nextcloud / nextcloud/nextcloudpi
Fail2Ban & UFW banning after UDP requests
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 2.9k
- Forks
- 318
- PR merge metrics
- No merged PRs in 30d
Description
Hello Team,
I have got a fresh nextcloudpi installation with version 1.51.1.
I have activated the "Uncomplicated Firewall" (UFW) and Fail2Ban:
Also DynDNS is active, and Fritz.Box is distributing the NextcloudPI installation as local DNS Server.
UFW is reporting this logon failure to /var/log/ufw.log
Apr 10 11:08:08 nextcloudpi kernel: [42554.194148] [UFW BLOCK] IN=eth0 OUT= MAC= ... LEN=64 TOS=0x00 PREC=0x00 TTL=128 ID=54790 PROTO=UDP SPT=61128 DPT=53 LEN=44
Because of this entries fail2ban is sending my computer to jail.
Unfortunatelly I do not know, with UDP requests my computer is sending.
Even, if this is a standard installation without any changes, I belive that this requests should not be shown as failures in the UFW.
Thank you
superma
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the reported /var/log/ufw.log entry and the Fail2Ban and UFW settings from the standard NextcloudPi 1.51.1 installation. Reproduce the UDP request from the local DNS setup and determine whether the default configuration incorrectly jails the client; done means the expected behavior and any required configuration change are verified.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100