Harden Portainer and Apache2 Reverse Proxy with fail2ban

apache2_portainer_fail2ban.md

Fail2ban and Portainer with Apache2 Reverse Proxy

Prerequsits

• Ubuntu 22.04
• Portainer with Remote access
• apache2 as reverse proxy e.g. as described here
• fail2ban and e.g. iptables are installed
• Portainer is accesible via https://YourDomain/portainer/

User --> https --> Apache2 --> http(s) --> Portainer

IMPORTANT NOTE

Usually it is a bad idea to make portainer accessible via internet as front end. It has a HUGE SECURITY RISK, please know what you are doing!

Short how-to harden your Portainer Server with Fail2Ban

Install fail2ban:

sudo apt update && sudo apt install fail2ban -y

Create the Portainer-filter:

sudo nano /etc/fail2ban/filter.d/apache-portainer.conf

Portainer will not write Host IP in authentication errors in logs, but you have chance to track it via apache2 access.log as 401 and 422 errors.

Paste the following lines in /etc/fail2ban/filter.d/apache-portainer.conf, this will cover GUI Failed login attempts:

[Definition]
failregex = ^<HOST>.+?\/portainer\/api\/.+? HTTP\/\d+(?:\.\d+)?\" 4(?:01|22)
ignoreregex = 
    
[Init]
datepattern = \[%%d/%%b/%%Y:%%H:%%M:%%S %%z\]

Create a new jail:

sudo nano /etc/fail2ban/jail.d/apache-portainer.local

Paste the following rows:

[apache_portainer]
backend = auto
enabled = true
port = 80,443
protocol = tcp
filter = apache_portainer
# Number of retrys before to ban. Portainer produces from 2 to 5 log entries per request or failed login.
maxretry = 10
#time in seconds
bantime = 36000
findtime = 36000
# Log path, on Ubuntu usually is following
logpath = /var/log/apache2/access.log

Re-start the fail2ban-service:

sudo service fail2ban restart

and enjoy your Portainer!

Not really, portainer itself do not log such kind of activities. But it will answer with correct http codes so you can catch it via reverse proxy.

Not really, portainer itself do not log such kind of activities. But it will answer with correct http codes so you can catch it via reverse proxy.

oh thanks for the response. Would that work with Nginx Proxy Manager? Or do you recommend instead to use OAuth with Authentik and implement 2FA?

Sure, this will work, you need to click on 3 dots and findout Proxy Host Number as on screenshot I have 15:

Then add corresponding log to your Fail2Ban, e.g. for this example it will be your_Path_to_NPM/data/logs/proxy-host-15_access.log.
You have to update fail2ban rule, as this tool has slightly different logs format, e.g. <HOST> will be somewhere in [Client <HOST>] area.