glasnt / wail2ban

fail2ban, for windows.

wail2ban

wail2ban is a windows port of the basic functionality of fail2ban, and combining elements of ts_block.

overview

wail2ban is a system that takes incoming failed access events for a customly configurable set of known event ids, and given sufficient failed attacks in a period of time, creates temporary firewall rules to block access.

installation

Installing wail2ban is a case of a view simple tasks:

• copy all the repository files to a location on the client machine, e.g. C:\scripts\wail2ban
• Using Task Scheduler, import the start wail2ban onstartup.xml file to automatically create a scheduled task to start the script when the machine boots.
• Initiate the script by running the start wail2ban.bat file. This is what the scheduled task starts.

commandline execution

wail2ban has write-debug things through it, just uncomment the $DebugPreference line to enable. This will output nice things to CMD, if running ad-hoc.

There are also a number of options that can be run against the script to control it:

• -config : dumps a parsed output of the configuration file to standard out, including timing and whitelist configurations.
• -jail : shows the current set of banned IPs on the machine
• -jailbreak: unbans every IP currently banned by the script.

technical overview

Event logs for various software packages are configured to produce messages when failed connections occur. The contents of the events usually contain an IP, an a message something along the lines of "This IP failed to connect to your server."

Typical examples of this include:

• Security Event ID 4625, "Windows Security Auditing".
• An account failed to log in. ... Source Network Address: 11.22.33.44

Database products also include these kind of events, such as:

• Application Event ID 18456, "Microsoft SQL Server".
• Login failed for user 'sa'. Reason: Password did not match that for the login provided. [CLIENT: 11.22.33.44]

These events are produced any time someone mistypes a password, or similar.

The issue occurs when automated brute-force entry systems attempt to access systems multiple times a second.

what wail2ban does

wail2ban is a real-time event sink for these messages. As messages come in, wail2ban takes note of the time of the attempt and the IP used in the attempt. Given enough attempts in a specific period of time, wail2ban will generate a firewall rule to block all access to the client machine for a certain period of time.

In a default setup, if an IP attempts 5 failed passwords in a 2 minute period, they get banned from attempting again for a period of time.

How long? Well, that depends on how many times they've been banned before!

There is a file called BannnedIPLog.ini that will keep a count of how many times an IP has been banned.

The punishment time is based on the function y=5^x, where x is the amount of times it has been banned, and y is the amount of minutes it's banned for.

This allows for scaling of bans, but prevent permenant bans, which may cause issues in the future as IPs are reassigned around the blagosphere.

There is also a $MAX_BANDURATION in place, which means that an IP cannot be banned for more than 3 months. Given the ban duration function gives values of years at the 10th increment, it's better to cap things out.

failsafes

As with all automated systems, there can be some false-positives.

Whitelists - this script can be configured with a whitelist of IPs that it will never ban, such as a company IP block.

Self-list - the script automatically adds a set of IPs to the whitelist that it knows as not to ban, based on the configured static IPs on the host machine. That is, it will ignore attempts from itself (or event logs which list it's own IP in the message).

Timeouts - IPs are only banned for specific period of time. After this time, they are removed from the firewall by the script. The timeouts are parsed once a new failed attempt is captured by the system. This may mean that IPs are unbanned after their exact unlock time, but for sufficiently attacked systems, this difference is not a major issue.

Jailbreak - a configuration called -jailbreak can be run against the script at any time to immediately remove all banned IPs. All their counters are reset, and it is as if the IP never tried to attack the machine.

htmlgen

I've added a script that will grep the wail2ban log file, and generate some nice statistics, and show the top banned IPs by country. Sample Report

If you want to enable this, grok the main wail2ban.ps1 script for the call to wail2ban_htmlgen.ps1, and enable it (remove the comment)

limitations

There can be improvements relating to the service-like execution of this script, so it's always running. This can be acheieved using something like non-sucking service manager, but that is left as an exercise for the reader.

Update 2020: There have been several on and off repo communications saying this code is still useful! I don't have any way to test the following, but hopefully the following may help:

• Thanks to Marco Jonas, BLOCK_TYPE is set to netsh, which I presume still exists.
• Thanks to Gl0, you can add SSL RDP Login support with this patch
• Thanks to kentuckytech, add -executionpolicy bypass -file to the .bat file if you require a bypass.

wail2ban's Issues

First ban doesn't take effect on Server 2016

First ban of an IP throws a pair of errors and doesn't take effect - errors provided below.
Second ban seems like it works as intended.

