feat: add auth reject logging for fail2ban integration#9
Closed
jozefrebjak wants to merge 2 commits intodevelopfrom
Closed
feat: add auth reject logging for fail2ban integration#9jozefrebjak wants to merge 2 commits intodevelopfrom
jozefrebjak wants to merge 2 commits intodevelopfrom
Conversation
Add AUTH_REJECT_LOG env var that enables logging of Access-Reject events to a file using the FreeRADIUS linelog module. Only logs entries where Calling-Station-Id is present (skip internal/empty requests). Log format: timestamp : Auth-Reject : user=X calling-station-id=X called-station-id=X The log file can be mounted and consumed by fail2ban on the host VM to block brute force attackers via iptables/nftables. Closes #8
Update README with AUTH_REJECT_LOG feature documentation including Docker Swarm setup, fail2ban filter/jail configuration, and Prometheus monitoring via fail2ban-exporter. Also update Custom Post-Auth Queries section with EXTENDED option documentation.
Contributor
Author
|
Closing - fail2ban on VM cannot block Calling-Station-Id since traffic comes from NAS, not directly from attacker. Need to block at ASA level instead. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AUTH_REJECT_LOGenv var that enables logging Access-Reject events to/var/log/freeradius/auth-reject.loglinelogmodule inPost-Auth-Type REJECTsectionCalling-Station-Idis present (skips internal requests without client IP)AUTH_REJECT_LOG_PATHto customize log file locationLog format
Usage
Mount log directory for fail2ban access:
Test plan
AUTH_REJECT_LOG=trueCalling-Station-Idis loggedCalling-Station-Idis NOT loggedCloses #8