github-com-docker-mailserver/docker-mailserver
1
0
Fork 0
mirror of https://github.com/docker-mailserver/docker-mailserver.git synced 2024-01-19 02:48:50 +00:00
Code Issues Projects Releases Wiki Activity
docker-mailserver/docs/content/config/security/fail2ban.md

127 lines
5.3 KiB
Markdown
Raw Normal View History

docs(refactor): Large refactor + additions + fixes Consistency pass, formatting cleanup and fixes, introduce admonitions, add front-matter. --- docs: Add front-matter --- docs: Fix and format links - Some links were invalid (eg files moved or renamed) - Some were valid but had invalid section headers (content removed or migrated) - Some use `http://` instead of `https://` when the website supports a secure connection. - Some already used the `[name][reference]` convention but often with a number that wasn't as useful for maintenance. - All referenced docs needed URLs replaced. Opted for the `[name][reference]` approach to group them all clearly at the bottom of the doc, especially with the relative URLs and in some cases many duplicate entries. - All `tomav` references from the original repo prior to switch to an organization have been corrected. - Minor cosmetic changes to the `name` part of the URL, such as for referencing issues to be consistent. - Some small changes to text body, usually due to duplicate URL reference that was unnecessary (open relay, youtous) - Switched other links to use the `[name][reference]` format when there was a large group of URLs such as wikipedia or kubernetes. Github repos that reference projects related to `docker-mailserver` also got placed here so they're noticed better by maintainers. This also helped quite a bit with `mermaid` external links that are very long. - There was a Github Wiki supported syntax in use `[[name | link]]` for `fetchmail` page that isn't compatible by default with MkDocs (needs a plugin), converted to `[name][reference]` instead since it's a relative link. --- docs: Update commit link for LDAP override script Logic moved to another file, keeping the permalink commit reference so it's unaffected by any changes in the file referenced in future. --- docs: Heading corrections Consistency pass. Helps with the Table of Contents (top-right UI) aka Document Outline. docs: codefence cleanup --- docs: misc cleanup --- docs: Add Admonitions Switches `<details>` usage for collapsible admonitions (`???`) while other text content is switched to the visually more distinct admoniton (`!!!` or `???+`) style. This does affect editor syntax highlighting a bit and markdown linting as it's custom non-standard markdown syntax.
2021-03-01 10:41:19 +00:00
---
title: 'Security | Fail2Ban'
hide:
- toc # Hide Table of Contents for this page
---
added Fail2ban config page
2016-06-01 02:22:15 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
!!! quote "What is Fail2Ban (F2B)?"
Improve fail2ban docs and fix a typo (#2126) Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
2021-08-13 08:30:39 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
Fail2ban is an intrusion prevention software framework. Written in the Python programming language, it is designed to prevent against brute-force attacks. It is able to run on POSIX systems that have an interface to a packet-control system or firewall installed locally, such as \[NFTables\] or TCP Wrapper.
Improve fail2ban docs and fix a typo (#2126) Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
2021-08-13 08:30:39 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
[Source][wikipedia-fail2ban]
docs(refactor): Large refactor + additions + fixes Consistency pass, formatting cleanup and fixes, introduce admonitions, add front-matter. --- docs: Add front-matter --- docs: Fix and format links - Some links were invalid (eg files moved or renamed) - Some were valid but had invalid section headers (content removed or migrated) - Some use `http://` instead of `https://` when the website supports a secure connection. - Some already used the `[name][reference]` convention but often with a number that wasn't as useful for maintenance. - All referenced docs needed URLs replaced. Opted for the `[name][reference]` approach to group them all clearly at the bottom of the doc, especially with the relative URLs and in some cases many duplicate entries. - All `tomav` references from the original repo prior to switch to an organization have been corrected. - Minor cosmetic changes to the `name` part of the URL, such as for referencing issues to be consistent. - Some small changes to text body, usually due to duplicate URL reference that was unnecessary (open relay, youtous) - Switched other links to use the `[name][reference]` format when there was a large group of URLs such as wikipedia or kubernetes. Github repos that reference projects related to `docker-mailserver` also got placed here so they're noticed better by maintainers. This also helped quite a bit with `mermaid` external links that are very long. - There was a Github Wiki supported syntax in use `[[name | link]]` for `fetchmail` page that isn't compatible by default with MkDocs (needs a plugin), converted to `[name][reference]` instead since it's a relative link. --- docs: Update commit link for LDAP override script Logic moved to another file, keeping the permalink commit reference so it's unaffected by any changes in the file referenced in future. --- docs: Heading corrections Consistency pass. Helps with the Table of Contents (top-right UI) aka Document Outline. docs: codefence cleanup --- docs: misc cleanup --- docs: Add Admonitions Switches `<details>` usage for collapsible admonitions (`???`) while other text content is switched to the visually more distinct admoniton (`!!!` or `???+`) style. This does affect editor syntax highlighting a bit and markdown linting as it's custom non-standard markdown syntax.
