Mantykora 7's questions

SOLUTION

##To stop DOS attack from remote host.

[http-get-dos] 
enabled = true 
port = http,https 
filter = http-get-dos 
logpath = /var/log/apache*/access.log 
maxretry = 400 
findtime = 400 
bantime = 200 
ignoreip = 127.0.0.1
action = iptables[name=HTTP, port=http, protocol=tcp]

OS: Ubuntu Server 20.10

Http server: Apache

When I add the rule (to stop DOS attack from remote host) to jail.conf, fail2ban stops working. I got such a configuration in a few tutorials but they were Ubuntu 16 and 18.

enabled = true 
port = http,https 
filter = http-get-dos 
logpath = /var/log/apache*/access.log 
maxretry = 400 
findtime = 400 
bantime = 200 
ignoreip = 127.0.0.1
action = iptables[name=HTTP, port=http, protocol=tcp]

/etc/fail2ban/filter.d

http-get-dos.conf

# Fail2Ban configuration file 
[Definition]
failregex = ^<HOST> -.*"(GET|POST).* 
ignoreregex =

sudo systemctl status fail2ban

● fail2ban.service - Fail2Ban Service
     Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Thu 2021-01-07 09:05:29 UTC; 1h 23min ago
       Docs: man:fail2ban(1)
    Process: 82878 ExecStartPre=/bin/mkdir -p /run/fail2ban (code=exited, status=0/SUCCESS)
    Process: 82879 ExecStart=/usr/bin/fail2ban-server -xf start (code=exited, status=255/EXCEPTION)
   Main PID: 82879 (code=exited, status=255/EXCEPTION)

Jan 07 09:05:29 urial systemd[1]: Starting Fail2Ban Service...
Jan 07 09:05:29 urial systemd[1]: Started Fail2Ban Service.
Jan 07 09:05:29 urial fail2ban-server[82879]: 2021-01-07 09:05:29,370 fail2ban                [82879]: ERROR   Failed during configuration: While reading from '/etc/fail2ban/jail.local' [l>
Jan 07 09:05:29 urial fail2ban-server[82879]: 2021-01-07 09:05:29,372 fail2ban                [82879]: ERROR   Async configuration of server failed
Jan 07 09:05:29 urial systemd[1]: fail2ban.service: Main process exited, code=exited, status=255/EXCEPTION
Jan 07 09:05:29 urial systemd[1]: fail2ban.service: Failed with result 'exit-code'.

/etc/fail2ban$ cat jail.local

wlodek@urial:/etc/fail2ban$ cat jail.local
 ##To block failed login attempts use the below jail. 
[sshd]
enable = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretray = 3
findtime = 300
bandtime = 86400
ignoreip = 127.0.0.1  

##To block failed login attempts use the below jail. 
[apache] 
enabled = true 
port = http,https 
filter = apache-auth 
logpath = /var/log/apache2/*error.log 
maxretry = 3 
bantime = 600 
ignoreip = 127.0.0.1
 
##To block the remote host that is trying to request suspicious URLs, use the below jail. 
[apache-overflows] 
enabled = true 
port = http,https 
filter = apache-overflows 
logpath = /var/log/apache2/*error.log 
maxretry = 3 
bantime = 600 
ignoreip = 127.0.0.1
 
##To block the remote host that is trying to search for scripts on the website to execute, use the below jail. 
[apache-noscript] 
enabled = true 
port = http,https 
filter = apache-noscript 
logpath = /var/log/apache2/*error.log 
maxretry = 3 
bantime = 600 
ignoreip = 127.0.0.1
 
##To block the remote host that is trying to request malicious bot, use below jail. 
[apache-badbots] 
enabled = true 
port = http,https 
filter = apache-badbots 
logpath = /var/log/apache2/*error.log 
maxretry = 3 
bantime = 600 
ignoreip = 127.0.0.1
 
##To stop DOS attack from remote host. [http-get-dos] 
enabled = true 
port = http,https 
filter = http-get-dos 
logpath = /var/log/apache*/access.log 
maxretry = 400 
findtime = 400 
bantime = 200 
ignoreip = 127.0.0.1
action = iptables[name=HTTP, port=http, protocol=tcp]

