Hallo, ich habe den Docker "lscr.io/linuxserver/fail2ban" installiert um NPM abzusichern.

fail2ban erkennt auch "password missmatch" und möchte mich bannen:

 

 2025-03-15 23:54:19,084 14F4E1F82B28 INFO  Starting Fail2ban v1.1.0
 2025-03-15 23:54:19,084 14F4E0533B38 INFO  Observer start...
 2025-03-15 23:54:19,096 14F4E1F82B28 INFO  Connected to fail2ban persistent database '/config/fail2ban/fail2ban.sqlite3'
 2025-03-15 23:54:19,099 14F4E1F82B28 INFO  Creating new jail 'npm'
 2025-03-15 23:54:19,100 14F4E1F82B28 INFO  Jail 'npm' uses poller {}
 2025-03-15 23:54:19,100 14F4E1F82B28 INFO  Initiated 'polling' backend
 2025-03-15 23:54:19,103 14F4E1F82B28 INFO    maxRetry: 3
 2025-03-15 23:54:19,103 14F4E1F82B28 INFO    findtime: 600
 2025-03-15 23:54:19,103 14F4E1F82B28 INFO    banTime: 7200
 2025-03-15 23:54:19,104 14F4E1F82B28 INFO    encoding: UTF-8
 2025-03-15 23:54:19,107 14F4E1F82B28 INFO  Added logfile: '/var/log/proxy-host-4_error.log' (pos = 0, hash = 5ed430604b3c65d5546b9a692339ce449c54bfcd)
 2025-03-15 23:54:19,109 14F4E1F82B28 INFO  Added logfile: '/var/log/proxy-host-6_error.log' (pos = 0, hash = )
 2025-03-15 23:54:19,112 14F4E1F82B28 INFO  Added logfile: '/var/log/proxy-host-5_error.log' (pos = 0, hash = 690b37ad739d653c5afe2fd0da8543e0a39c3b63)
 2025-03-15 23:54:19,114 14F4E1F82B28 INFO  Added logfile: '/var/log/proxy-host-1_error.log' (pos = 0, hash = 738c72875720ad59519de582c2b82e3f8afc0b07)
 2025-03-15 23:54:19,115 14F4E1F82B28 INFO  Added logfile: '/var/log/proxy-host-2_error.log' (pos = 0, hash = )
 2025-03-15 23:54:19,117 14F4E1F82B28 INFO  Added logfile: '/var/log/proxy-host-3_error.log' (pos = 0, hash = )
 2025-03-15 23:54:19,119 14F4E1F82B28 INFO  Jail 'npm' started
 2025-03-15 23:54:57,450 14F4E00FBB38 INFO  [npm] Found 2003... - 2025-03-15 23:54:56
 2025-03-15 23:54:59,681 14F4E00FBB38 INFO  [npm] Found 2003... - 2025-03-15 23:54:59
 2025-03-15 23:55:59,351 14F4E00FBB38 INFO  [npm] Found 2003... - 2025-03-15 23:55:58
 2025-03-15 23:55:59,363 14F4DFEECB38 NOTIC [npm] Ban 2003:...
 2025-03-15 23:56:01,580 14F4E00FBB38 INFO  [npm] Found 2003... - 2025-03-15 23:56:01
 2025-03-15 23:56:50,558 14F4E00FBB38 INFO  [npm] Found 2003... - 2025-03-15 23:56:50

 

aber er kann es nicht, wie man sieht.

es muss über iptables laufen denn nftables gibt es nicht auf Unraid 7.0.1 - aber wie der Docker auf iptables zugreift oder wo ich da was einstellen muss: keine Ahnung!

 

Hinweis: "2003" habe ich für meine eigene IPv6 abgekürzt.

 

Edit:

meine jail.local habe ich so angepasst:

[DEFAULT]
bantime  = 2h
maxretry = 3
chain = INPUT

[npm]
enabled = true
port = https
backend = polling
logpath = /var/log/proxy-host-*_error.log
action = iptables-allports[name=npm]

 

chain und action habe ich hinzugefügt, aber klappt trotzdem nicht.

 

Problem: fail2ban erreicht iptables vom Unraid nicht.

Edited March 15, 20251 yr by Avenga

Update:

Nachdem ich die jail.local noch mal angepasst habe:

[DEFAULT]
bantime  = 2h
maxretry = 3
banaction = iptables-multiport[blocktype=DROP]

[npm]
enabled = true
port 	= 12345
backend = polling
logpath = /var/log/proxy-host-*_error.log
chain   = DOCKER-USER
action  = %(known/action)s

(mit und ohne "banaction:.." probiert")

 

will er iptabes aktivieren, aber es klappt nicht:

 

2025-03-16 07:06:44,992 1486D39EEB28 INFO  Jail 'npm' started
 2025-03-16 07:06:45,187 1486D195DB38 NOTIC [npm] Restore Ban 2003:da:xxx
 2025-03-16 07:06:45,217 1486D195DB38 ERROR 1486d29896f0 -- exec: { ip6tables -w -C f2b-npm -j RETURN >/dev/null 2>&1; } || { ip6tables -w -N f2b-npm || true; ip6tables -w -A f2b-npm -j RETURN; }
for proto in $(echo 'tcp' | sed 's/,/ /g'); do
{ ip6tables -w -C DOCKER-USER -p $proto -m multiport --dports 12345 -j f2b-npm >/dev/null 2>&1; } || { ip6tables -w -I DOCKER-USER -p $proto -m multiport --dports 12345 -j f2b-npm; }
done
 2025-03-16 07:06:45,218 1486D195DB38 ERROR 1486d29896f0 -- stderr: 'ip6tables: No chain/target/match by that name.'
 2025-03-16 07:06:45,219 1486D195DB38 ERROR 1486d29896f0 -- returned 1
 2025-03-16 07:06:45,220 1486D195DB38 ERROR Failed to execute ban jail 'npm' action 'iptables-multiport' info 'ActionInfo({'ip': '2003:da:xxx', 'family': 'inet6', 'fid': <function Actions.ActionInfo.<lambda> at 0x1486d2995a80>, 'raw-ticket': <function Actions.ActionInfo.<lambda> at 0x1486d2996200>})': Error starting action Jail('npm')/iptables-multiport: 'Script error

 

Edited March 16, 20251 yr by Avenga

ich komme der Ursache näher:

im Container sind "iptables v1.8.10 (nf_tables) vorhanden.

auf Unraid jedoch: iptables v1.8.11 (legacy)

k.a. wie ich den Container auf 1.8.11 legay kriegen kann, das kann wahrscheinlich nur der Entwickler