2021-03-01 10:41:19 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
[wikipedia-fail2ban]: https://en.wikipedia.org/wiki/Fail2ban
docs(refactor): Large refactor + additions + fixes Consistency pass, formatting cleanup and fixes, introduce admonitions, add front-matter. --- docs: Add front-matter --- docs: Fix and format links - Some links were invalid (eg files moved or renamed) - Some were valid but had invalid section headers (content removed or migrated) - Some use `http://` instead of `https://` when the website supports a secure connection. - Some already used the `[name][reference]` convention but often with a number that wasn't as useful for maintenance. - All referenced docs needed URLs replaced. Opted for the `[name][reference]` approach to group them all clearly at the bottom of the doc, especially with the relative URLs and in some cases many duplicate entries. - All `tomav` references from the original repo prior to switch to an organization have been corrected. - Minor cosmetic changes to the `name` part of the URL, such as for referencing issues to be consistent. - Some small changes to text body, usually due to duplicate URL reference that was unnecessary (open relay, youtous) - Switched other links to use the `[name][reference]` format when there was a large group of URLs such as wikipedia or kubernetes. Github repos that reference projects related to `docker-mailserver` also got placed here so they're noticed better by maintainers. This also helped quite a bit with `mermaid` external links that are very long. - There was a Github Wiki supported syntax in use `[[name | link]]` for `fetchmail` page that isn't compatible by default with MkDocs (needs a plugin), converted to `[name][reference]` instead since it's a relative link. --- docs: Update commit link for LDAP override script Logic moved to another file, keeping the permalink commit reference so it's unaffected by any changes in the file referenced in future. --- docs: Heading corrections Consistency pass. Helps with the Table of Contents (top-right UI) aka Document Outline. docs: codefence cleanup --- docs: misc cleanup --- docs: Add Admonitions Switches `<details>` usage for collapsible admonitions (`???`) while other text content is switched to the visually more distinct admoniton (`!!!` or `???+`) style. This does affect editor syntax highlighting a bit and markdown linting as it's custom non-standard markdown syntax.
2021-03-01 10:41:19 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
## Configuration
Improve fail2ban docs and fix a typo (#2126) Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
2021-08-13 08:30:39 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
!!! warning
Improve fail2ban docs and fix a typo (#2126) Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
2021-08-13 08:30:39 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
DMS must be launched with the `NET_ADMIN` capability in order to be able to install the NFTables rules that actually ban IP addresses. Thus, either include `--cap-add=NET_ADMIN` in the `docker run` command, or the equivalent in the `compose.yml`:
docs(refactor): Large refactor + additions + fixes Consistency pass, formatting cleanup and fixes, introduce admonitions, add front-matter. --- docs: Add front-matter --- docs: Fix and format links - Some links were invalid (eg files moved or renamed) - Some were valid but had invalid section headers (content removed or migrated) - Some use `http://` instead of `https://` when the website supports a secure connection. - Some already used the `[name][reference]` convention but often with a number that wasn't as useful for maintenance. - All referenced docs needed URLs replaced. Opted for the `[name][reference]` approach to group them all clearly at the bottom of the doc, especially with the relative URLs and in some cases many duplicate entries. - All `tomav` references from the original repo prior to switch to an organization have been corrected. - Minor cosmetic changes to the `name` part of the URL, such as for referencing issues to be consistent. - Some small changes to text body, usually due to duplicate URL reference that was unnecessary (open relay, youtous) - Switched other links to use the `[name][reference]` format when there was a large group of URLs such as wikipedia or kubernetes. Github repos that reference projects related to `docker-mailserver` also got placed here so they're noticed better by maintainers. This also helped quite a bit with `mermaid` external links that are very long. - There was a Github Wiki supported syntax in use `[[name | link]]` for `fetchmail` page that isn't compatible by default with MkDocs (needs a plugin), converted to `[name][reference]` instead since it's a relative link. --- docs: Update commit link for LDAP override script Logic moved to another file, keeping the permalink commit reference so it's unaffected by any changes in the file referenced in future. --- docs: Heading corrections Consistency pass. Helps with the Table of Contents (top-right UI) aka Document Outline. docs: codefence cleanup --- docs: misc cleanup --- docs: Add Admonitions Switches `<details>` usage for collapsible admonitions (`???`) while other text content is switched to the visually more distinct admoniton (`!!!` or `???+`) style. This does affect editor syntax highlighting a bit and markdown linting as it's custom non-standard markdown syntax.
