Sign-in protection and fail2ban

New in FireSight OT 0.4.0 (in beta). This is also section 7 of Install and upgrade FireSight OT.

Addresses that keep failing to sign in are blocked at two levels.

In the Hub (console)

Security & settings → Sign-in protection (administrators):

What counts: failed sign-ins from the console (passwords and two-factor codes), single sign-on, API tokens, and the backup SFTP/S3 accounts.
Default: 5 failures within 10 minutes block the address from the console and API for 30 minutes, twice as long each further time that day (up to 24 hours). The person sees until when.
Never block: list your office or VPN addresses (e.g. 203.0.113.0/24).
Blocked now: each blocked address with an Unblock button; you can also block an address by hand for an hour, a day or a week.
Off: untick Block addresses after repeated failed sign-ins.

Cloud Connectors are never blocked (they sign in with certificates). Blocks and unblocks are in the audit log and go to SIEMs and webhooks as sign-in events.

On the Hub server (fail2ban)

The installer also sets up fail2ban, which blocks persistent addresses at the server's firewall (every port), for the Hub's sign-ins and for the server's SSH:

Jail	Blocks after	Within	For
`fsot-hub`	10 failed Hub sign-ins	30 min	2 h, longer for repeat offenders (up to a week)
`sshd`	5 failed SSH logins (Debian default)	10 min	10 min, longer for repeat offenders

Change the settings in a file of your own (the installer rewrites its file, /etc/fail2ban/jail.d/fsot-hub.conf, when it's run again):

sudo nano /etc/fail2ban/jail.d/zz-local.conf

[DEFAULT]
# never blocked: your office and VPN (space separated)
ignoreip = 127.0.0.1/8 ::1 203.0.113.0/24

[fsot-hub]
maxretry = 10
findtime = 30m
bantime = 2h

[sshd]
maxretry = 5
bantime = 1h

sudo fail2ban-client reload
sudo fail2ban-client status fsot-hub    # settings in use, and who is blocked

Everyday commands:

sudo fail2ban-client banned                                # everything blocked, all jails
sudo fail2ban-client set fsot-hub unbanip 198.51.100.7     # lift a block (also: set sshd unbanip …)
sudo fail2ban-client set fsot-hub banip 198.51.100.7       # block by hand

Turn it off:

only for the Hub's sign-ins (keep SSH protected): add enabled = false under [fsot-hub] in zz-local.conf, then sudo fail2ban-client reload;
completely: sudo systemctl disable --now fail2ban;
at installation: run install-hub.sh with --no-fail2ban.

Locked out? fail2ban blocks at the firewall, so the browser can't reach the Hub at all from that address. Use another connection (a phone hotspot, your cloud provider's web console) to run sudo fail2ban-client set fsot-hub unbanip <your address>, then add your address to ignoreip above and to Never block in the console.

Behind a reverse proxy or load balancer: tell the Hub to trust it (FSOT_TRUSTED_PROXIES in /etc/default/fsot-hub), so it sees people's real addresses; otherwise it would block the proxy.