27.1. IPBAN service

This service can be enabled for TELNET, SSH, SIP, IAX, SMTP, POP3, HTTP, FTP, to prevent brute force attacks by blocking an IP address which persists in authentication failures.

It also permits to send an email to the configured recipient when the limit is reached.

The IPBAN resource puts in the blacklist the source IP address that has generated a number of authentication failures (for example, username and / or password of FTP access).

If an IP fails to authenticate MAX-NRTY times, within FIND-TIME minutes the error condition is reached and if IP not present in WHITE-LIST, then if ACTION:MAIL an email is sent to MAIL-RCPT and MAIL-RCPT-LIST , and if ACTION:BLOCK the IP is banned for BAN-TIME minutes.

A simplest explanation would be: The IPBAN resource puts in the blacklist the source IP address that has generated a number of authentication failures (for example, username and / or password of FTP access). Until the IP address is in the blacklist, it will inhibit access to the considered resource.

Configuring the SMTP resource is needed to send emails.

[Caution]Caution

The IBAN is a service to be configured carefully, if errors are present, may not have access to Abilis!

[Warning]Warning

The blacklist is cleared when you restart the Abilis.

[Important]Important

The SMTP resource requires a separate licence in CPX.

27.1.1. IPBAN service parameters

This service is enabled by default for Abilis.

Use the following command to display the parameters of the service; the command d ipban ? displays the meaning of all parameters.

[11:35:17] ABILIS_CPX:d ipban

- IP Addresses banning settings: ----------------------------------------------
max-items:1000
MAIL-FROM:AUTO (ipban@ABILIS_CPX)
MAIL-RCPT:#
MAIL-RCPT-LIST:#
MAIL-FILTER-INTERVAL:3                  MAIL-BODY:STANDARD

- IP Addresses Banning services defaults: -------------------------------------
ACTION:NONE         MAX-NRTY:10     FIND-TIME:10       BAN-TIME:10     
WHITE-LIST:#

- IP Addresses Banning services settings: -------------------------------------
---------+------------+-----------+------------+-----------+-------------------
RES:     | ACTION:    | MAX-NRTY: | FIND-TIME: | BAN-TIME: | WHITE-LIST:
---------+------------+-----------+------------+-----------+-------------------
Telnet   | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Ssh      | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
CtiSip   | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
CtiIax   | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Smtp     | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Pop3     | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Http     | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Ftp      | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
CtiVo    | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------

Meaning of the most important parameters:

IP Addresses banning parameter(s):

max-items

Ban list capacity [100..5000].

MAIL-FROM

Sender of e-mail. "SYS" or "AUTO" or a valid e-mail address.

- SYS: the mail sender configured in CXGEN 'MAIL-SENDER' is used;

- AUTO: a fixed value is used (e.g. ipban@<cp-prompt>);

- e-mail address: max 128 ASCII characters. Space not allowed.

MAIL-RCPT

E-mail recipient(s). # or max ASCII characters. Space not allowed.

MAIL-RCPT-LIST

E-mail recipients list. "#" or the name of a TXT list.

MAIL-FILTER-INTERVAL

Filtering interval for e-mail [NO, 1..65534 min.]

MAIL-BODY

E-mail body type [STANDARD, SMS-LIKE]

ACTION

Action to be executed [NONE: No action has to be executed; BLOCK: Block the IP; MAIL: E-mail must be sent.]. Values can be joined using "," operator.

MAX-NRTY

Number of authentication failure attempts before the IP address is put in banned list [1..255].

FIND-TIME

Time interval within which the maximum number of attempts is valid [1..120 min.].

BAN-TIME

How long an IP address is kept in the banned list [NOMAX, 1..10080 min.].

WHITE-LIST

The service will not ban a host which matches an address in the list. "#" or the name of a IP/IR/RU/MR list.

IP Addresses banning service(s) parameter(s):

ACTION

Action to be executed [DFT: The default configured action; NONE: No action has to be executed; BLOCK: Block the IP; MAIL: E-mail must be sent.] Values can be joined using "," operator.

MAX-NRTY

Number of authentication failure attempts before the IP address is put in banned list [1..255].

FIND-TIME

Time interval within which the maximum number of attempts is valid [DFT, 1..120 min.].

BAN-TIME

How long an IP address is kept in the banned list [DFT, NOMAX, 1..10080 min.].

WHITE-LIST

The service will not ban a host which matches an address in the list. "DFT" or "#" or the name of a IP/IR/RU/MR list.