2021-03-01 10:41:19 +00:00
```yaml
cap_add:
- NET_ADMIN
```
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
!!! bug "Running Fail2Ban on Older Kernels"
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
DMS configures F2B to use NFTables, not IPTables (legacy). We have observed that older systems, for example NAS systems, do not support the modern NFTables rules. You will need to configure F2B to use legacy IPTables again, for example with the [``fail2ban-jail.cf``][github-file-f2bjail], see the [section on configuration further down below](#custom-files).
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
### DMS Defaults
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
F2B: update F2B after discussion in #3256 (#3288)
2023-05-01 13:00:35 +00:00
DMS will automatically ban IP addresses of hosts that have generated 6 failed attempts over the course of the last week. The bans themselves last for one week. The Postfix jail is configured to use `mode = extra` in DMS.
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
### Custom Files
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
!!! question "What is [`docker-data/dms/config/`][docs-dms-config-volume]?"
This following configuration files inside the `docker-data/dms/config/` volume will be copied inside the container during startup
1. `fail2ban-jail.cf` is copied to `/etc/fail2ban/jail.d/user-jail.local`
- with this file, you can adjust the configuration of individual jails and their defaults
F2B: update F2B after discussion in #3256 (#3288)
2023-05-01 13:00:35 +00:00
- there is an example provided [in our repository on GitHub][github-file-f2bjail]
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
2. `fail2ban-fail2ban.cf` is copied to `/etc/fail2ban/fail2ban.local`
- with this file, you can adjust F2B behavior in general
F2B: update F2B after discussion in #3256 (#3288)
2023-05-01 13:00:35 +00:00
- there is an example provided [in our repository on GitHub][github-file-f2bconfig]
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
[docs-dms-config-volume]: ../../faq.md#what-about-the-docker-datadmsconfig-directory
[github-file-f2bjail]: https://github.com/docker-mailserver/docker-mailserver/blob/master/config-examples/fail2ban-jail.cf
[github-file-f2bconfig]: https://github.com/docker-mailserver/docker-mailserver/blob/master/config-examples/fail2ban-fail2ban.cf
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
fail2ban: add 'log' command (#3299) Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
2023-05-02 22:13:44 +00:00
### Viewing All Bans
When just running
```bash
setup fail2ban
```
the script will show all banned IP addresses.
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
### Managing Bans
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
You can manage F2B with the `setup` script. The usage looks like this:
```bash
docker exec <CONTAINER NAME> setup fail2ban [<ban|unban> <IP>]
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
```
fail2ban: add 'log' command (#3299) Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
2023-05-02 22:13:44 +00:00
### Viewing the Log File
```bash
docker exec <CONTAINER NAME> setup fail2ban log
```
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
## Running Inside A Rootless Container
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
[`RootlessKit`][rootless::rootless-kit] is the _fakeroot_ implementation for supporting _rootless mode_ in Docker and Podman. By default, RootlessKit uses the [`builtin` port forwarding driver][rootless::port-drivers], which does not propagate source IP addresses.
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
It is necessary for F2B to have access to the real source IP addresses in order to correctly identify clients. This is achieved by changing the port forwarding driver to [`slirp4netns`][rootless::slirp4netns], which is slower than the builtin driver but does preserve the real source IPs.
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
[rootless::rootless-kit]: https://github.com/rootless-containers/rootlesskit
[rootless::port-drivers]: https://github.com/rootless-containers/rootlesskit/blob/v0.14.5/docs/port.md#port-drivers
[rootless::slirp4netns]: https://github.com/rootless-containers/slirp4netns
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
=== "Docker"
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
For [rootless mode][rootless::docker] in Docker, create `~/.config/systemd/user/docker.service.d/override.conf` with the following content:
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
!!! danger inline end
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
This changes the port driver for all rootless containers managed by Docker. Per container configuration is not supported, if you need that consider Podman instead.