I switched from Ubuntu to pfsense. Which ports and how to open the internet to work? If I do any (the last rule works) but that's not what I want. i just want to open (53,80,443)

Pfsense

Ubuntu iptables I had these ports open on ubuntu and the internet was working (80,53,443)

-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -m limit --limit 25/min --limit-burst 100 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

I can´t access to Cisco AP by http, I have to configure it. After connect to switch, my router (VyOS) show new IP address IP 192.168.1.61 1c:6a:7a:e2:80:63 2020/04/22 10:14:49 MyDHCPServer AP1c6a.7ae2.8063 I cannt ping

Reply from 192.168.1.61: bytes=32 time<1ms TTL=255
Reply from 192.168.1.61: bytes=32 time<1ms TTL=255
Reply from 192.168.1.61: bytes=32 time<1ms TTL=255
Reply from 192.168.1.61: bytes=32 time<1ms TTL=255
Reply from 192.168.1.61: bytes=32 time<1ms TTL=255

But I can´t access to Cisco AP by http://192.168.1.61 -> ro response.

I do not know how to do routing between Lan#1 192.168.1.0 and Lan#2 192.168.10.0. I tried with static routing set protocols static route 0.0.0.0/0 next-hop 192.168.10.0 distance '1' but I do not understand it.

1. Interfaces

run show interfaces ethernet 
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface        IP Address                        S/L  Description
---------        ----------                        ---  -----------
eth0             192.168.1.222/24                  u/u  OUTSIDE 
eth1             192.168.10.1/24                   u/u  INSIDE 

2. Gateway

gateway-address 192.168.1.1

3. NAT

I can do next NAT, then there is routing and internet but this (2 x NAT in network) is incorrect

edit nat source r 1
set outbound-interfeace eth0
set source address 192.168.10.0/24
set translation address masquerade

I have VyOS router, I want to block p2p traffic. Which ports must be blocked?. I tried 6881-6999, but it does not work. Thank you in advance for your help

set firewall name "FIREWALL-IN" 

set firewall name "FIREWALL-IN" default-action drop

set firewall name "FIREWALL-IN" rule 10 action accept
set firewall name "FIREWALL-IN" rule 10 state established enable
set firewall name "FIREWALL-IN" rule 10 state related enable


set firewall name "FIREWALL-IN" rule 100
set firewall name "FIREWALL-IN" rule 100 description "p2p - block 6881-6999"
set firewall name "FIREWALL-IN" rule 100 action drop
set firewall name "FIREWALL-IN" rule 100 protocol tcp_udp
set firewall name "FIREWALL-IN" rule 100 source port 6881-6999
set firewall name "FIREWALL-IN" rule 100 state established enable
set firewall name "FIREWALL-IN" rule 100 state related enable

UPDATE1

A

set firewall name "FIREWALL-IN" rule 100
set firewall name "FIREWALL-IN" rule 100 description "p2p - block 6881-6999"
set firewall name "FIREWALL-IN" rule 100 action drop
set firewall name "FIREWALL-IN" rule 100 protocol tcp_udp
set firewall name "FIREWALL-IN" rule 100 source port 6881-6999

B

set firewall name "FIREWALL-OUT" rule 100
set firewall name "FIREWALL-OUT" rule 100 description "p2p - block 6881-6999"
set firewall name "FIREWALL-OUT" rule 100 action drop
set firewall name "FIREWALL-OUT" rule 100 protocol tcp_udp
set firewall name "FIREWALL-OUT" rule 100 source port 6881-6999

UPDATE 2

set firewall name "FIREWALL-IN" 

set firewall name "FIREWALL-IN" default-action drop

set firewall name "FIREWALL-IN" rule 1 action accept
set firewall name "FIREWALL-IN" rule 1 state established enable
set firewall name "FIREWALL-IN" rule 1 state related enable

set firewall name "FIREWALL-IN" rule 10
set firewall name "FIREWALL-IN" rule 10 description "Allow http, https"
set firewall name "FIREWALL-IN" rule 10 action accept
set firewall name "FIREWALL-IN" rule 10 protocol tcp
set firewall name "FIREWALL-IN" rule 10 destination port 80,443
set firewall name "FIREWALL-IN" rule 10 state new enable
set firewall name "FIREWALL-IN" rule 10 state established enable
set firewall name "FIREWALL-IN" rule 10 state related enable

