24.1. IPBAN service

24.1. IPBAN service
	Chapter 24. IPBAN

This service can be enabled for TELNET, SSH, SIP, IAX, SMTP, POP3, HTTP, FTP, to prevent brute force attacks by blocking an IP address which persists in authentication failures.

It also permits to send an email to the configured recipient when the limit is reached.

The IPBAN resource puts in the blacklist the source IP address that has generated a number of authentication failures (for example, username and / or password of FTP access).

If an IP fails to authenticate MAX-NRTY times, within FIND-TIME minutes the error condition is reached and if IP not present in WHITE-LIST, then if ACTION:MAIL an email is sent to MAIL-RCPT and MAIL-RCPT-LIST , and if ACTION:BLOCK the IP is banned for BAN-TIME minutes.

A simplest explanation would be: The IPBAN resource puts in the blacklist the source IP address that has generated a number of authentication failures (for example, username and / or password of FTP access). Until the IP address is in the blacklist, it will inhibit access to the considered resource.

Configuring the SMTP resource is needed to send emails.

	Caution
	The IBAN is a service to be configured carefully, if errors are present, may not have access to Abilis!

	Warning
	The blacklist is cleared when you restart the Abilis.

	Important
	The SMTP resource requires a separate licence in CPX.

24.1.1. IPBAN service parameters

This service is enabled by default for Abilis.

Use the following command to display the parameters of the service; the command d ipban ? displays the meaning of all parameters.

[11:35:17] ABILIS_CPX:d ipban

- IP Addresses banning settings: ----------------------------------------------
max-items:1000
MAIL-FROM:AUTO (ipban@ABILIS_CPX)
MAIL-RCPT:#
MAIL-RCPT-LIST:#
MAIL-FILTER-INTERVAL:3                  MAIL-BODY:STANDARD

- IP Addresses Banning services defaults: -------------------------------------
ACTION:NONE         MAX-NRTY:10     FIND-TIME:10       BAN-TIME:10     
WHITE-LIST:#

- IP Addresses Banning services settings: -------------------------------------
---------+------------+-----------+------------+-----------+-------------------
RES:     | ACTION:    | MAX-NRTY: | FIND-TIME: | BAN-TIME: | WHITE-LIST:
---------+------------+-----------+------------+-----------+-------------------
Telnet   | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Ssh      | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
CtiSip   | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
CtiIax   | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Smtp     | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Pop3     | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Http     | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
Ftp      | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------
CtiVo    | DFT        | DFT       | DFT        | DFT       | DFT       
---------+------------+-----------+------------+-----------+-------------------

Meaning of the most important parameters:

IP Addresses banning parameter(s):

max-items

Ban list capacity [100..5000]

MAIL-FROM

Sender of e-mail. "SYS" or "AUTO" or a valid e-mail address.

- SYS: the mail sender configured in CXGEN 'MAIL-SENDER' is used;

- AUTO: a fixed value is used (e.g. ipban@<cp-prompt>);

- e-mail address: from 0 up to 128 ASCII printable characters. Spaces aren't allowed. Case is preserved.

MAIL-RCPT: E-mail recipient(s). "#" or up to 128 ASCII printable characters. Spaces aren't allowed. Case is preserved.
MAIL-RCPT-LIST: E-mail recipients list. "#" or the name of a TXT list.
MAIL-FILTER-INTERVAL: Filtering interval for e-mail [NO, 1..65534 min.]
MAIL-BODY: E-mail body type [STANDARD, SMS-LIKE]
ACTION: Action to be executed [NONE: No action has to be executed; BLOCK: Block the IP; MAIL: E-mail must be sent.]. Values can be joined using "," operator.
MAX-NRTY: Number of authentication failure attempts before the IP address is put in banned list [1..255]
FIND-TIME: Time interval within which the maximum number of attempts is valid [1..120 min.]
BAN-TIME: How long an IP address is kept in the banned list [NOMAX, 1..10080 min.]
WHITE-LIST: The service will not ban a host which matches an address in the list. "#" or the name of a IP/IR/RU/MR list.