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
```cf
[Service]
Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=slirp4netns"
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
```
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
And then restart the daemon:
docs(fail2ban): Add info about running in rootless containers (#2252) Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
2021-10-30 08:56:32 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
```console
$ systemctl --user daemon-reload
$ systemctl --user restart docker
```
Improve fail2ban docs and fix a typo (#2126) Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
2021-08-13 08:30:39 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
[rootless::docker]: https://docs.docker.com/engine/security/rootless
docs(refactor): Large refactor + additions + fixes Consistency pass, formatting cleanup and fixes, introduce admonitions, add front-matter. --- docs: Add front-matter --- docs: Fix and format links - Some links were invalid (eg files moved or renamed) - Some were valid but had invalid section headers (content removed or migrated) - Some use `http://` instead of `https://` when the website supports a secure connection. - Some already used the `[name][reference]` convention but often with a number that wasn't as useful for maintenance. - All referenced docs needed URLs replaced. Opted for the `[name][reference]` approach to group them all clearly at the bottom of the doc, especially with the relative URLs and in some cases many duplicate entries. - All `tomav` references from the original repo prior to switch to an organization have been corrected. - Minor cosmetic changes to the `name` part of the URL, such as for referencing issues to be consistent. - Some small changes to text body, usually due to duplicate URL reference that was unnecessary (open relay, youtous) - Switched other links to use the `[name][reference]` format when there was a large group of URLs such as wikipedia or kubernetes. Github repos that reference projects related to `docker-mailserver` also got placed here so they're noticed better by maintainers. This also helped quite a bit with `mermaid` external links that are very long. - There was a Github Wiki supported syntax in use `[[name | link]]` for `fetchmail` page that isn't compatible by default with MkDocs (needs a plugin), converted to `[name][reference]` instead since it's a relative link. --- docs: Update commit link for LDAP override script Logic moved to another file, keeping the permalink commit reference so it's unaffected by any changes in the file referenced in future. --- docs: Heading corrections Consistency pass. Helps with the Table of Contents (top-right UI) aka Document Outline. docs: codefence cleanup --- docs: misc cleanup --- docs: Add Admonitions Switches `<details>` usage for collapsible admonitions (`???`) while other text content is switched to the visually more distinct admoniton (`!!!` or `???+`) style. This does affect editor syntax highlighting a bit and markdown linting as it's custom non-standard markdown syntax.
2021-03-01 10:41:19 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
=== "Podman"
Improve fail2ban docs and fix a typo (#2126) Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
2021-08-13 08:30:39 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
[Rootless Podman][rootless::podman] requires adding the value `slirp4netns:port_handler=slirp4netns` to the `--network` CLI option, or `network_mode` setting in your `compose.yml`:
Improve fail2ban docs and fix a typo (#2126) Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
2021-08-13 08:30:39 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
!!! example
Improve fail2ban docs and fix a typo (#2126) Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
2021-08-13 08:30:39 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
```yaml
services:
mailserver:
network_mode: "slirp4netns:port_handler=slirp4netns"
environment:
- ENABLE_FAIL2BAN=1
- NETWORK_INTERFACE=tap0
...
```
Improve fail2ban docs and fix a typo (#2126) Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
2021-08-13 08:30:39 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
You must also add the ENV `NETWORK_INTERFACE=tap0`, because Podman uses a [hard-coded interface name][rootless::podman::interface] for `slirp4netns`. `slirp4netns` is not compatible with user-defined networks!
Improve fail2ban docs and fix a typo (#2126) Co-authored-by: Georg Lauterbach <44545919+georglauterbach@users.noreply.github.com>
2021-08-13 08:30:39 +00:00
docs: update F2B docs & bind mount links (#3293)
2023-04-26 08:05:42 +00:00
[rootless::podman]: https://github.com/containers/podman/blob/v3.4.1/docs/source/markdown/podman-run.1.md#--networkmode---net
[rootless::podman::interface]: https://github.com/containers/podman/blob/v3.4.1/libpod/networking_slirp4netns.go#L264
Reference in a new issue Copy permalink