set firewall name "FIREWALL-IN" rule 15
set firewall name "FIREWALL-IN" rule 15 description "Allow dns"
set firewall name "FIREWALL-IN" rule 15 action accept
set firewall name "FIREWALL-IN" rule 15 protocol tcp_udp
set firewall name "FIREWALL-IN" rule 15 destination port 53
set firewall name "FIREWALL-IN" rule 15 state new enable
set firewall name "FIREWALL-IN" rule 15 state established enable
set firewall name "FIREWALL-IN" rule 15 state related enable

set firewall name "FIREWALL-IN" rule 20
set firewall name "FIREWALL-IN" rule 20 description "pop3,imap"
set firewall name "FIREWALL-IN" rule 20 action accept
set firewall name "FIREWALL-IN" rule 20 protocol tcp
set firewall name "FIREWALL-IN" rule 20 destination port 110,993,995
set firewall name "FIREWALL-IN" rule 20 state new enable
set firewall name "FIREWALL-IN" rule 20 state established enable
set firewall name "FIREWALL-IN" rule 20 state related enable

set firewall name "FIREWALL-IN" rule 30
set firewall name "FIREWALL-IN" rule 30 description "smtp"
set firewall name "FIREWALL-IN" rule 30 action accept
set firewall name "FIREWALL-IN" rule 30 protocol tcp
set firewall name "FIREWALL-IN" rule 30 destination port 25,587,465
set firewall name "FIREWALL-IN" rule 30 state new enable
set firewall name "FIREWALL-IN" rule 30 state established enable
set firewall name "FIREWALL-IN" rule 30 state related enable

set firewall name "FIREWALL-IN" rule 100 description "p2p - block 6881-6999"
set firewall name "FIREWALL-IN" rule 100 action drop
set firewall name "FIREWALL-IN" rule 100 protocol tcp_udp
set firewall name "FIREWALL-IN" rule 100 destination port 6881-6999
set firewall name "FIREWALL-IN" rule 100 state established enable
set firewall name "FIREWALL-IN" rule 100 state related enable

After installation Ubuntu Server 16 LTS, there is no usb 2.0. I can not connect mouse, keyboard, disc, pendrive e.t.c. On usb 3.0 it works.

Motherboard - new Gigabyte - GA-970A-DS3P

I installed Mail Server on Ubuntu Server 14: (tutorial https://www.linuxcbt.com/products_linuxcbt_postfix_edition)

1. Postfix + dovecot - works properly without MailScanner

2. ClamAV - clamd

3. Spamassassin

4. MailScanner

After install MailScanner mail server did not work.

A few years ago I did the same thing on OpenSuse11 and server running to this day. On Ubuntu I do not know why do not want to work.

difference between Ubuntu and OpenSuse

On Ubuntu Server Postfix configuration file /etc/postfix/main.cf there was no

header_checks = regexp:/etc/postfix/header_checks 

there was no file header_checks

/etc/postfix/header_checks

when I remove the line header_checks = regexp:/etc/postfix/header_checks from file main.cf server work.

Maybe this is simple solution, but..... I have no idea?

Thank you in advance for your help

main.cf

cat main.cf

# is /etc/mailname.
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file = /etc/ssl/certs/server.crt
smtpd_tls_key_file = /etc/ssl/private/server.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = mantykora.cleoni.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = mantykora.cleoni.com, localhost.cleoni.com, , localhost, cleoni.com
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.1.0/24
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4

# Wlodek 2016 02 11

home_mailbox = Maildir/
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_local_domain = cleoni.com
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtp_tls_note_starttls_offer = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes

smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_hostname, reject_invalid_hostname  

#Wlodek 2016 02 12 to support MailScanner

header_checks = regexp:/etc/postfix/header_checks

MailScanner.conf I add this https://www.mailscanner.info/postfix/#

%org-name% = Cleoni
%org-long-name% = Cleoni Unix
%web-site% = cleoni.pl

Run As User = postfix
Run As Group = postfix
MTA = postfix

Incoming Queue Dir = /var/spool/postfix/hold
Outgoing Queue Dir = /var/spool/postfix/incoming

Virus Scanners = clamav


Spam List = SBL+XBL


SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin

For some time during ping 192.168.0.2 I have something like this (DUP!) something is wrong with my network card or switch?

