2ban.conf
and the jail file:
less /etc/fail2ban/jail.conf
However that bit of hungry guard dog only protects this machine, leaving the other 4 or sometimes 5 on my local network still open.
So specifically, is there a way to broadcast the rules it applies to the other 4 or 5 machines, protecting them at the same time?
The way I would do that would be to install fail2ban on each machine, and then periodically rsync the relevant config files from one designated "master" copy to the other machines. You can probably set that up as a cron job.
Actually, that's not really how I would do it. How I really would do it would be to ensure that only one machine is directly exposed to the internet. Let's say I had four machines, "groucho", "harpo", "chico" and "zeppo". Plus, of course, my modem/router has a firewall. So I would have:
(ASCII art best viewed in a fixed-width font, like Courier)
internet | | firewall (router/modem) | | groucho | +-------+-------+------------+ | | | harpo chico zeppo
groucho, of course, also runs its own firewall, giving defence in depth: even if router firewall is compromised, the firewall on groucho gives some additional security. harpo, chico and zeppo don't have any firewall because they're all part of my trusted LAN. (You may not trust your LAN, in which case by all means put firewalls on everything.) Nothing can go directly from the internet to the inner LAN, so groucho is the only machine that needs to run fail2ban.
To SSH into chico, say, I would SSH into groucho, then SSH into chico. There's probably a clever way of doing that in a single step with ssh tunnelling, but that's beyond my level of expertise, so I just do it with two steps.
Or possibly broadcast them to the router, which is running dd-wrt, and which is considered one of the more bulletproof reflash's about. I may be lucky, but since I do have a port forward to allow my web server, there is a potential attack point.
Does your router have a writable storage area? Apart from its own configuration, of course?
On Saturday 27 August 2016 14:08:58 Steven D'Aprano wrote:
On Sat, Aug 27, 2016 at 10:46:31AM -0400, Gene Heskett wrote:
Greetings all;
Is there someone familiar with fail2ban here?
I'm not an expert, but I do run it myself.
I just installed it and started it with the installation defaults, which I do not know since the init script has no "dump" option.
Look at the default config file:
less /etc/fail2ban/fail2ban.conf
and the jail file:
less /etc/fail2ban/jail.conf
However that bit of hungry guard dog only protects this machine, leaving the other 4 or sometimes 5 on my local network still open.
So specifically, is there a way to broadcast the rules it applies to the other 4 or 5 machines, protecting them at the same time?
The way I would do that would be to install fail2ban on each machine, and then periodically rsync the relevant config files from one designated "master" copy to the other machines. You can probably set that up as a cron job.
Actually, that's not really how I would do it. How I really would do it would be to ensure that only one machine is directly exposed to the internet. Let's say I had four machines, "groucho", "harpo", "chico" and "zeppo". Plus, of course, my modem/router has a firewall. So I would have:
(ASCII art best viewed in a fixed-width font, like Courier)
internet firewall (router/modem) groucho +-------+-------+------------+ harpo chico zeppo
In my lashup, although groucho has two ethernet ports, groucho is on an 8 port switch in parallel with harpo, chico, and zeppo. The switches upstream port goes to the router. So all machines have instant access to the net with the router keeping track of who originated the net traffic request. ssh -Y using keyfile access control is transparent from this machine to the others. As is an sshfs mount to /home/me on all the other machines. Root access by ssh is denied. Where there is more than one machine in a building/room, an additional hub tee's things off.
groucho, of course, also runs its own firewall, giving defence in depth: even if router firewall is compromised, the firewall on groucho gives some additional security. harpo, chico and zeppo don't have any firewall because they're all part of my trusted LAN. (You may not trust your LAN, in which case by all means put firewalls on everything.) Nothing can go directly from the internet to the inner LAN, so groucho is the only machine that needs to run fail2ban.
To SSH into chico, say, I would SSH into groucho, then SSH into chico. There's probably a clever way of doing that in a single step with ssh tunnelling, but that's beyond my level of expertise, so I just do it with two steps.
Or possibly broadcast them to the router, which is running dd-wrt, and which is considered one of the more bulletproof reflash's about. I may be lucky, but since I do have a port forward to allow my web server, there is a potential attack point.
Does your router have a writable storage area? Apart from its own configuration, of course?
Yes, one can add to its rules, but access is a cast iron b---h.
Cheers, Gene Heskett
Gene Heskett wrote:
On Saturday 27 August 2016 14:08:58 Steven D'Aprano wrote:
On Sat, Aug 27, 2016 at 10:46:31AM -0400, Gene Heskett wrote:
Greetings all;
Is there someone familiar with fail2ban here?
