Tango Devlopment

Tag: debian

fail2ban non-root startup
fail2ban runs as root by default. This is unnecessary for its functionality, other than to alter firewall rules. The firewall rules can be safely done, using sudo to enable the required calls. The Debian/Ubuntu init.d file has provisions to start fail2ban as a non-root user, but newer releases use systemd to start and stop the process. This requires a different procedure. This procedure is for my servers which use Shorewall to maintain the firewall. I will document my process for configuring fail2ban in another post. First, create the user fail2ban as system user with group(s) required to read the logs. Fail2ban does not need a shell. The home directory is set like similar system users on Ubuntu systems.
This procedure is for my servers which use Shorewall to maintain the firewall. I will document my process for configuring fail2ban in another post. First, create the user fail2ban as system user with group(s) required to read the logs. Fail2ban does not need a shell. The home directory is set like similar system users on Ubuntu systems.

useradd --system --no-create-home --home-dir /var/lib/fail2ban --groups adm,www-data --shell /usr/sbin/nologin fail2ban

If you are using an init.d script to start fail2ban, set the user in /etc/default/fail2ban. This value is not used by systemd. If you are using systemd there is no need to alter the /etc/default/fail2ban file.

If you are using systemd to start fail2ban, create the systemd file /etc/systemd/system/fail2ban.service.d/override.conf. Omit the [Unit] section if you are not using Shorewall.
```
[Service]
User=fail2ban
Group=adm
# Run ExecStartPre with root-permission
PermissionsStartOnly=true
ExecStartPre=/bin/chown -R fail2ban:adm /var/run/fail2ban
[Unit]
Requires=shorewall.service
After=shorewall.service
```
Create a sudoers file for fail2ban such as /etc/sudoers.d/fail2ban Ensure required operations are included in the Cmnd_Aalias definition. This file is configured to use shorewall and includes all the actions that could be called. If your sudoers configuration does not use an include directory, add the rules to your sudoers file, or enable use of an include directory.
```
# Sudoer rules for fail2ban
User_Alias FAIL2BAN = fail2ban
Cmnd_Alias FAIL2BAN = /sbin/shorewall allow, /sbin/shorewall6 allow, \
    /sbin/shorewall logdrop, /sbin/shorewall6 logdrop, \
    /sbin/shorewall drop, /sbin/shorewall6 drop, \
    /sbin/shorewall logreject, /sbin/shorewall6 logreject, \
    /sbin/shorewall logreject, /sbin/shorewall6 reject
FAIL2BAN ALL = NOPASSWD: FAIL2BAN
# EOF
```
Change the ownership of existing files.

chown -R fail2ban /var/log/fail2ban* /var/lib/fail2ban

Finally, stop and restart fail2ban, check for the fail2ban process, and check your fail2ban log for errors.
```
systemctl stop fail2ban
systemctl start fail2ban
ps -fu fail2ban
tail -60 /var/log/fail2ban.log | less
```
If you are using fail2ban or a similar application to rotate logs, edit the configuration to create new logs owned by the fail2ban userid.
If you are using fail2ban or a similar application to rotate logs, edit the configuration to create new logs owned by the fail2ban userid.
2020/10/12
init.d for Non-root Processes

When installing third-party applications, they often default to running as root. The server applications for TeamSite/LiveSite are among those. I have applied a simple modification to the init.d scripts that starts them as a non-root user. It also allows the scripts to be run by members of an administration group via sudo. This approach is applicable to other applications. (more…)

2018/06/04
Providing IPv6 DNS resolver data with radvd

One nagging issue I had with IPv6 was how to distribute DNS server addresses and search lists to my clients. It took a little research to find the solution. On IPv4 I had been using DHCP to do this, but DHCP didn’t seem to be right approach for IPv6. radvd can be used to distribute both types of data. The following article covers setup on Ubuntu and OpenWRT. The Ubuntu (Debian) examples below should work with any distribution using/etc//radvd.conf to configure radvd. (more…)

2011/08/08
Blocking Spam with Exim

Recent reports indicate that spam is increasing again. I have been using Exim to filter spam for several years. Some recent tuning I have done have decreased the percent of spam which reaches my spam filters. This article provides a discussion of the techniques used, and provides implementation examples. Spambots tend to be simple programs which don’t handle slow servers very well. Using a greylist is effective method of blocking them as they usually don’t retry. My latest changes use delays to cause many spambots to abandon their attempt. Greylisting is used only for poorly configured servers that make it to the Recipient command.

(more…)

2011/01/30
Implementing DKIM with Exim

This article was updated in February 2014 to reflect changes policy and reporting options. The earlier ADSP (Author Domain Signing Practices) information has been removed.

DomainKeys Identified Mail (DKIM) provides a method to confirm the origin of an e-mail. DKIM also provides some protection against tampering. Unlike SPF, this validation applies to the contents of the message when it is signed. Like SPF, the information required for validation is added to DNS. (more…)

2010/09/29
Cfengine 2 for Debian and Ubuntu
Cfengine is a declarative system configuration tool. This helps apply standards to system configuration. The configuration files specify the desired configuration and the engine applies these specifications to the system. It is useful to:
- Distribute configuration files;
- Install standard packages (including on Debian and Ubuntu with code provided here);
- Cleanup old files; and
- Ensure certain programs are/are not running.
This documentation applies to Cfengine version 2. . The latest version has made significant changes to the scripting structure, but maintains the capability to run the version 2 format files. (more…)
2010/09/01