2660: Fail2ban update r=mergify[bot] a=nextgens
## What type of PR?
documentation
## What does this PR do?
Change the instructions on how to setup fail2ban
### Related issue(s)
## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.
Co-authored-by: Florent Daigniere <nextgens@freenetproject.org>
If you use a reverse proxy in front of Mailu, it is vital to set the environment variables REAL_IP_HEADER and REAL_IP_FROM.
If you use a reverse proxy in front of Mailu, it is vital to set the environment variables REAL_IP_HEADER and REAL_IP_FROM.
Without these environment variables, Mailu will not trust the remote client IP passed on by the reverse proxy and as a result your reverse proxy will be banned.
Without these environment variables, Mailu will not trust the remote client IP passed on by the reverse proxy and as a result your reverse proxy will be banned.
See the :ref:`[configuration reference <reverse_proxy_headers>` for more information.
See the :ref:`configuration reference <reverse_proxy_headers>` for more information.
Assuming you have a working Fail2Ban installation on the host running your Docker containers,
Assuming you have a working Fail2Ban installation on the host running your Docker containers,
@ -560,32 +560,57 @@ follow these steps:
options:
options:
tag: mailu-front
tag: mailu-front
2. Add the /etc/fail2ban/filter.d/bad-auth.conf
2. Add the /etc/fail2ban/filter.d/bad-auth-bots.conf
actionunban = ipset del -exist f2b-bad-auth-bots <ip>/24
Using DOCKER-USER chain ensures that the blocked IPs are processed in the correct order with Docker. See more in: https://docs.docker.com/network/iptables/.
Please note that the provided example will block the subnet from sending any email to the Mailu instance.
5. In the mailu docker-compose set the logging driver of the Admin container to journald; and set the tag to mailu-admin
..code-block:: bash
..code-block:: bash
@ -594,89 +619,32 @@ The above will block flagged IPs for a week, you can of course change it to your
options:
options:
tag: mailu-admin
tag: mailu-admin
5. Add the /etc/fail2ban/filter.d/bad-auth-sso.conf
6. Add the /etc/fail2ban/filter.d/bad-auth.conf
..code-block:: bash
..code-block:: bash
# Fail2Ban configuration file
# Fail2Ban configuration file
[Definition]
[Definition]
failregex = .* Login failed for .+ from <HOST>.
failregex = : Authentication attempt from <HOST> has been rate-limited\.$
ignoreregex =
ignoreregex =
journalmatch = CONTAINER_TAG=mailu-admin
journalmatch = CONTAINER_TAG=mailu-admin
6. Add the /etc/fail2ban/jail.d/bad-auth-sso.conf
7. Add the /etc/fail2ban/jail.d/bad-auth.conf
..code-block:: bash
..code-block:: bash
[bad-auth-sso]
[bad-auth]
enabled = true
enabled = true
backend = systemd
backend = systemd
filter = bad-auth-sso
filter = bad-auth
bantime = 604800
bantime = 604800
findtime = 300
findtime = 900
maxretry = 10
maxretry = 15
action = docker-action
action = docker-action
The above will block flagged IPs for a week, you can of course change it to your needs.
The above will block flagged IPs for a week, you can of course change it to your needs.
7. Add the /etc/fail2ban/filter.d/bad-auth-api.conf
8. Add the following to /etc/fail2ban/action.d/docker-action.conf
..code-block:: bash
# Fail2Ban configuration file
[Definition]
failregex = .* Invalid API token provided by <HOST>.
ignoreregex =
journalmatch = CONTAINER_TAG=mailu-admin
8. Add the /etc/fail2ban/jail.d/bad-auth-api.conf
..code-block:: bash
[bad-auth-api]
enabled = true
backend = systemd
filter = bad-auth-api
bantime = 604800
findtime = 300
maxretry = 10
action = docker-action
The above will block flagged IPs for a week, you can of course change it to your needs.
9. Add the /etc/fail2ban/action.d/docker-action.conf
actionban = iptables -I f2b-bad-auth 1 -s <ip> -j DROP
actionunban = iptables -D f2b-bad-auth -s <ip> -j DROP
Using DOCKER-USER chain ensures that the blocked IPs are processed in the correct order with Docker. See more in: https://docs.docker.com/network/iptables/
Option 2: Use ipset together with iptables
IMPORTANT: You have to install ipset on the host system, eg. `apt-get install ipset` on a Debian/Ubuntu system.
See ipset homepage for details on ipset, https://ipset.netfilter.org/.
ipset and iptables provide one big advantage over just using iptables: This setup reduces the overall iptable rules.
There is just one rule for the bad authentications and the IPs are within the ipset.
Specially in larger setups with a high amount of brute force attacks this comes in handy.
Using iptables with ipset might reduce the system load in such attacks significantly.
..code-block:: bash
..code-block:: bash
@ -695,7 +663,7 @@ Using iptables with ipset might reduce the system load in such attacks significa
Using DOCKER-USER chain ensures that the blocked IPs are processed in the correct order with Docker. See more in: https://docs.docker.com/network/iptables/
Using DOCKER-USER chain ensures that the blocked IPs are processed in the correct order with Docker. See more in: https://docs.docker.com/network/iptables/
10. Configure and restart the Fail2Ban service
9. Configure and restart the Fail2Ban service
Make sure Fail2Ban is started after the Docker service by adding a partial override which appends this to the existing configuration.
Make sure Fail2Ban is started after the Docker service by adding a partial override which appends this to the existing configuration.
bors[bot]
2 years ago
committed by