mirror of
https://github.com/home-assistant/home-assistant.io.git
synced 2025-07-23 01:06:52 +00:00
Fix style issues (#6114)
This commit is contained in:
Fabian Affolter
GitHub
parent
1ce0d2df6a
commit
5108fcc19d
@ -10,29 +10,34 @@ footer: true
|
||||
ha_category: Infrastructure
|
||||
---
|
||||
|
||||
This is a quick guide on how to setup fail2ban for Home Assistant. Contains extracts from [Is there a log file for invalid logins? \(Blocking hackers\)](https://community.home-assistant.io/t/is-there-a-log-file-for-invalid-logins-blocking-hackers/2892).
|
||||
This is a quick guide on how to set up `fail2ban` for Home Assistant. Contains extracts from [Is there a log file for invalid logins? \(Blocking hackers\)](https://community.home-assistant.io/t/is-there-a-log-file-for-invalid-logins-blocking-hackers/2892).
|
||||
|
||||
**Installing fail2ban**
|
||||
## {% linkable_title Installing fail2ban %}
|
||||
|
||||
Debian/Ubuntu:
|
||||
|
||||
```bash
|
||||
sudo apt-get install fail2ban
|
||||
$ sudo apt-get install fail2ban
|
||||
```
|
||||
|
||||
CentOS/RHEL:
|
||||
|
||||
```bash
|
||||
sudo yum install epel-release
|
||||
sudo yum install -y fail2ban
|
||||
$ sudo yum install epel-release
|
||||
$ sudo yum install -y fail2ban
|
||||
```
|
||||
Fedora:
|
||||
|
||||
```bash
|
||||
sudo dnf install -y fail2ban
|
||||
$ sudo dnf install -y fail2ban
|
||||
```
|
||||
|
||||
For other package managers use the appropriate commands.
|
||||
|
||||
**Enable Home Assistant Logging**
|
||||
## {% linkable_title Enable Home Assistant Logging %}
|
||||
|
||||
First, enable `http.ban` logging in `configuration.yaml` file for your Home Assistant instance:
|
||||
|
||||
First, enable http.ban logging in `configuration.yaml` file for your Home Assistant instance:
|
||||
```yaml
|
||||
logger:
|
||||
default: critical
|
||||
@ -41,23 +46,27 @@ logger:
|
||||
```
|
||||
|
||||
Restart Home Assistant to activate the changes:
|
||||
|
||||
```bash
|
||||
sudo systemctl restart home-assistant
|
||||
$ sudo systemctl restart home-assistant
|
||||
```
|
||||
|
||||
Tail the Home Assistant log then log out of the Home Assistant web interface and attempt logging in with an incorrect password, look for a line like `Login attempt or request with invalid authentication from xxx.xxx.xxx.xxx`:
|
||||
|
||||
```bash
|
||||
tail -f /home/homeassistant/.homeassistant/home-assistant.log | grep WARNING
|
||||
$ tail -f /home/homeassistant/.homeassistant/home-assistant.log | grep WARNING
|
||||
2018-08-29 14:28:15 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from xxx.xxx.xxx.xxx
|
||||
```
|
||||
|
||||
**Configure fail2ban**
|
||||
## {% linkable_title Configure fail2ban %}
|
||||
|
||||
Next we will create a filter and jail file for `fail2ban`:
|
||||
|
||||
Next we will create a filter and jail file for fail2ban:
|
||||
- `/etc/fail2ban/filter.d/ha.conf`
|
||||
- `/etc/fail2ban/jail.d/ha.conf`
|
||||
|
||||
Contents of `/etc/fail2ban/filter.d/ha.conf`:
|
||||
|
||||
```ini
|
||||
[INCLUDES]
|
||||
before = common.conf
|
||||
@ -67,7 +76,8 @@ failregex = ^%(__prefix_line)s.*Login attempt or request with invalid authentica
|
||||
ignoreregex =
|
||||
```
|
||||
|
||||
Contents of `/etc/fail2ban/jail.d/ha.conf` (Note that you'll need to change the `logpath` to match your logfile which will be different from the path listed.):
|
||||
