# HG changeset patch
# User IBBoard <dev@ibboard.co.uk>
# Date 1555959930 -3600
# Node ID 23c4f6a38b5763f27cef3c1cd97d21547cf51b46
# Parent  d3ef339b53a63eca568bcf85ac26cca3b6fdf275
Make Fail2Ban SSH rules more agressive

diff -r d3ef339b53a6 -r 23c4f6a38b57 common/fail2ban/ibb-sshd-bad-user.conf
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/common/fail2ban/ibb-sshd-bad-user.conf	Mon Apr 22 20:05:30 2019 +0100
@@ -0,0 +1,19 @@
+# Fail2Ban configuration file
+# Author: IBBoard
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values:  TEXT
+#
+failregex = Failed password for invalid user ([0-9a-z][0-9a-z]?|ec2-user|postgres|oracle|nagios|git|ftpuser|hadoop|zabbix|student|ubuntu|teamspeak3?|ts3(server|bot)?|jsboss|guest|csgoserver|minecraft|tomcat|applmgr|usuario|nexus|weblogic|vagrant|zimbra|jira|vyatta|qhsupport|cemergen|redmine|sinusbot|debian|asterisk) from <HOST> port [0-9]+ ssh2
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
diff -r d3ef339b53a6 -r 23c4f6a38b57 common/fail2ban/jail.local
--- a/common/fail2ban/jail.local	Wed Apr 17 12:05:32 2019 +0100
+++ b/common/fail2ban/jail.local	Mon Apr 22 20:05:30 2019 +0100
@@ -8,7 +8,15 @@
 filter   = sshd
 action   = firewall-ban[name=SSH,chain=Fail2Ban,port=222]
 logpath  = /var/log/secure
-maxretry = 5
+maxretry = 3
+bantime  = 604800
+
+[ssh-user-instaban]
+enabled  = true
+filter   = ibb-sshd-bad-user
+action   = firewall-ban[name=SSH-Instaban,chain=Fail2Ban,port=222]
+logpath  = /var/log/secure
+maxretry = 1
 bantime  = 604800
 
 [ssh-key-ban]
@@ -16,7 +24,7 @@
 filter   = ibb-sshd
 action   = firewall-ban[name=SSH-Key,chain=Fail2Ban,port=222]
 logpath  = /var/log/secure
-maxretry = 5
+maxretry = 3
 findtime = 604800
 bantime  = 604800
 
diff -r d3ef339b53a6 -r 23c4f6a38b57 manifests/templates.pp
--- a/manifests/templates.pp	Wed Apr 17 12:05:32 2019 +0100
+++ b/manifests/templates.pp	Mon Apr 22 20:05:30 2019 +0100
@@ -388,6 +388,9 @@
 	file { '/etc/fail2ban/filter.d/ibb-sshd.conf':
 		source => 'puppet:///common/fail2ban/ibb-sshd.conf',
 	}
+	file { '/etc/fail2ban/filter.d/ibb-sshd-bad-user.conf':
+		source => 'puppet:///common/fail2ban/ibb-sshd-bad-user.conf',
+	}
 	# Because one of our rules checks fail2ban's log, but the service dies without the file
 	file { '/var/log/fail2ban.log':
 		ensure => present,