Chapril/xmpp.chapril.org-tools
Chapril/xmpp.chapril.org-tools
25
2
Fork 0
Code Issues Releases Activity
dc7484e16a
xmpp.chapril.org-tools/fail2ban
History
pitchum e591ef175b Disable custom fail2ban jail. Too agressive. 
Maybe we'll enable it again if spammers come back.
2020-12-08 19:35:10 +01:00
..
filter.d Craft fail2ban rules to mitigate spambots attacks (#4461) 2020-05-16 15:22:35 +02:00
jail.d Disable custom fail2ban jail. Too agressive. 2020-12-08 19:35:10 +01:00
README.md Craft fail2ban rules to mitigate spambots attacks (#4461) 2020-05-16 15:22:35 +02:00

README.md

fail2ban rules for XMPP

fail2ban rules created to mitigate spambots acting since April 2020. Random accounts are created with different IPs (probably zombie machines) and then always the same 3 XMPP accounts (on other XMPP servers) are targeted. The new chapril account ask for presence subscription to those external JIDs and immediately send them random messages without waiting for an answer.

ejabberd detects the suspicious fast presence subscriptions and logs something easy to capture:

grep Flooder /var/log/ejabberd/ejabberd.log

So we use these log warnings to trigger IP ban.

Quickstart guide

cd /etc/fail2ban/filter.d
ln -s /srv/xmpp.chapril.org/tools/fail2ban/filter.d/xmpp-flooders.conf
cd /etc/fail2ban/jail.d
ln -s /srv/xmpp.chapril.org/tools/fail2ban/jail.d/chapril-xmpp.conf
systemctl restart fail2ban

Check that the jail is active:

fail2ban-client status
fail2ban-client status xmpp-c2s