Cannot convert argument "value", with value: "System.Object[]", for "AddSeconds" to type "System.Double": "Cannot
convert the "System.Object[]" value of type "System.Object[]" to type "System.Double"."
At C:\Scripts\wail2ban.ps1:224 char:4
+             $ExpireDate = (Get-Date).AddSeconds($BanDuration)
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodException
    + FullyQualifiedErrorId : MethodArgumentConversionInvalidCastArgument

Get-Date : Cannot bind parameter 'Date' to the target. Exception setting "Date": "Cannot convert null to type
"System.DateTime"."
At C:\Scripts\wail2ban.ps1:243 char:22
+     $Expire = (get-date $ExpireDate -format u).replace("Z","")
+                         ~~~~~~~~~~~
    + CategoryInfo          : WriteError: (:) [Get-Date], ParameterBindingException
    + FullyQualifiedErrorId : ParameterBindingFailed,Microsoft.PowerShell.Commands.GetDateCommand

Cannot convert value "" to type "System.DateTime". Error: "String was not recognized as a valid DateTime."
At C:\Scripts\wail2ban.ps1:289 char:10
+ ...       if ($([int]([datetime]$ReleaseDate- (Get-Date)).TotalSeconds) - ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvalidCastParseTargetInvocationWithFormatProvider

Get-Date : Cannot bind parameter 'Date'. Cannot convert value "" to type "System.DateTime". Error: "String was not
recognized as a valid DateTime."
At C:\Scripts\wail2ban.ps1:290 char:63
+ ... ban old records: $IP looks old enough $(get-date $ReleaseDate -format ...
+                                                      ~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Get-Date], ParameterBindingException
    + FullyQualifiedErrorId : CannotConvertArgumentNoMessage,Microsoft.PowerShell.Commands.GetDateCommand

Not working on windows server 2012 R2

Hi,

Where to start to adapt this to work on windows server 2012 R2

Regards.

wail2ban is not scanning IIS's logs files

fail2ban can be configured to search in any log files, wail2ban only check Window's events store and does not bother to check any on file logs, we should be able to add regex and files to scan for addition data to make bans using the same syntax fail2ban uses for compatibility.

wail2ban could load all configuration files in a subfolder with additional regex and file paths to keep an eye on.

installation tasks - powershell execution policy

The setup instructions don't work as-is on Server 2016 - the .BAT called by the scheduled task needed a
start powershell -executionpolicy bypass -file .\wail2ban.ps1

continue on issues#5

continuing here #5 ...
So I've downloaded the lateste release and still have the same issues, what I've noticed is that on the logs themselves I get and empty souce network address field, I'm trying this on a local PC so the IPs should be all "private" LAN IPs I dont know if that would have any effect also I've seen some people saying this is related to the encryption and the type of connections there was a few way of solving this for 2008 but havent found anything for 2012 R2 dont know if anyone will have seen this and have a solution or any guidance on where to start looking in to this?
Regards and Thanks.

where is the BannnedIPLog.ini file

Hi,

I was wondering is this had been implemented?

Kind regards and thanks.
\Marco

azure vm issue

Environment

Windows 2012 R2
Azure VM

Issue: It logs the public ip of the machine and then locks it completely after 3 failed attempts. it should identify the remote ip and not the local public ip.

Script runing issue

Hi, thank for your great work.
I faced issue when I run the script.
Windows server 2012 R2
Register-WMIEvent : Access denied
At C:\scripts\wail2ban\wail2ban.ps1:425 char:1

• Register-WMIEvent -Query $query -sourceidentifier $SinkName

•   + CategoryInfo          : NotSpecified: (:) [Register-WmiEvent], ManagementException
    + FullyQualifiedErrorId : System.Management.ManagementException,Microsoft.PowerShell.Commands.RegisterWmiEventComm
   and
  
  

can you please help me to solve this out.
Regards

does not work on windows server 2012

workaround is very simple:
`
diff --git a/wail2ban.ps1 b/wail2ban.ps1
index 0cb9342..1bdd4f0 100755
--- a/wail2ban.ps1
+++ b/wail2ban.ps1
@@ -68,6 +68,7 @@ $WhiteList = @()
#You can overload the BlockType here for 2003, if you feel like having fun.
$OSVersion = invoke-expression "wmic os get Caption /value"
if ($OSVersion -match "2008") { $BLOCK_TYPE = "NETSH" }
+if ($OSVersion -match "2012") { $BLOCK_TYPE = "NETSH" }

#Grep configuration file
switch -regex -file $ConfigFile {
`