RancherOS support?

[vitobotta]

Hi! This is not really a bug report so I hope it's OK if I ask a question here. I am looking to use RancherOS both for the Rancher management platform and for my Kubernetes hosts. Since everything in RancherOS runs as a container - including system services - I was looking for how to use fail2ban as a container, and found this repo. Has anyone tried docker-fail2ban with RancherOS? Does it work?

Thanks a lot in advance for your help!

[cryptoDevTrader]

I was able to get it working for sshd on RancherOS using the following docker-compose.yml. Note the F2B_LOG_LEVEL env is optional.

version: '3'
services:
  fail2ban:
    image: crazymax/fail2ban
    restart: always
    network_mode: host
    cap_add:
      - NET_ADMIN
      - NET_RAW
    environment:
      F2B_LOG_LEVEL: DEBUG
    volumes:
      - ./data:/data
      - /var/log:/var/log:ro

The contents of ./data/jail.d/sshd.conf is as follows. Note that the only thing changed from the example is logpath.

[sshd]
enabled = true
chain = INPUT
port = ssh
filter = sshd[mode=aggressive]
logpath = /var/log/messages
maxretry = 5

After IPs are banned, you should see some data when running sudo iptables -L f2b-sshd from the host, like so:

Chain f2b-sshd (1 references)
target     prot opt source               destination
REJECT     all  --  218.92.0.246         anywhere             reject-with icmp-port-unreachable
REJECT     all  --  112.85.42.174        anywhere             reject-with icmp-port-unreachable
RETURN     all  --  anywhere             anywhere

One thing I do find odd are DEBUG logs like these. It would be interesting to know if this is resolvable or if it has any negative impact.

2020-11-22 01:05:46,903 fail2ban.filterpyinotif [1]: DEBUG   Event queue size: 16
2020-11-22 01:05:46,904 fail2ban.filterpyinotif [1]: DEBUG   <_RawEvent cookie=0 mask=0x2 name='' wd=2 >

[vitobotta]

Hi @divThis, RancherOS is being deprecated and there won't be any further development according to Rancher, so I would recommend against using it. :)

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.