Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fail2ban polling update and dropping of the FW checking #7936

Merged
merged 3 commits into from
Dec 30, 2017
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 19 additions & 4 deletions doc/Extensions/Applications.md
Original file line number Diff line number Diff line change
Expand Up @@ -215,21 +215,36 @@ snmp ALL=(ALL) NOPASSWD: /etc/snmp/exim-stats.sh, /usr/bin/exim*
extend fail2ban /etc/snmp/fail2ban
```

4: Edit /etc/snmp/fail2ban to match the firewall table you are using on your system. You should be good if you are using the defaults. Also make sure that the cache variable is properly set if you wish to use caching. The directory it exists in, needs to exist as well. To make sure it is working with out issue, run '/etc/snmp/fail2ban -u' and make sure it runs with out producing any errors.
If you want to use the cache, it is as below, by using the -c switch.
```
extend fail2ban /etc/snmp/fail2ban -c
```

If you want to use the cache and update it if needed, this can by using the -c and -U switches.
```
extend fail2ban /etc/snmp/fail2ban -c -U
```

If you need to specify a custom location for the fail2ban-client, that can be done via the -f switch.

If not specified, "/usr/bin/env fail2ban-client" is used.

```
extend fail2ban /etc/snmp/fail2ban -f /foo/bin/fail2ban-client
```

5: Restart snmpd on your host

6: If you wish to use caching, add the following to /etc/crontab and restart cron.
6: If you wish to use caching, add the following to /etc/crontab and restart cron.
```
*/3 * * * * root /etc/snmp/fail2ban -u
```

7: Restart or reload cron on your system.

In regards to the totals graphed there are two variables banned and firewalled. Firewalled is a count of banned entries the firewall for fail2ban and banned is the currently banned total from fail2ban-client. Both are graphed as the total will diverge with some configurations when fail2ban fails to see if a IP is in more than one jail when unbanning it. This is most likely to happen when the recidive is in use.

If you have more than a few jails configured, you may need to use caching as each jail needs to be polled and fail2ban-client can't do so in a timely manner for than a few. This can result in failure of other SNMP information being polled.

For additional details of the switches, please see the POD in the script it self at the top.

### FreeBSD NFS Client
#### SNMP Extend
Expand Down
6 changes: 0 additions & 6 deletions html/includes/graphs/application/fail2ban_banned.inc.php
Original file line number Diff line number Diff line change
Expand Up @@ -21,12 +21,6 @@
'ds' => 'banned',
'colour' => '582A72'
),
array(
'filename' => $rrd_filename,
'descr' => 'Firewalled',
'ds' => 'firewalled',
'colour' => '28774F'
)
);
} else {
echo "file missing: $rrd_filename";
Expand Down
6 changes: 3 additions & 3 deletions includes/polling/applications/fail2ban.inc.php
Original file line number Diff line number Diff line change
Expand Up @@ -16,23 +16,23 @@
$bannedStuff = explode("\n", $f2b);

$total_banned=$bannedStuff[0];
$firewalled=$bannedStuff[1];

$rrd_name = array('app', $name, $app_id);
$rrd_def = RrdDefinition::make()
->addDataset('banned', 'GAUGE', 0)
->addDataset('firewalled', 'GAUGE', 0);


$fields = array(
'banned' =>$total_banned,
'firewalled' => $firewalled,
'firewalled'=>'U',
);
$metrics['total'] = $fields;

$tags = array('name' => $name, 'app_id' => $app_id, 'rrd_def' => $rrd_def, 'rrd_name' => $rrd_name);
data_update($device, 'app', $tags, $fields);

$int=2;
$int=1;
$jails=array();

while (isset($bannedStuff[$int])) {
Expand Down