Feature Request : autobans/manual bans

[Boldairdev]

I love the software well done, easy to use, but so far it's a passive tool.
Adding a button that would launch :
iptables -I INPUT -s xxx.xxx.xxx.xxx -j DROP (xxx beeing the offender IP) on each offender line.
Could even add it as an autobanning feature, with maybe a treshold like fail2ban,
That would certainly make my day :)
(could even make it an option to autoban the known mass scanners at first start)

(I'm not forgiving, my jail2ban jails ban the 1st time a week, in case of recidive a year, but fail2ban is not that easy to configure, especially for new jails, this, with banning features, could really be a better solution)

[jacktraf]

I agree, this would be an nice feature. What's an easy way to implement this on our own?

[stonfute]

A such feature will be awesome !

[unixfox]

👍

[stamparm]

This feature will be implemented at some point, BUT...

1. Where to do the autobanning? At server (?) which in regular setups should just be a passive component processing the events (e.g. got by sensor sniffing the traffic at remote locations or by local sensors sniffing the TAPed traffic).
2. How to decide what to autoban? Threshold? Only attackers?

[stonfute]

You can use iptables to drop packets on the server !

I don't think auto-ban is a really good idea ... because you have to deal with differents thresholds depending on type of alerts !
But a simple button would be great !

If you don't want to choose one firewall (such as iptables or nftables) you could implement a custom user command passing the ip to block as a parameter.

That function would be perfect for my gateway !

[unixfox]

@stonfute 👍 I opened an issue in relation to your request : #44.

[Boldairdev]

as for me my preferences would go both ways :

• in config :
  • define if autoban should be used
  • define your banning command (iptable, nftable)
  • define a generic bantime ( (n seconds)
  • define a generic threshold (n attacks in n seconds) gets banned for generic bantime
  • define optional threshold for each attack type, on the same model, if not defined, default to generic)
• autoban when threshold reached, using the user defined command
• add a button "ban ip/network immediately' to the interface using the same config user defined command and the generic bantime
• add a button "unban ip/network" (in case you banned/autobanned a false positive or you changed you mind and after all want the ip to attempt an SQL injection (could be useful if you think you have secured against a type of attack and want to test)
• in addition :
  • optionnally define types of attackers that should be always banned no matter what ignoring threshold (known mass scanners for example)
  • optionally define ip exempts form banning (you don't want to ban the ip from which you're trying intrusion tests on your server for instance)

this would be pretty much similar to what fail2ban does but going beyond it (much more attack types recognized in maltrail, and not having to define all those jails) and with the UI that's already here that would be a perfect tool :)

[krull]

👍 Suggestion: A mailtrail.conf command entry would suffice to add iptables rules via any of the major iptables helper programs such as csf, apf, shorewall or just plain iptables.

Something like:

USE_CSF true
CSF_COMMAND csf -d $FLAGED_IP

my two centavos 👍 keep up the great work!

[unixfox]

Great idea 👍 !

[stamparm]

@ALL auto generating feed of today's "known attackers"/"bad reputation" IPs that appeared more than N times in a short time-period (e.g. more than once in a 1 second period). This should be pretty "safe" to implement (and block)

<maltrail_server_ip>:8338/bad.txt would enlist all those "bad" IPs line-break separated, like in case of https://www.badips.com/get/list/any/2?age=7d

Then, you can do the automatic banning from any point outside by just doing the curl in some time periods, e.g.:

for i in $(curl https://www.badips.com/get/list/any/2?age=7d); do echo $i; done 2>/dev/null

does this sound good?

[krull]

Hi all. This looks great. We can then have csf or any other iptables script daemon monitor said file for changes to include in the ruleset

Sent from Samsung Mobile

-------- Original message --------
From: Miroslav Stampar notifications@github.com
Date:26/01/2016 18:01 (GMT+02:00)
To: stamparm/maltrail maltrail@noreply.github.com
Cc: Brendan Jocson krull.mcroth@gmail.com
Subject: Re: [maltrail] Feature Request : autobans/manual bans (#30)

@ALL auto generating feed of today's "known attackers"/"bad reputation" IPs that appeared more than N times in a short time-period (e.g. more than once in a 1 second period). This should be pretty "safe" to implement (and block)

<maltrail_server_ip>:8338/bad.txt would enlist all those "bad" IPs line-break separated, like in case of https://www.badips.com/get/list/any/2?age=7d

Then, you can do the automatic banning from any point outside by just doing the curl in some time periods, e.g.:

for i in $(curl https://www.badips.com/get/list/any/2?age=7d); do echo $i; done 2>/dev/null

does this sound good?

—
Reply to this email directly or view it on GitHub.

[Babzsak]

https://github.com/trick77/ipset-blacklist how about including this one?

[stamparm]

@Babzsak you mean lists from there? Majority of those are already being used in maltrail

[kutus]

I do it like this:
for IP in $(cat /var/log/maltrail/2016-03-29.log | grep [host] | grep -v heuristic | awk '{print $10}' | awk '!($0 in a) {a[$0];print}'); do if [$(grep -ic $IP /etc/hosts.deny) -eq 0]; then echo ALL: $IP >> /etc/hosts.deny; fi; done
Is easy to modify for iptables rules.

[pierrehegr]

I did it with fail2ban by creating filter.d/maltrail.conf with this failregex:

failregex = .* UDP IP <HOST>
It does work quite well

[mpochron]

@pierrehegr what u wrote here - it's not enough.

I wrote definition and configuration for fail2ban, also it's working with VestaCP, take look at my gist:
https://gist.github.com/machei/4d95c3c955fefbe26e6df65f7d3ae353

If u like my gist then give me star !

[MikhailKasimov]

6f9279a

[stamparm]

Look for FAIL2BAN_REGEX at README.md

[podivilov]

Does maltrail support csf autobans?

[stamparm]

Does maltrail support csf autobans?

@podivilov you have the means to apply recognized malicious IPs to whatever mechanism you require (even csf). please, take a look into #9313 (comment). by similar principle you can propagate the "blacklist" to whatever "autoban" system you use

[podivilov]

Sounds good. Thank you! Mikhail Podivilov