# Configuring Fail2ban for Samba-AD

By default the AD environment allows to define password strategies that protect the domain by blocking accounts that have attempted multiple unauthorized accesses.

However, this may result in DoS if an attacker is testing accounts with incorrect passwords.

That is why it is recommended not to lockout the account itself but rather a fail2ban on the source IP address at the origin of the unsuccessful connection attempts.

Validate that log redirection is activated in the file `smb.conf`.

Please note that in the case of NTLM authentication, it is the file server that connects to the domain controller to validate the NTLM challenge, not the host. It is therefore necessary to configure the environment to not blacklist the file server itself by mistake.

    log level = 1 auth_json_audit:3@/var/log/samba/auth_json_audit.log

- Install the utility fail2ban:

      # RedHat8 and derived distributions
      yum install fail2ban
      # Debian
      apt-get install fail2ban

- Create the configuration file `/etc/fail2ban/filter.d/samba.conf`:

      [Definition]
      failregex = NT_STATUS_WRONG_PASSWORD.*remoteAddress": "ipv4:<HOST>:

- Create the configuration file `/etc/fail2ban/jail.d/samba.conf`:

      [samba]
      filter = samba
      enabled = true
      action = iptables-multiport[name=samba, port="88,135,389,445,464,636,3328,3329", protocol=tcp]
      #   mail[name=samba, dest=technique@mondomaine.fr]
      logpath = /var/log/samba/auth_json_audit.log
      maxretry = 5
      findtime = 600
      bantime = 600

- To exclude some IP addresses from fail2ban, create the file `/etc/fail2ban/jail.d/customisation.local`:

      [DEFAULT]
      ignoreip = 192.168.154.217

- Enable fail2ban:

      systemctl enable fail2ban
      systemctl start fail2ban

## How do I unlock a machine after cleaning?

- To unlock an IP address:

      fail2ban-client set samba unbanip <COMPUTER_IP>

- Display blocked IP addresses:

      fail2ban-client status samba