I'm not an expert, but I do run it myself.
I just installed it and started it with the installation defaults, which I do not know since the init script has no "dump" option.
Look at the default config file:
less /etc/fail2ban/fail2ban.conf
and the jail file:
less /etc/fail2ban/jail.conf
However that bit of hungry guard dog only protects this machine, leaving the other 4 or sometimes 5 on my local network still open.
So specifically, is there a way to broadcast the rules it applies to the other 4 or 5 machines, protecting them at the same time?
The way I would do that would be to install fail2ban on each machine, and then periodically rsync the relevant config files from one designated "master" copy to the other machines. You can probably set that up as a cron job.
Actually, that's not really how I would do it. How I really would do it would be to ensure that only one machine is directly exposed to the internet. Let's say I had four machines, "groucho", "harpo", "chico" and "zeppo". Plus, of course, my modem/router has a firewall. So I would have:
(ASCII art best viewed in a fixed-width font, like Courier)
internet firewall (router/modem) groucho +-------+-------+------------+ harpo chico zeppoIn my lashup, although groucho has two ethernet ports, groucho is on an 8 port switch in parallel with harpo, chico, and zeppo. The switches upstream port goes to the router. So all machines have instant access to the net with the router keeping track of who originated the net traffic request. ssh -Y using keyfile access control is transparent from this machine to the others. As is an sshfs mount to /home/me on all the other machines. Root access by ssh is denied. Where there is more than one machine in a building/room, an additional hub tee's things off.
groucho, of course, also runs its own firewall, giving defence in depth: even if router firewall is compromised, the firewall on groucho gives some additional security. harpo, chico and zeppo don't have any firewall because they're all part of my trusted LAN. (You may not trust your LAN, in which case by all means put firewalls on everything.) Nothing can go directly from the internet to the inner LAN, so groucho is the only machine that needs to run fail2ban.
To SSH into chico, say, I would SSH into groucho, then SSH into chico. There's probably a clever way of doing that in a single step with ssh tunnelling, but that's beyond my level of expertise, so I just do it with two steps.
Or possibly broadcast them to the router, which is running dd-wrt, and which is considered one of the more bulletproof reflash's about. I may be lucky, but since I do have a port forward to allow my web server, there is a potential attack point.
Does your router have a writable storage area? Apart from its own configuration, of course?
Yes, one can add to its rules, but access is a cast iron b---h.
Cheers, Gene Heskett
Gene, the concept is
internet <-> router/modem <-> firewall <-> switch <-> local network/intranet
you can access the machines in your lan directly without going through whatever.
I actually purchased a low power fanless network pc (3 network ports) 10y ago and it is being used as firewall since then. Later some nice OpenWRT routers came out, so this is also doable for ~30$
regards
On Saturday 27 August 2016 18:53:09 deloptes wrote:
Gene Heskett wrote:
On Saturday 27 August 2016 14:08:58 Steven D'Aprano wrote:
On Sat, Aug 27, 2016 at 10:46:31AM -0400, Gene Heskett wrote:
Greetings all;
Is there someone familiar with fail2ban here?
I'm not an expert, but I do run it myself.
I just installed it and started it with the installation defaults, which I do not know since the init script has no "dump" option.
Look at the default config file:
less /etc/fail2ban/fail2ban.conf
and the jail file:
less /etc/fail2ban/jail.conf
However that bit of hungry guard dog only protects this machine, leaving the other 4 or sometimes 5 on my local network still open.
So specifically, is there a way to broadcast the rules it applies to the other 4 or 5 machines, protecting them at the same time?
The way I would do that would be to install fail2ban on each machine, and then periodically rsync the relevant config files from one designated "master" copy to the other machines. You can probably set that up as a cron job.
Actually, that's not really how I would do it. How I really would do it would be to ensure that only one machine is directly exposed to the internet. Let's say I had four machines, "groucho", "harpo", "chico" and "zeppo". Plus, of course, my modem/router has a firewall. So I would have:
(ASCII art best viewed in a fixed-width font, like Courier)
internet firewall (router/modem) groucho +-------+-------+------------+ harpo chico zeppoIn my lashup, although groucho has two ethernet ports, groucho is on an 8 port switch in parallel with harpo, chico, and zeppo. The switches upstream port goes to the router. So all machines have instant access to the net with the router keeping track of who originated the net traffic request. ssh -Y using keyfile access control is transparent from this machine to the others. As is an sshfs mount to /home/me on all the other machines. Root access by ssh is denied. Where there is more than one machine in a building/room, an additional hub tee's things off.
groucho, of course, also runs its own firewall, giving defence in depth: even if router firewall is compromised, the firewall on groucho gives some additional security. harpo, chico and zeppo don't have any firewall because they're all part of my trusted LAN. (You may not trust your LAN, in which case by all means put firewalls on everything.) Nothing can go directly from the internet to the inner LAN, so groucho is the only machine that needs to run fail2ban.