IP Addresses banning service(s) parameter(s):

ACTION: Action to be executed [DFT: The default configured action; NONE: No action has to be executed; BLOCK: Block the IP; MAIL: E-mail must be sent.] Values can be joined using "," operator.
MAX-NRTY: Number of authentication failure attempts before the IP address is put in banned list [1..255]
FIND-TIME: Time interval within which the maximum number of attempts is valid [DFT, 1..120 min.]
BAN-TIME: How long an IP address is kept in the banned list [DFT, NOMAX, 1..10080 min.]
WHITE-LIST: The service will not ban a host which matches an address in the list. "DFT" or "#" or the name of a IP/IR/RU/MR list.

The following command allows the administrator to change the configuration of the resource:

S IPBAN par:val [par:val] Set IP Addresses banning parameters and defaults

S IPBAN RES:val par:val [par:val] Set IP Addresses banning service(s) parameters

	Caution
	To activate the changes made on the upper case parameters, execute the initialization command init ipban

Use the following command to display the Banned IP

[12:23:44] ABILIS_CPX:d ipban banned

Banned IP addresses:1

RES      |       IP        | Banned Time (mm:ss) | Remaining Time (mm:ss)
---------+-----------------+---------------------+-------------------------
Ssh        192.168.020.104   10:0                  9:23

In this example is show IP 192.168.20.104 which is blocked for resource SSH for 10 minutes.

	Warning
	The blacklist is cleared when you restart the Abilis.

To erase an IP from the blacklist use the following command:

[12:22:38] ABILIS_CPX:c ipban banned res:ssh ip:192.168.20.104

COMMAND EXECUTED 

[12:22:54] ABILIS_CPX:d ipban banned                             

Banned IP addresses:0

RES      |       IP        | Banned Time (mm:ss) | Remaining Time (mm:ss)
---------+-----------------+---------------------+-------------------------
                    *** NO BANNED IP ADDRESSES ***

	Tip
	Interesting chapter: Section 70.29, “How to prevent brute force attacks”

24.1.2. IPBAN diagnostics and statistics

The following command is used to display the diagnostics of IPBAN :

[12:51:21] ABILIS_CPX:d d ipban

----------------------+-----------------------------------------
Name                  |Value
----------------------+-----------------------------------------
Total used memory     |124000
Item size             |124
----------------------+-----------------------------------------
MAX-ITEMS             |1000
CUR-FREE              |999
CUR-USED              |1
PEAK-USED             |1
OVERFLOWS             |0
----------------------+-----------------------------------------

----------------------+-----------------------------------------
RES:                  |BANNED-IP-ENTRIES
----------------------+-----------------------------------------
Telnet                |1
Ssh                   |0
CtiSip                |0
CtiIax                |0
Smtp                  |0
Pop3                  |0
Http                  |0
Ftp                   |0
CtiVo                 |0
----------------------+-----------------------------------------
TOTAL                 |1
----------------------+-----------------------------------------

The following command is used to display the statistics of IPBAN :

[12:59:56] ABILIS_CPX:d s ipban

--- Cleared 0 days 21:32:16 ago, on 20/05/2015 at 15:27:49 --------------------
-----------+-----------+-----------+-----------+-----------+
RES:       |AUTH-FAIL: |QUERIES:   |MAIL-SUCC: |MAIL-FAIL: |
-----------+-----------+-----------+-----------+-----------+
Telnet     |         21|         39|          0|          0|
Ssh        |         10|         18|          0|          0|
CtiSip     |          0|          0|          0|          0|
CtiIax     |          0|          0|          0|          0|
Smtp       |          0|          0|          0|          0|
Pop3       |          0|          0|          0|          0|
Http       |          0|         35|          0|          0|
Ftp        |          0|          0|          0|          0|
CtiVo      |          0|          0|          0|          0|
-----------+-----------+-----------+-----------+-----------+
TOTAL      |         31|         92|          0|          0|
-----------+-----------+-----------+-----------+-----------+


Chapter 24. IPBAN		Chapter 25. RIP - Routing Information Protocol