Image

Ubuntu server 15 - *192.168.0.222* Windows server 2012 - *192.168.0.2* - Virtual machine

64 bytes from 192.168.0.2: icmp_seq=3 ttl=128 time=0.369 ms (DUP!)
64 bytes from 192.168.0.2: icmp_seq=4 ttl=128 time=0.203 ms
64 bytes from 192.168.0.2: icmp_seq=4 ttl=128 time=0.280 ms (DUP!)
64 bytes from 192.168.0.2: icmp_seq=5 ttl=128 time=0.343 ms
64 bytes from 192.168.0.2: icmp_seq=5 ttl=128 time=0.443 ms (DUP!)
64 bytes from 192.168.0.2: icmp_seq=6 ttl=128 time=0.306 ms
64 bytes from 192.168.0.2: icmp_seq=6 ttl=128 time=0.393 ms (DUP!)
64 bytes from 192.168.0.2: icmp_seq=7 ttl=128 time=0.283 ms
64 bytes from 192.168.0.2: icmp_seq=7 ttl=128 time=0.380 ms (DUP!)

wlodek@ubuntu:/etc/network$ cat interfaces
auto lo
iface lo inet loopback

auto eth0 
iface eth0 inet manual
bond-master bond0 

auto eth1
iface eth1 inet manual
bond-master bond0


    #Interface
    auto bond0

    iface bond0 inet static
        address 192.168.0.222
        netmask 255.255.255.0
        gateway 192.168.0.100
        dns-nameserver 8.8.8.8

    bond-mode 6
    bond-miimon 100
    bond-slaves none

ping from 192.168.0.79(Ubuntu server 15 (Samba)) to 192.168.0.2 Windows serevr 2012 no DUP!

192.168.0.79

wlodek@Samba:~$ ifconfig
eth0      Link encap:Ethernet  HWaddr 00:1a:4d:25:11:c7  
          inet addr:192.168.0.79  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::21a:4dff:fe25:11c7/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4303692 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2829493 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:6299362962 (6.2 GB)  TX bytes:502897264 (502.8 MB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:12773 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12773 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1200613 (1.2 MB)  TX bytes:1200613 (1.2 MB)

64 bytes from 192.168.0.2: icmp_seq=1 ttl=128 time=0.589 ms
64 bytes from 192.168.0.2: icmp_seq=2 ttl=128 time=0.346 ms
64 bytes from 192.168.0.2: icmp_seq=3 ttl=128 time=0.376 ms
64 bytes from 192.168.0.2: icmp_seq=4 ttl=128 time=0.319 ms
64 bytes from 192.168.0.2: icmp_seq=5 ttl=128 time=0.392 ms
64 bytes from 192.168.0.2: icmp_seq=6 ttl=128 time=0.379 ms

I can mount the Windows share drive in the following way:

mount.cifs //192.168.1.151/_wymiana /mnt/share_2 -o user=wega,password=1234

but I can not in this way:

mount.cifs //192.168.1.151/_wymiana /mnt/share_2 -o credentials=/root/.smbcredential_2

cat .smbcredential_2
username=wega   
password=1234

Debugging with strace

strace -f -e trace=mount mount -t cifs //192.168.1.151/_wymiana /mnt/share_2 -o credentials=/root/.smbcredential_2
Process 3338 attached
Process 3339 attached
[pid  3339] +++ exited with 0 +++
[pid  3338] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3339, si_status=0, si_utime=0, si_stime=0} ---
[pid  3338] mount("//192.168.1.151/_wymiana", ".", "cifs", 0, "ip=192.168.1.151,unc=\\\\192.168.1"...) = -1 EACCES (Permission denied)
mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
[pid  3338] +++ exited with 32 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3338, si_status=32, si_utime=0, si_stime=0} ---
+++ exited with 32 +++

thank you in advance for your help