Merhabalar, fail2ban ile mysql’e yapilan brute force ataklari nasil engellenir bir bakalim.

1. Ilk olarak my.cnf icinde mysql error loglarini aktif edelim

log_warnings = 2
log_error = /var/log/mysql/error.log

/etc/init.d/mysql restart

2. Fail2ban icin mysql.conf adinda bir filtre olusturalim

vim /etc/fail2ban/filter.d/mysql.conf

ve icine alttaki satirlari yapistiralim, kaydedelim ve cikalim.

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named “host”. The tag “” can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P[\w\-.^_]+)
# Values: TEXT
#

failregex = Access denied for user ‘.*’@'<HOST>’

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

3. vim /etc/fail2ban/jail.conf dosyasi icine asagidaki satirlari ekleyip cikalim

[mysql]
enabled = true
port = 6033
filter = mysql
logpath = /var/log/mysql/error.log
maxretry = 1

4. Filtremizin dogru calisip calismadigini kontrol edelim.

fail2ban-regex /var/log/mysql/error.log /etc/fail2ban/filter.d/mysql.conf

Eger asagidaki bir hata alirsaniz /usr/share/fail2ban/server/datedetector.py dosyasina bir ekleme yapmalisiniz

Found a match for ‘150813 15:32:54 [Warning] Access denied for user ‘root’@’10.9.5.55’ (using password: YES)
‘ but no valid date/time found for ‘150813 15:32:54 [Warning] Access denied for user ‘root’@’10.9.5.55‘ (using password: YES)
‘. Please contact the author in order to get support for this format

vim /usr/share/fail2ban/server/datedetector.py dosyasini acip finally: satirini bulup asagidaki satirlari ekleyin.

# MySQL date detector
template = DateStrptime()
template.setName(“YearMonthDay Hour:Minute:Second”)
template.setRegex(“\d{2}\d{2}\d{2} {1,2}\d{1,2}:\d{2}:\d{2}”)
template.setPattern(“%y%m%d %H:%M:%S”)
self.__templates.append(template)

dogru sekilde ekledikten sonra tekrar filtremizi kontrol edelim.

fail2ban-regex /var/log/mysql/error.log /etc/fail2ban/filter.d/mysql.conf

Success, the total number of match is 46 

Herhangi bir hata almadiysaniz guzel engellemeler diyor ve gidiyorum.

Sevgiler.