0

I'm looking for a way to use fail2ban to control/block samba logins on Ubuntu 12.04.3 LTS.
I already set up an jail.local. The samba part currently looks like this:

[samba]
enabled = true
port = 135,139,445,137,138
protocol = tcp,udp

I'm missing these two options:

filter =
logpath =

I know that samba log are located in /var/log/samba, but every hostname has its own file, so what do I have to set as logpath and as filter? Or is this even possible?

Thank you very much

Improve this question
5
  • Did you even bother to read the documentation ?
    – user9517
    Jan 10, 2014 at 19:15
  • 1
    I wouldn't ask if I haven't already done some research. For example the official fail2ban Wiki: fail2ban.org/wiki/… .
    – Roman Holzner
    Jan 10, 2014 at 19:19
  • @CopyDevil What, specifically have you attempted to get this working in your environment? What specific error messages or unexpected behavior are you experiencing? Server Fault is not here to do your work for you. You must ask a good, specific, answerable question in order for us to help you.
    – voretaq7
    Jan 10, 2014 at 19:48
  • I think I wrote it: I know that samba log are located in /var/log/samba, but every hostname has its own file, this is what I tried, and why I failed. I also posted the code I wrote so far. Do the work? I'm asking for 2 little options, where I'm stucked! What are you trying to do? What have you tried in order to make it happen? What results did you expect? What actually happened? Everything is in my Question. I'm really sorry.
    – Roman Holzner
    Jan 10, 2014 at 20:25
  • @CopyDevil You are not asking for "two little options", you are asking for the solution handed to you on a silver platter. We can certainly help you with the syntax for logpath (See Iain's answer), but as pointed out in the same answer filter is a regex you're going to need to define yourself based on your needs.
    – voretaq7
    Jan 10, 2014 at 23:24

2 Answers 2

Reset to default
5

The logpath option takes a wildcard as the official wiki you reference says

wildcard support in logpath option

so for example 

logpath  = /var/log/apache*/*error.log

Again from the document you say you read

filter : a filter defines a regular expression which must match a pattern corresponding to a log-in failure or any other expression

These are normally put into a .conf file in the filter.d directory.

Improve this answer
2
  • I thank you very much for the answer, but I don't understand your point. I think that every answer on every IT-Related stackexchange Site could be answered by reading the Documentation. But if someone asks a short question like this one, this would simply be overkill. Now the question is answered, and if anybody has the same question, he will find a quick answer. I believe this is easier than everyone reading the manual...
    – Roman Holzner
    Jan 10, 2014 at 19:32
  • Try to read: oreilly.com/openbook/samba/book/ch09_01.html (9.1.1 Samba Logs)
    – Pol Hallen
    May 28, 2014 at 16:51
0

In case someone is looking for an answer. Configure the samba jail in a new file "/etc/fail2ban/jail.d/samba.local".

[samba]
enabled = true
port = 139,445
filter = samba # Filter defined in a file named "samba.conf" in "/etc/fail2ban/filter.d/"
logpath = /var/log/samba/log.%m 
maxretry = 3

Configure the "samba" filter in "/etc/fail2ban/filter.d/samba.conf".

[Definition]
failregex = ^%(__prefix_line)s\[.*\]\s*smbd(?:\[[0-9]+\])?: \s.*authentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>\s.*
ignoreregex =

Dont forget to reload the configuration changes.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .