search

roots / trellis

WordPress LEMP stack with PHP 8.2, Composer, WP-CLI and more
https://roots.io/trellis/
MIT License
2.51k stars 607 forks source link

Add built-in fail2ban filters #1375

Closed swalkinshaw closed 2 years ago

swalkinshaw commented 2 years ago

Trellis supported default fail2ban services previously but they were restricted to filters built into fail2ban itself (like sshd).

This adds filters defined by Trellis as well now by automatically creating the filter configuration files from templates.

Importantly, these filters will be disabled by default. Any time a new filter is added, it will also be added to fail2ban_services_custom with enabled set to false.

This achieves a few goals:

  1. makes it very easy to enable the built-in filters, which
  2. brings more awareness to them by adding them to group_vars/all/security.yml
  3. hopefully encourages more fail2ban filters to be created and used

There's two initial filters:

Which are both designed to prevent common DDoS attack vectors.

swalkinshaw commented 2 years ago

@TangRufus I think we "recommend" (or at least link to) https://github.com/ItinerisLtd/trellis-disable-xml-rpc but the fail2ban based solution should be better since it will prevent it at the iptables level so requests don't even reach Nginx.

Any thoughts?

tangrufus commented 2 years ago

the fail2ban based solution should be better since it will prevent it at the iptables level so requests don't even reach Nginx.

Agree.

I think we "recommend" (or at least link to) ItinerisLtd/trellis-disable-xml-rpc

Agree. They block at different levels. It should be okay to have both enabled at the same time.

We should update https://docs.roots.io, especially:

  1. how to determine whether an IP is being banned
  2. how to use fail2ban_ignoreip
  3. how to unban IPs
  4. warn about legitimate use cases of xmlrpc (e.g: jetpack)
  5. warn about wrong IPs, Nginx might log proxy IPs / VPN IPs (e.g: Cloudflare, workplace VPN, load balancer)
  6. how to adjust the rate limit

Question: When an IP is banned because of one of the fail2ban services (e.g: wordpress-xmlrpc), does fail2ban ban all its access (to different URLs) via http and https?

If yes, we should warn the users.

swalkinshaw commented 2 years ago

Question: When an IP is banned because of one of the fail2ban services (e.g: wordpress-xmlrpc), does fail2ban ban all its access (to different URLs) via http and https?

I believe so since the ban is done at the iptables level which doesn't know about URLs. So the initial detection is URL based, but the ban isn't.