fail2ban on PBS 3

[johnoatwork]

Hello all,

I've followed the guide at https://github.com/inettgmbh/fail2ban-proxmox-backup-server to set up fail2ban for PBS.

Couple of issues with this, but the one I'm currently trying to sort out is why failed attempts via the PBS gui aren't recorded in /var/log/proxmox-backup/api/auth.log.

As a result of course fail2ban doesn't detect the failed attempt.

Any thoughts would be appreciated.

 

[dcsapak]

what does the log show on a failed attempt?

 

[johnoatwork]

what does the log show on a failed attempt?

Actually the failure is recorded in /var/log/proxmox-backup/api/auth.log:

"authentication failure; rhost=[::ffff:10.100.0.10]:60267 user=fake@pam msg=user account disabled or expired."

I must have missed it the first time - the log file is huge. When I follow the log with tail I see it's writing a successful auth entry a couple of times a second:

"2023-08-24T18:32:56+10:00: successful auth for user 'root@pam'"

Is this normal?

 

[dcsapak]

When I follow the log with tail I see it's writing a successful auth entry a couple of times a second:

"2023-08-24T18:32:56+10:00: successful auth for user 'root@pam'"

Is this normal?

depends what how many clients connect and what they do.
e.g. each pve connects every 10 seconds to the pbs if there is a pbs storage configured, so if you have a few, that can increase that log
(you should be able to prevent those logs when using api tokens instead of the root user directly)

 

[johnoatwork]

Thanks Dominik. There are 3 nodes each accessing several datastores on PBS so that would explain it. I'm not familiar with "using api tokens instead of the root user directly" but I'll have a look into it. Anyway I'm not particularly concerned about it and log rotation seems to be working.

The second issue I'm having is configuring fail2ban for SSH on PBS. The guide at https://github.com/inettgmbh/fail2ban-proxmox-backup-server works well for gui/api access but initially fail2ban wouldn't start. It seems SSHD is enabled by default and fail2ban it's looking for the SSH logs at /var/log/auth.log. Creating that file allows fail2ban to start, but SSHD doesn't write its logs there or to /var/log/proxmox-backup/api/auth.log.

Do you know where SSHD logs it's messages on PBS?

 

[dcsapak]

since the underlying system is normal debian, /var/log/auth.log should be the log where sshd writes to (just verified on a pbs installation)

 

[johnoatwork]

since the underlying system is normal debian, /var/log/auth.log should be the log where sshd writes to (just verified on a pbs installation)

Interesting. /var/log/auth.log didn't exist on my PBS3 installation until I created it and SSHD isn't writing to it. /etc/ssh/sshd_config has the default config for logging (SyslogFacility AUTH). I have no idea where SSHD is writing it's logs!

 

[dcsapak]

probably rsyslog is not installed and it's only logged into the journal?

 

[johnoatwork]

Yep, that was it. Thanks for the help.