Ban an attacker and audit for a backdoor

short · 30 min · Objective 3.3

Task

Configure fail2ban to ban repeated SSH failures, prove it works without banning yourself, and then run the setuid-binary audit that finds the kind of backdoor this defends against.

Steps

  1. Before enabling anything, set ignoreip in jail.local to include your own management network. This is the step that stops the tool locking you out, and it comes first for that reason.
  2. Configure the sshd jail in jail.local -- not jail.conf, which package updates overwrite -- with a low maxretry and a short bantime for testing.
  3. Start fail2ban and confirm the jail is active with fail2ban-client status sshd.
  4. From a machine NOT in ignoreip, fail SSH logins until the ban triggers. Confirm the address appears in fail2ban-client status sshd and that a firewall rule now blocks it.
  5. Confirm your own address, in ignoreip, is never banned however many times you fail.
  6. Now the audit half: find every setuid binary with find / -xdev -perm -4000 -type f 2>/dev/null and compare it against a known-good list. Plant a fake backdoor -- cp /bin/bash /tmp/.hidden && chmod 4755 /tmp/.hidden -- and confirm your audit finds it.
  7. Remove the planted binary and confirm the audit is clean again.

Verify

fail2ban-client status sshd | grep -E 'Currently banned|Total banned'
grep -q 'ignoreip' /etc/fail2ban/jail.local && echo "ignoreip set"
find / -xdev -perm -4000 -type f 2>/dev/null | grep -q '/tmp/.hidden' && echo "audit found the backdoor"
rm -f /tmp/.hidden
find / -xdev -perm -4000 -type f 2>/dev/null | grep -qv '/tmp/.hidden' && echo "clean"

Step 6 is the point: a setuid copy of bash owned by root is a working backdoor -- any user can run it and become root -- and it is exactly what the find -perm -4000 audit exists to catch. An unexpected result there is an escalation, not a note.

Notes

Order matters in both halves. ignoreip before enabling fail2ban, or the first fat-fingered password locks you out of your own defence. And a known-good baseline before the audit, or you cannot tell an unexpected setuid binary from a legitimate one.