Contents of `/etc/fail2ban/jail.d/ha.conf`. Note that you'll need to change the `logpath` to match your logfile which will be different from the path listed.:
|
||||
|
||||
```ini
|
||||
[DEFAULT]
|
||||
# Email config
|
||||
@ -90,17 +100,20 @@ bantime = 30 # during testing it is useful to have a short ban interval, comment
|
||||
maxretry = 3
|
||||
```
|
||||
|
||||
Restart fail2ban:
|
||||
Restart `fail2ban`:
|
||||
|
||||
```bash
|
||||
sudo systemctl restart fail2ban
|
||||
```
|
||||
|
||||
Confirm fail2ban is running:
|
||||
Confirm `fail2ban` is running:
|
||||
|
||||
```bash
|
||||
sudo systemctl status fail2ban
|
||||
```
|
||||
|
||||
Check that the ha jail is active:
|
||||
|
||||
```bash
|
||||
sudo fail2ban-client status
|
||||
Status
|
||||
@ -108,7 +121,7 @@ Status
|
||||
`- Jail list: ha
|
||||
```
|
||||
|
||||
**Testing fail2ban**
|
||||
## {% linkable_title Testing fail2ban %}
|
||||
|
||||
Tail the fail2ban log file then log out of the Home Assistant web interface and attempt to log in again with an incorrect password.
|
||||
```bash
|
||||
@ -131,24 +144,28 @@ sudo tail -f -n 20 /var/log/fail2ban.log
|
||||
2018-08-29 13:28:23,941 fail2ban.actions [10208]: NOTICE [ha] Unban xxx.xxx.xxx.xxx
|
||||
```
|
||||
|
||||
Now that fail2ban is working it can be enabled for startup at boot time, also raise the bantime from 30 seconds to what ever you would like, I used 8 hours which is 28800 seconds:
|
||||
Now that fail2ban is working it can be enabled for startup at boot time, also raise the bantime from 30 seconds to what ever you would like. 8 hours is 28800 seconds.
|
||||
|
||||
```bash
|
||||
sudo sed -i 's/bantime = 30/bantime = 28800/g' /etc/fail2ban/jail.d/ha.conf
|
||||
sudo systemctl enable fail2ban
|
||||
sudo systemctl restart fail2ban
|
||||
$ sudo sed -i 's/bantime = 30/bantime = 28800/g' /etc/fail2ban/jail.d/ha.conf
|
||||
$ sudo systemctl enable fail2ban
|
||||
$ sudo systemctl restart fail2ban
|
||||
```
|
||||
|
||||
A final note, if you need to unban an IP it can be done with fail2ban-client:
|
||||
A final note, if you need to unban an IP it can be done with `fail2ban-client`:
|
||||
|
||||
```bash
|
||||
sudo fail2ban-client set JAILNAME unbanip IPADDRESS
|
||||
$ sudo fail2ban-client set JAILNAME unbanip IPADDRESS
|
||||
```
|
||||
eg:
|
||||
|
||||
```bash
|
||||
sudo fail2ban-client set ha unbanip xxx.xxx.xxx.xxx
|
||||
$ sudo fail2ban-client set ha unbanip xxx.xxx.xxx.xxx
|
||||
```
|
||||
|
||||
Fail2ban should now be configured and running, if an IP address is banned you will recieve an email with whois details about the IP address that attempted to connect, if not you will need configure postfix or another MTA (Mail Transport Agent).
|
||||
Fail2ban should now be configured and running, if an IP address is banned you will recieve an email with WHOIS details about the IP address that attempted to connect, if not you will need configure Postfix or another MTA (Mail Transport Agent).
|
||||
|
||||
If you want to read more about `fail2ban`, some links are below:
|
||||
|
||||
If you want to read more about fail2ban, some links are below:
|
||||
- [fail2ban Split config](http://www.fail2ban.org/wiki/index.php/FEATURE_Split_config)
|
||||
- [How To Protect SSH with Fail2Ban on Ubuntu 14.04](https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-14-04)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user