Re: [Fail2ban-users] ProFtpd DROP net-fw TLS connection from client ftp
On Tue, Aug 08, 2017 at 03:55:52PM -0400, Bill Shirley wrote: Looks like you haven't opened up sftp(port 115) in Shorewall. Post on the shorewall-us...@lists.sourceforge.net list. Tom Eastep is very helpful. If it were fail2ban blocking traffic, you would see it in the log file. Note if you're not using fail2ban with ipsets actions instead of iptables, you're going to run into problems if you do a 'shorewall restart'. It will clear your bans. The solution there is not to go messing with the firewall behind shorewall's back. There is a 'shorewall' action which will, by default, run "shorewall reject " on a ban. If you restart shorewall, then, shorewall should remember that it was told to reject packets from that IP and re-instate it. If you still think the problem could be fail2ban, post your config, action, and log files. Bill On 8/8/2017 1:42 PM, Davide Marchi wrote: Hi friends, I tell you immediately that I am not clear whether the matter concerns Shorewall rather than Fail2ban, so you have pity for me :-) I've configured ProFtpd to connect by tls (SSLv3 TLSv1 -> Letsencypt certificate) and if I stop shorewall the "sftp" connection works fine, but with Shorewall up, it DROP the connection: Aug 8 18:50:10 server kernel: [16438563.572121] Shorewall:net-fw:DROP:IN=eth0 OUT= MAC=00:50:56:3c:a8:50:00:08:e3:ff:fd:90:08:00 SRC=132.142.22.10 DST=44.320.032.111 LEN=60 TOS=0x00 PREC=0x00 TTL=56 ID=63283 DF PROTO=TCP SPT=33175 DPT=55298 WINDOW=29200 RES=0x00 SYN URGP=0 Now I wondering where is the problem, I don't know if is Fail2ban to tell to Shorewall to Drop this connection or if I should open a specific question on Shorewall ML. Many thanks to all! Davide Italy -- Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot ___ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users -- Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot ___ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users -- For more information, please reread. signature.asc Description: PGP signature -- Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot___ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users
Re: [Fail2ban-users] ProFtpd DROP net-fw TLS connection from client ftp
Hi, There is a big difference between sftp (SSH file transfer) and ftps (FTP over SSL). For SFTP, port 115 seems to be reserved (but I believe most ssh implementations just use the ssh port (22) for this). For FTPS, ports 989 (data) and 990 are reserved. It depends on what you configured in proftpd, maybe it can do both protocols. The commmand "sudo netstat -tunlp | grep -i proftp" will show you on which ports your running instance of proftpd is listening. Then decide which ports you need to open in your firewall. Anyway, this is no fail2ban question :) Good luck, Tom Hendrikx On 09-08-17 10:16, Davide Marchi wrote: > Il 2017-08-08 21:55 Bill Shirley ha scritto: >> Looks like you haven't opened up sftp(port 115) in Shorewall. Post on >> the >> shorewall-us...@lists.sourceforge.net list. Tom Eastep is very helpful. > > > I've open the 115 port both with Shorewall and PROFTPD (and restart), > but with no luck. > Now I open a post to Shorewall-users! > > >> >> If it were fail2ban blocking traffic, you would see it in the log file. >> > > > Yes I know, but I had the fear of not having read well all the logs.. > > >> Note if you're not using fail2ban with ipsets actions instead of >> iptables, you're >> going to run into problems if you do a 'shorewall restart'. It will >> clear your bans. >> > > > I think I'm right in this situation! Obviously I would like to switch to > Ipsets mode now that you warned me of the danger (and thank you very > much for that!) > Could you give me some documentation link to deepen the topic? > > >> If you still think the problem could be fail2ban, post your config, >> action, and log >> files. >> >> Billlists.sourceforge.net/lists/listinfo/fail2ban-users > > > > > Many thanks Bill! > > -- > > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > ___ > Fail2ban-users mailing list > Fail2ban-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/fail2ban-users -- Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot ___ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users
Re: [Fail2ban-users] ProFtpd DROP net-fw TLS connection from client ftp
Il 2017-08-08 21:55 Bill Shirley ha scritto: Looks like you haven't opened up sftp(port 115) in Shorewall. Post on the shorewall-us...@lists.sourceforge.net list. Tom Eastep is very helpful. I've open the 115 port both with Shorewall and PROFTPD (and restart), but with no luck. Now I open a post to Shorewall-users! If it were fail2ban blocking traffic, you would see it in the log file. Yes I know, but I had the fear of not having read well all the logs.. Note if you're not using fail2ban with ipsets actions instead of iptables, you're going to run into problems if you do a 'shorewall restart'. It will clear your bans. I think I'm right in this situation! Obviously I would like to switch to Ipsets mode now that you warned me of the danger (and thank you very much for that!) Could you give me some documentation link to deepen the topic? If you still think the problem could be fail2ban, post your config, action, and log files. Billlists.sourceforge.net/lists/listinfo/fail2ban-users Many thanks Bill! -- Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot ___ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users
