S.ivanov: Add initial page - adaptations contributed by Lukas Fülling

2024-05-27T16:19:02Z

Add initial page - adaptations contributed by Lukas Fülling

New page

Here we describe in short how you can set up <code>fail2ban</code> for the Proxmox Backup Server API to block IP addresses (temporarily) if there were too many wrong login attempts submitted through them.
The page is based upon the [https://pve.proxmox.com/wiki/Fail2ban HOWTO for Proxmox VE]

== Install fail2ban ==

Execute the following commands as root in a shell on the Proxmox Backup Server host, for example connected through SSH or via the web console in the Proxmox Backup Server web interface.

apt update
apt install fail2ban

== Setup Base Config ==

We recommend to use the <code>/etc/fail2ban/jail.local</code> file, as settings in this file take precedence over identical settings of <code>jail.conf</code>.

Use <code>jail.conf</code> as a template:

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

And adapt the settings to your needs in the copied over <code>jail.local</code>.

The main reason for using this separate file is that the original <code>jail.conf</code> could be overwritten by fail2ban package updates, while the copied <code>jail.local</code> will not, so you can better manage updates that way.

== Setup Jail ==

=== Base Config ===
Add the following to the end of the copied over file <code>/etc/fail2ban/jail.local</code>:

<pre>
[proxmox-backup-server]
enabled = true
port = https,http,8007
filter = proxmox-backup-server
logpath = /var/log/proxmox-backup/api/auth.log
maxretry = 3
findtime = 2d
bantime = 1h
</pre>

Tip: Time properties like <code>bantime</code> and <code>findtime</code> also allow combinations like <code>2m 30s</code>. You can test if a value is valid and what the actually resulting ban seconds are using the <code>fail2ban-client --str2sec '1d 12h'</code> command.
See the <code>jail.conf</code> manual page<ref><code>jail.conf</code> manual page https://manpages.debian.org/stable/fail2ban/jail.conf.5.en.html</ref> for description of all options.

=== Filter Config ===
Create the file <code>/etc/fail2ban/filter.d/proxmox-backup-server.conf</code> with the following content:

<pre>
[Definition]
failregex = authentication failure; rhost=\[<HOST>\]:\d+ user=.* msg=.*
ignoreregex =

</pre>

=== Restart Service to Enable Config ===
Use:
systemctl restart fail2ban
to activate the config addition and arm fail2ban for the Proxmox Backup Server API.

== Test fail2ban Config ==
You can test your configuration by trying to log in through the web interface with a wrong password or a wrong user, and then issue the command:

<pre>
fail2ban-regex /var/log/proxmox-backup/api/auth.log /etc/fail2ban/filter.d/proxmox-backup-server.conf
</pre>

You should have *at least* a "Failregex: 1 total" at the top of the "Results" section (and "1 matched" at the bottom)

Note, if you tried too often and got yourself banned (your IP is reported by <code>fail2ban-client get proxmox-backup-server banned</code>) you can use <code>fail2ban-client unban <IP></code> (replace <code><IP></code> with the IP address) to manually unblock yourself.

== Links ==
* [http://www.fail2ban.org/wiki/index.php/Main_Page Fail2Ban ]

[[Category: HOW-TO]]

Fail2ban - Revision history

S.ivanov: Add initial page - adaptations contributed by Lukas Fülling