To SSH into chico, say, I would SSH into groucho, then SSH into chico. There's probably a clever way of doing that in a single step with ssh tunnelling, but that's beyond my level of expertise, so I just do it with two steps.
Or possibly broadcast them to the router, which is running dd-wrt, and which is considered one of the more bulletproof reflash's about. I may be lucky, but since I do have a port forward to allow my web server, there is a potential attack point.
Does your router have a writable storage area? Apart from its own configuration, of course?
Yes, one can add to its rules, but access is a cast iron b---h.
Cheers, Gene Heskett
Gene, the concept is
internet <-> router/modem <-> firewall <-> switch <-> local network/intranet
you can access the machines in your lan directly without going through whatever.
I actually purchased a low power fanless network pc (3 network ports) 10y ago and it is being used as firewall since then. Later some nice OpenWRT routers came out, so this is also doable for ~30$
regards
dd-wrt may have additional bells and whistles. It seems to need a $70 router to have the resources to do port forwarding, customized iptables rules and such. However, it has worked so well for me that I have not had the urge to try some of the $30 routers. Competition generally leads to a better, cheaper product.
The new user would be wise to survey what is available, and for how much. But first learn the lingo well enough to determine if you need feature such and such. dd-wrt is the only one I trust to not have a back door in it. Someone else will have to attest for openwrt, and tomato as I have exactly zero experience with them.
To unsubscribe, e-mail: trinity-users-unsubscribe@lists.pearsoncomputing.net For additional commands, e-mail: trinity-users-help@lists.pearsoncomputing.net Read list messages on the web archive: http://trinity-users.pearsoncomputing.net/ Please remember not to top-post: http://trinity.pearsoncomputing.net/mailing_lists/#top-posting
Cheers, Gene Heskett
On Sunday 28 of August 2016 01:17:45 Gene Heskett wrote:
dd-wrt may have additional bells and whistles. It seems to need a $70 router to have the resources to do port forwarding, customized iptables rules and such. However, it has worked so well for me that I have not had the urge to try some of the $30 routers. Competition generally leads to a better, cheaper product.
The new user would be wise to survey what is available, and for how much. But first learn the lingo well enough to determine if you need feature such and such. dd-wrt is the only one I trust to not have a back door in it. Someone else will have to attest for openwrt, and tomato as I have exactly zero experience with them.
I've also previously used the dd-wrt, but after I get to know better OpenWRT, it became my first choice. Part of flash is available as a regular filesystem. Is there a proper packaging system. In short, much more versatile than dd-wrt.
Anyway, when I last looked at the dd-wrt pages, so it seemed to me that the development already stagnant for some time.
On Saturday 27 August 2016 19:30:46 Slávek Banko wrote:
On Sunday 28 of August 2016 01:17:45 Gene Heskett wrote:
dd-wrt may have additional bells and whistles. It seems to need a $70 router to have the resources to do port forwarding, customized iptables rules and such. However, it has worked so well for me that I have not had the urge to try some of the $30 routers. Competition generally leads to a better, cheaper product.
The new user would be wise to survey what is available, and for how much. But first learn the lingo well enough to determine if you need feature such and such. dd-wrt is the only one I trust to not have a back door in it. Someone else will have to attest for openwrt, and tomato as I have exactly zero experience with them.
I've also previously used the dd-wrt, but after I get to know better OpenWRT, it became my first choice. Part of flash is available as a regular filesystem. Is there a proper packaging system. In short, much more versatile than dd-wrt.
Anyway, when I last looked at the dd-wrt pages, so it seemed to me that the development already stagnant for some time.
I can't argue that point Slávek. OTOH, what can you do to it that is not already done so well that it Just Works(TM)? The last attack it might have succumbed to had the whole Mary Ann rebuilt to guard against it in something on the order of 36 hours, 2+ years ago. That included the install bin's for several hundred routers. So BrainSlayer moved at more than adequate speed IMO when the money and reputation was on the table.
Cheers, Gene Heskett
-
deloptes -
Gene Heskett -
Slávek Banko -
Steven D'Aprano