search

Keleo / Fail2BanBundle

Fail2Ban plugin for Kimai to prevent automated attacks
https://www.kimai.org/store/fail2ban-bundle.html
MIT License
6 stars 4 forks source link

Questionable fail2ban logging #6

Closed N247S closed 1 year ago

N247S commented 1 year ago

So I tested out if fail2ban was working, as it doesn't generate a fail2ban.log file upon activation. And I noticed a few things which might be worth looking into?

First, the plugin doesn't generate a fail2ban.log file until a failed login-attempt has been made. The problem with this is that fail2ban will crash if a logfile is not found, meaning no protection as the service is terminated. It will not mention that if you just restart fail2ban (so that is bad on their part), but I think an easy-fix is to just generate an empty file if not exist upon starting kimai?

Second, I tested a failed-login attempt which printed the following entry:

[2022-08-01 15:38:18] fail2ban.ERROR: 127.0.0.1 [] []

I am pretty sure fail2ban won't ban the localhost, but it is pretty curious how it should protect against brute-force logins if this is all the information it gets.

Information: Kimai version: 1.21 stable Ubuntu 20.04 plugin version: I cloned the github today, so not sure? I guese 1.1, but I cannot confirm it as it doesn't show up in the plugins-list in the admin-panel.

If you need additional information, feel free to ask!

kevinpapst commented 1 year ago

From the README:

Bildschirmfoto 2022-08-01 um 15 50 36

If there is a wrong IP address, you are either testing locally or have a misconfiguration in your webserver/proxy. The plugin takes the Remote IP from the environment.

N247S commented 1 year ago

Ahh, missed the comment about the log-file. Makes sence it is there.

About the ip-adress, now you mention that. I use nginx as first entry with reverse proxy to apache. So I rechecked the configuration. I had the host-configuration set correctly, but didnt enable the remoteip module.

So both problems were on my end. Thanks for the fast response!

kevinpapst commented 1 year ago

Thanks for your feedback!