24.1. IPBAN service

24.1. IPBAN service
	Chapter 24. IPBAN

This service can be enabled for Telnet, Ssh, Sip, Iax, Smtp, Pop3, HTTP, Ftp, to prevent brute force attacks by blocking an IP address which persists in authentication failures.

It also permit to send an email to configured recipient when the limit is reached.

If an IP fails to authenticate MAX-NRTY: times, within FIND-TIME: minutes the error condition is reached and if IP not present in WHITE-LIST, then if ACTION:MAIL an email is sent to MAIL-RCPT: and MAIL-RCPT-LIST: , and if ACTION:BLOCK the IP is banned for BAN-TIME: minutes.

24.1.1. IPBAN service parameters

This service is enabled by default for Abilis.

Use the following command to display the parameters of the service;the command d ipban ? displays the meaning of all parameters.

[11:35:17] ABILIS_CPX:d ipban

- IP Addresses banning settings: ----------------------------------------------
max-items:1000
MAIL-FROM:AUTO (ipban@ABILIS_CPX)
MAIL-RCPT:#
MAIL-RCPT-LIST:#
MAIL-FILTER-INTERVAL:3                  MAIL-BODY:STANDARD

- IP Addresses Banning services defaults: -------------------------------------
ACTION:NONE         MAX-NRTY:10     FIND-TIME:10       BAN-TIME:10     
WHITE-LIST:#

- IP Addresses Banning services settings: -------------------------------------
---------+------------+-----------+------------+-----------+-------------------
RES:     | ACTION:    | MAX-NRTY: | FIND-TIME: | BAN-TIME: | WHITE-LIST:
---------+------------+-----------+------------+-----------+-------------------
Telnet   | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Ssh      | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
CtiSip   | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
CtiIax   | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Smtp     | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Pop3     | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Http     | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Ftp      | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
CtiVo    | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------

Meaning of the most important parameters:

IP Addresses banning parameter(s):

max-items

Ban list capacity [100..5000]

MAIL-FROM

Sender of e-mail. "SYS" or "AUTO" or a valid e-mail address.

- SYS: the mail sender configured in CXGEN 'MAIL-SENDER' is used;

- AUTO: a fixed value is used (e.g. ipban@<cp-prompt>);

- e-mail address: from 0 up to 128 ASCII printable characters. Spaces are not allowed. Case is preserved.

MAIL-RCPT: E-mail recipient(s). "#" or up to 128 ASCII printable characters. Spaces are not allowed. Case is preserved.
MAIL-RCPT-LIST: E-mail recipients list. "#" or the name of a TXT list.
MAIL-FILTER-INTERVAL: Filtering interval for e-mail [NO, 1..65534 min.]
MAIL-BODY: E-mail body type [STANDARD, SMS-LIKE]
ACTION: Action to be executed [NONE, BLOCK, MAIL] Values can be joined using "," operator.
MAX-NRTY: Number of authentication failure attempts before the IP address is put in banned list [1..255]
FIND-TIME: Time interval within which the maximum number of attempts is valid [1..120 min.]
BAN-TIME: How long an IP address is kept in the banned list [NOMAX, 1..10080 min.]
WHITE-LIST: The service will not ban a host which matches an address in the list. "#" or the name of a IP/IR/RU/MR list.

IP Addresses banning service(s) parameter(s):

ACTION: Action to be executed [DFT, NONE, BLOCK, MAIL] Values can be joined using "," operator.
MAX-NRTY: Number of authentication failure attempts before the IP address is put in banned list [1..255]
FIND-TIME: Time interval within which the maximum number of attempts is valid [DFT, 1..120 min.]
BAN-TIME: How long an IP address is kept in the banned list [DFT, NOMAX, 1..10080 min.]
WHITE-LIST: The service will not ban a host which matches an address in the list. "DFT" or "#" or the name of a IP/IR/RU/MR list.

The following command allows the administrator to change the configuration of the resource:

S IPBAN par:val [par:val] Set IP Addresses banning parameters and defaults

S IPBAN RES:val par:val [par:val] Set IP Addresses banning service(s) parameters

	Caution
	To activate the changes made on the upper case parameters, execute the initialization command init ipban

Use the following command to display the Banned IP

[12:23:44] ABILIS_CPX:d ipban banned

Banned IP addresses:1

RES      |       IP        | Banned Time (mm:ss) | Remaining Time (mm:ss)
---------+-----------------+---------------------+-------------------------
Ssh        192.168.020.104   10:0                  9:23

In this example is show IP 192.168.20.104 which is blocked for resource SSH for 10 minutes.

	Tip
	Interesting chapter:Section 67.21, “How to prevent brute force attacks”

24.1.2. IPBAN diagnostics and statistics

The following commands are used to display the diagnostics of IPBAN :

[12:51:21] ABILIS_CPX:d d ipban

----------------------+-----------------------------------------
Name                  |Value
----------------------+-----------------------------------------
Total used memory     |124000
Item size             |124
----------------------+-----------------------------------------
MAX-ITEMS             |1000
CUR-FREE              |999
CUR-USED              |1
PEAK-USED             |1
OVERFLOWS             |0
----------------------+-----------------------------------------

----------------------+-----------------------------------------
RES:                  |BANNED-IP-ENTRIES
----------------------+-----------------------------------------
Telnet                |1
Ssh                   |0
CtiSip                |0
CtiIax                |0
Smtp                  |0
Pop3                  |0
Http                  |0
Ftp                   |0
CtiVo                 |0
----------------------+-----------------------------------------
TOTAL                 |1
----------------------+-----------------------------------------

The following commands are used to display the statistics of IPBAN :

[12:59:56] ABILIS_CPX:d s ipban

--- Cleared 0 days 21:32:16 ago, on 20/05/2015 at 15:27:49 --------------------
-----------+-----------+-----------+-----------+-----------+
RES:       |AUTH-FAIL: |QUERIES:   |MAIL-SUCC: |MAIL-FAIL: |
-----------+-----------+-----------+-----------+-----------+
Telnet     |         21|         39|          0|          0|
Ssh        |         10|         18|          0|          0|
CtiSip     |          0|          0|          0|          0|
CtiIax     |          0|          0|          0|          0|
Smtp       |          0|          0|          0|          0|
Pop3       |          0|          0|          0|          0|
Http       |          0|         35|          0|          0|
Ftp        |          0|          0|          0|          0|
CtiVo      |          0|          0|          0|          0|
-----------+-----------+-----------+-----------+-----------+
TOTAL      |         31|         92|          0|          0|
-----------+-----------+-----------+-----------+-----------+


Chapter 24. IPBAN		Chapter 25. RIP - Routing Information Protocol