Banning IP that fails openHAB authentication

OpenHAB is an home automation software that enables you to control your home, to get the feedback of your sensors and do various scenarios and rules.

It's a very good software when you have some IT knowledge, mainly because with the rules you can develop with Domain Specific Language built on Xbase and enhance the base abilities of the software (that are already powerful with the base :-).

Nervertheless I'm not here to talk about openHAB but much to say how to add jail into fail2ban configured to fit to openHAB log.

Fail2ban enables to scan log files and Ban IP that fit on some rules. In our case the goal is to scan the logs of openhab to check if there is too much authentication failure and if it is the case ban the corresponding IP.

Tested with:

fail2ban 0.9.3 (doesn't work with 0.8.x)
openhab 1.7.x, 1.8.x
https

Prerequisites:
Enable authentication on openhab.cfg
security:option=ON
or
security:option=EXTERNAL
and set some users/pwd to users.cfg

Set your system locale to english (I had some troubles when I was on different locale, fail2ban was not able to detect the timestamp into the request log due to the fact that months were not written in english)

So as to enables ban IP we need to add a filter to fail2ban, define the corresponding jails and to change the log format of openhab.

Adding the filter to fail2ban, add a file openhab.conf with this content into the filter.d folder of the fail2ban install:

# Openhab brute force auth filter: /etc/fail2ban/filter.d/openhab.conf:

# Block IPs trying to auth openhab by web or rest api

# Matches e.g.

# 12.34.33.22 - - [26/sept./2015:18:04:43 +0200] "GET /openhab.app HTTP/1.1" 401 1382

# 175.18.15.10 - - [02/sept./2015:00:11:31 +0200] "GET /rest/bindings HTTP/1.1" 401 1384

[Definition]

failregex = ^<HOST>\s+-\s+-\s+\[\]\s+"[A-Z]+ .*" 401 \d+\s*$

[Init]

datepattern = %%d/%%b[^/]*/%%Y:%%H:%%M:%%S %%z

failregex and datepattern made by Serg G. Brester

Define the corresponding jail into your jail.local file:

[openhab-auth]
enabled = true

filter = openhab
action = iptables-allports[name=NoAuthFailures]
logpath = /opt/openhab/logs/request.log

Change openhab log format into the your openhab folder etc/ modify the jetty log configuration so as to have:

<Set name="filename"><SystemProperty name="jetty.logs" default="./logs"/>/request.log</Set>
<Set name="filenameDateFormat"></Set>
<Set name="retainDays">30</Set>

Restart openhab and fail2ban (sudo service fail2ban restart)

Please check that the request log follow the annual hour change (summer or winter hours)

Test your changes:

Before testing please set the bantime to 200 seconds or less so as to not ban yourself too much time, prepare a recovery solution in case you've made some wrong configuration (direct connecxion, or another IP connexion)

So as to test your change try to login either by web interface or mobile with a wrong login or password several times (in fact more than the number of times that you set into your jail.local, parameter maxretry).

After several attempt your ip adress should be banned and you lose the access to your server.

More info are available on this pullrequest:
https://github.com/fail2ban/fail2ban/pull/1223

1 Technophile