The following command allows the administrator to change the configuration of the resource:

S IPBAN par:val [par:val] Set IP Addresses banning parameters and defaults

S IPBAN RES:val par:val [par:val] Set IP Addresses banning service(s) parameters

[Caution]Caution

To activate the changes made on the upper case parameters, execute the initialization command init ipban

Use the following command to display the Banned IP

[12:23:44] ABILIS_CPX:d ipban banned

Banned IP addresses:1

RES      |       IP        | Banned Time (mm:ss) | Remaining Time (mm:ss)
---------+-----------------+---------------------+-------------------------
Ssh        192.168.020.104   10:0                  9:23  

In this example is show IP 192.168.20.104 which is blocked for resource SSH for 10 minutes.

[Warning]Warning

The blacklist is cleared when you restart the Abilis.

To erase an IP from the blacklist use the following command:

[12:22:38] ABILIS_CPX:c ipban banned res:ssh ip:192.168.20.104

COMMAND EXECUTED 

[12:22:54] ABILIS_CPX:d ipban banned                             

Banned IP addresses:0

RES      |       IP        | Banned Time (mm:ss) | Remaining Time (mm:ss)
---------+-----------------+---------------------+-------------------------
                    *** NO BANNED IP ADDRESSES ***  

27.1.2. IPBAN diagnostics and statistics

27.1.2.1. IPBAN diagnostics

This command reports the current situation of the IPBAN resource:

[12:51:21] ABILIS_CPX:d d ipban

----------------------+-----------------------------------------
Name                  |Value
----------------------+-----------------------------------------
Total used memory     |124000
Item size             |124
----------------------+-----------------------------------------
MAX-ITEMS             |1000
CUR-FREE              |834
CUR-USED              |166
PEAK-USED             |166
OVERFLOWS             |0
----------------------+-----------------------------------------

----------------------+-----------------------------------------
RES:                  |BANNED-IP-ENTRIES
----------------------+-----------------------------------------
Telnet                |0
Ssh                   |161
CtiSip                |0
CtiIax                |0
Smtp                  |0
Pop3                  |0
Http                  |0
Ftp                   |0
CtiVo                 |0
----------------------+-----------------------------------------
TOTAL                 |161
----------------------+-----------------------------------------

The meaning:

Total used memory

Total amount of memory used to store the ban list.

Item size

Amount of memory used to store one element of the ban list.

MAX-ITEMS

Current max numbers of IP that can be store in the ban list.

CUR-FREE

Current numbers of free places the ban list.

CUR-USED

Current numbers of used places the ban list.

PEAK-USED

Peak number of used places the ban list.

OVERFLOWS

Number of ban list overflows.

Telnet/Ssh/CtiSip/CtiIax/Smtp/Pop3/Http/Ftp/CtiVo

Number of entries that hold a banned IP for Telnet/Ssh/CtiSip/CtiIax/Smtp/Pop3/Http/Ftp/CtiVo.

TOTAL

Total number of entries that hold a banned IP.

27.1.2.2. IPBAN statistics

This command can help to understand what is happening, in case of troubles:

[12:59:56] ABILIS_CPX:d s ipban

--- Cleared 1 days 07:39:09 ago, on 09/11/2017 at 07:57:04 --------------------
-----------+-----------+-----------+-----------+-----------+
RES:       |AUTH-FAIL: |QUERIES:   |MAIL-SUCC: |MAIL-FAIL: |
-----------+-----------+-----------+-----------+-----------+
Telnet     |          0|          1|          0|          0|
Ssh        |        577|       3652|          0|          0|
CtiSip     |          1|         91|          0|          0|
CtiIax     |          0|          0|          0|          0|
Smtp       |          0|          7|          0|          0|
Pop3       |          0|          0|          0|          0|
Http       |          0|       1998|          0|          0|
Ftp        |          1|          9|          0|          0|
CtiVo      |          0|          0|          0|          0|
-----------+-----------+-----------+-----------+-----------+
TOTAL      |        579|       5758|          0|          0|
-----------+-----------+-----------+-----------+-----------+

With reference to the shown interval of time («Cleared 1 days 07:39:09 ago») these counters show the number of:

AUTH-FAILNumber of wrong-password notifications received from Telnet/Ssh/CtiSip/CtiIax/Smtp/Pop3/Http/Ftp/CtiVo.
QUERIESNumber of Telnet/Ssh/CtiSip/CtiIax/Smtp/Pop3/Http/Ftp/CtiVo queries.
MAIL-SUCCNumber of successful mail notifications.
MAIL-FAILNumber of failed mail notifications.
TOTAL Total number of AUTH-FAIL, QUERIES, MAIL-SUCC, MAIL-FAIL.