Using SET in Redis for fail2ban visibility and fine control

[mrfidgety]

This might be an already-solved problem, but I just want to write this down somewhere in case it is helpful.

Goal

• Performant visibility and management of IP addresses on the banned list
• Retain fail2ban bantime/findtime/maxretry functionality
• Make use of my Redis cache

Why not fail2ban?

• Banned IPs are stored as their own key, which need to be string matched to be collated. (see comment)

Implementation

TLDR:

• Banned IPs are now stored in a SET
• Expiry per IP stored in its own separate key
• Removing IPs from set can only happen by triggering cleanup_expired_bans

New class, naming is hard, so fail3ban....

class Fail3Ban
  class << self
    def filter(discriminator, options)
      setname   = options[:setname]   or raise ArgumentError, "Must pass setname option"
      bantime   = options[:bantime]   or raise ArgumentError, "Must pass bantime option"
      findtime  = options[:findtime]  or raise ArgumentError, "Must pass findtime option"
      maxretry  = options[:maxretry]  or raise ArgumentError, "Must pass maxretry option"

      # Safety check to ensure filter is on and we have access to redis
      if filter_enabled?(setname) && redis.present?
        if banned?(setname, discriminator)
          true
        elsif yield
          fail!(setname, discriminator, bantime, findtime, maxretry)
        end
      else
        false
      end
    end

    def banned?(setname, discriminator)
      if redis.present?
        # Check for presence of discriminator in the set
        # Use .then so it is compatible with a raw Redis::Client, and ConnectionPool Redis
        redis.then { |r| r.sismember(banned_set_key(setname), discriminator) }
      else
        false
      end
    end

    # Run this at whatever cadence is suitable
    def cleanup_expired_bans(setname)
      if redis.present?
        # Iterate all banned discriminators and check for expiry key.
        banned_discriminators = redis.then { |r| r.smembers(banned_set_key(setname)) }

        banned_discriminators.each do |discriminator|
          # Remove from banned list if expiry key not present (i.e. it has expired)
          unless cache.read(banned_expiry_key(setname, discriminator))
            unban!(setname, discriminator)
          end
        end
      end
    end

    def ban!(setname, discriminator, bantime)
      # Add discriminator to banned set
      # Use .then so it is compatible with a raw Redis::Client, and ConnectionPool Redis
      redis.then { |r| r.sadd?(banned_set_key(setname), discriminator) }

      # Add key for tracking expiry of this discriminator
      cache.write(banned_expiry_key(setname, discriminator), 1, bantime)
    end

    def unban!(setname, discriminator)
      # Remove discriminator from banned set
      # Use .then so it is compatible with a raw Redis::Client, and ConnectionPool Redis
      redis.then { |r| r.srem?(banned_set_key(setname), discriminator) }

      # I have chosen not to find and remove the expiry key
      #
      # 1. It wont exist if this is called from .cleanup_expired_bans
      # 2. If it does exist, it will expire eventually and can be overwritten if need be.
    end

    protected

    def key_prefix
      "fail3ban"
    end

    # Include rack attack cache prefix as we are not using Rack::Attack.cache methods to access/mutate the set
    # and we want everything nice and neat under the same key format
    def banned_set_key(setname)
      "#{cache.prefix}:#{key_prefix}:ban:#{setname}"
    end

    def banned_expiry_key(setname, discriminator)
      "#{key_prefix}:ban:#{setname}:#{discriminator}"
    end

    def failure_count_key(setname, discriminator)
      "#{key_prefix}:count:#{setname}:#{discriminator}"
    end

    def fail!(setname, discriminator, bantime, findtime, maxretry)
      # Same counter logic as fail2ban
      count = cache.count(failure_count_key(setname, discriminator), findtime)

      if count >= maxretry
        ban!(setname, discriminator, bantime)
      end

      true
    end

    private

    def cache
      Rack::Attack.cache
    end

    def redis
      @redis ||= Rails.cache.is_a?(ActiveSupport::Cache::RedisCacheStore) ? Rails.cache.redis : nil
    end

    def filter_enabled?(setname)
      Rails.cache.exist?("fail3ban/#{setname}")
    end
  end
end

Used in Rack::Attack

# Block ip addresses that attempt to access any path ending .env or .php two times within an hour
# It will block all future requests from that IP for 24 hours.
#
# Set key: rack::attack:fail3ban:ban:pentesters
# Expiry key: rack::attack:fail3ban:ban:pentesters:#{req.ip}
blocklist("fail3ban/pentesters") do |req|
  Fail3Ban.filter(req.ip, setname: "pentesters", maxretry: 2, findtime: 1.hour, bantime: 24.hours) do
    # The count for the discriminator (req.ip) is incremented if the return value is truthy
    # A ban is initiated if the count is greater or equal to the maxretry in the allocated findtime
    # The discriminator  added to a redis set of banned items
    req.path.end_with?(".env", ".php")
  end
end

Worker to cleanup (I run this hourly)

module RackAttack
  class ClearExpiredFail3banBlocklists
    include Sidekiq::Job

    def perform
      Rack::Attack::Fail3Ban.cleanup_expired_bans("pentesters")
    end
  end
end

Now I can do this:

If I have done something silly please point it out to me!