• /etc/fail2ban/filter.d/ppp.conf

  [Definition]
  failregex = CTRL: Client <HOST> control connection finished
  ignoreregex =

• /etc/fail2ban/jail.local

  [ppp]
  enabled  = true
  port     = 1723
  protocol = tcp
  filter   = ppp
  logpath  = /var/log/ppp.log
  bantime=6
  findtime=30
  maxretry=4

No es la solución más efectiva, porque de esta manera si un cliente hace login/logoff 6 veces correctamente en menos de 30 segundos (algo tampoco muy normal), será baneado; pero es que con la información que da el log del pptpd no encontré otra solución.

NOTA: para que funcione, el log del pptpd debe ser bastante completo. Hay que poner la variable «debug»en el archivo de config del pptpd

BONUS – mandando correos sin sendmail

Si queremos que fail2ban mande correos y no tenemos sendmail instalado ni lo queremos instalar, podemos optar por usar el programa swaks (apt-get install swaks), que sirve precisamente para eso, para mandar correos desde el equipo local sin tener corriendo un mta como sendmail.

Para ello, una vez instalado swaks, creamos los siguientes archivos para que fail2ban haga uso de ellos:

[root@server]# cat /etc/fail2ban/action.d/swaks-whois-lines.conf

[Definition]
actionstart = 
actionstop = 
actioncheck = 
actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
            From: Fail2Ban <<sender>>
            To: <dest>\n
            Hi,\n
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n\n
            Here are more information about <ip>:\n
            `/usr/bin/whois <ip>`\n\n
            Lines containing IP:<ip> in <logpath>\n
            `/bin/grep '\<<ip>\>' <logpath>`\n\n
            Regards,\n
            Fail2Ban" | swaks --to <dest> --server emailserver -d -
actionunban = printf %%b "Subject: [Fail2Ban] <name>: unbanned <ip>
             From: Fail2Ban <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been unbanned by Fail2Ban\n\n
             Here are more information about <ip>:\n
             `/usr/bin/whois <ip>`\n\n
             Lines containing IP:<ip> in <logpath>\n
             `/bin/grep '\<<ip>\>' <logpath>`\n\n
             Regards,\n
             Fail2Ban" | swaks --to <dest> --server emailserver -d -

[Init]
name = default
dest = root
sender = fail2ban
logpath = /dev/null

Cambiar el valor de –server por el correspondiente

[root@server]# cat /etc/fail2ban/action.d/swaks-whois-lines.conf |egrep -v '^#'

[Definition]
actionstart = 
actionstop = 
actioncheck = 
actionban = printf %%b "Subject: [Fail2Ban] <name>: banned <ip>
            From: Fail2Ban <<sender>>
            To: <dest>\n
            Hi,\n
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n\n
            Here are more information about <ip>:\n
            `/usr/bin/whois <ip>`\n\n
            Lines containing IP:<ip> in <logpath>\n
            `/bin/grep '\<<ip>\>' <logpath>`\n\n
            Regards,\n
            Fail2Ban" | swaks --to <dest> --server emailserver -d -
actionunban = printf %%b "Subject: [Fail2Ban] <name>: unbanned <ip>
             From: Fail2Ban <<sender>>
             To: <dest>\n
             Hi,\n
             The IP <ip> has just been unbanned by Fail2Ban\n\n
             Here are more information about <ip>:\n
             `/usr/bin/whois <ip>`\n\n
             Lines containing IP:<ip> in <logpath>\n
             `/bin/grep '\<<ip>\>' <logpath>`\n\n
             Regards,\n
             Fail2Ban" | swaks --to <dest> --server emailserver -d -

[Init]
name = default
dest = root
sender = fail2ban
logpath = /dev/null

Cambiar el valor de ‘mta’, ‘action’ y ‘destemail’:

[root@server /]# egrep "^mta" /etc/fail2ban/jail.conf
mta = swaks
[root@server /]# egrep "^action =" /etc/fail2ban/jail.conf 
action = %(action_mwl)s
[root@server /]# egrep "^destemail =" /etc/fail2ban/jail.conf 
destemail = email@address.com

Reiniciamos el demonio y listo