Project

General

Profile

HowTo Configure Fail2ban For Redmine » History » Version 2

David Siewert, 2013-07-18 05:23

1 1 David Siewert
h1. HowTo Configure Fail2ban For Redmine
2
3
4
h2. Install
5
6
install fail2ban with apt-get if not installed ( or use yum, pacman or another package manager)
7
8
<pre>
9
 apt-get install fail2ban
10
</pre>
11
12
13
h2. Configure
14
15
create a new file in /etc/fail2ban/filter.d/redmine.conf
16
explanation: here we create our new filter to match failed login attempts
17
18
<pre>
19
# redmine configuration file
20
#
21
# Author: David Siewert
22
#
23
# $Revision$
24
#
25
 
26
[Definition]
27
 
28
failregex = Failed [-/\w]+ for .* from <HOST>
29
 
30
# Option:  ignoreregex
31
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
32
# Values:  TEXT
33
#
34
ignoreregex =
35
36
# Source:
37
#http://www.fail2ban.org/wiki/index.php/MANUAL_0_8
38
</pre>
39
40
41
42
43
add following lines somewhere in your /etc/fail2ban/jail.conf
44
explanation: here we enable our newly createt filter and add some configuration options
45
<pre>
46
[redmine]
47
enabled  = true
48
filter   = redmine
49
port     = 80,443
50
#backend  = polling
51
action   = iptables-allports[name=redmine]
52
logpath  = /var/log/redmine/default/production.log
53
maxretry = 5
54
findtime = 7320
55
bantime  = 7320
56
</pre>
57
58
note 1:
59
if you our web server uses local time, then you need to increase findtime and bantime accordingly to the drift in comparison to UTC time
60
in my example configuration i used 2 h + 2 minutes = 3600 * 2 +120  = 7320,
61 2 David Siewert
because my local server time was always 2 hours earlier and i added 2 minutes just in case
62 1 David Siewert
63
64
note 2:
65
if you do not use redmine in production mode, then you need to change the logpath as well
66
67
note 3:
68
if this configuration does not work, you can try uncommenting "backend  = polling"
69
70
h2. Test
71
72
73
if you make any changes, you can check the syntax with:
74
75
<pre>
76
fail2ban-regex /var/log/redmine/default/production.log /etc/fail2ban/filter.d/redmine.conf 
77
</pre>
78
79
80
finally start/restart fail2ban
81
82
<pre>
83
/etc/init.d/fail2ban restart
84
</pre>
85
86
and test if you can get yourself banned :)
87
note: your failed login attempts need to match the maxretry value in /etc/fail2ban/jail.conf