TCP port scan detection with HAProxy

I'm doing this on Debian Linux, but you should be able to do the same on any of HAProxy's supported platforms, like FreeBSD or other Linux distributions.

HAProxy was never intended to be used as a port scan detector. This TCP port scan detection is really a deliberate misuse of the "bind" keyword for HAProxy. HAProxy's "bind" accepts a dash-delimited ports range, and you can make HAProxy listen on about 40,000 TCP ports without any problem.

You have to skip ports for your real TCP services. I will skip SMTP (TCP port 25) and HTTP (TCP port 80) in the following example.

Install HAProxy first.

apt-get install haproxy

Append the following lines to HAProxy's configuration at /etc/haproxy/haproxy.cfg.

frontend fr_tcp
    log /dev/log local2
    mode tcp
    bind <IP address of your HAProxy server>:1-24
    bind <IP address of your HAProxy server>:26-79
    bind <IP address of your HAProxy server>:81-40000
    log-format %ci:%cp\ =>\ %[dst]:%[dst_port]\ [%t]\ %ft\ %b/%s\ %Tw/%Tc/%Tt\ %B\ %ts\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq
    default_backend bk_tcp

backend bk_tcp
    mode tcp
    server www-2 127.0.0.1:1028

In the frontend section, HAProxy is configured to accept connections on TCP ports 1 to 40,000 minus 25 and 80. A custom log format is used to record IP addresses and port numbers of source and destination nodes, which are separated by a "=>" character string.

The backend section specifies a backend server at 127.0.0.1:1028. You can change the IP address and/or port number. It doesn't matter whether you have a TCP service there, and I don't have one. This is just to get a working configuration.

You have to stop and start HAProxy again to make the new configuration come into effect. I don't just restart or reload HAProxy because sometimes it seemed to run out of file descriptors and I have to reboot my Debian Linux.

service haproxy stop
service haproxy start

Give it some time, I guess at most half an hour, and you should see some logged actions in /var/log/messages or /var/log/syslog, like the following:

2018-09-29T03:21:53.912375+00:00 h4fvps1 haproxy[6415]: 45.XXX.49.XXX:64768 => 1YY.Y40.YY.1Y8:445 [29/Sep/2018:03:21:50.908] fr_tcp bk_tcp/www-2 1/-1/3003 0 SC 0/0/0/0/3 0/0

The line above shows that a host at IP 45.XXX.49.XXX tried to connect to TCP port 445 of my server at IP 1YY.Y40.YY.1Y8.

I prefer to keep HAProxy's log in its own file, so I changed the content of the file /etc/rsyslod.d/49-haproxy.conf to the following (only uncommented lines are shown):

$AddUnixListenSocket /var/lib/haproxy/dev/log
local2.* /var/log/haproxy.log

That's it.

Before this "misuse" of HAProxy, I had tried my hands on scanlogd and PSAD, two security tools capable of detecting port scans. But none of them really accept TCP connections, which makes me doubt the validity of source IP addresses they logged. HAProxy does not have this problem because it really listens on all the TCP ports you specified in haproxy.cfg. You can verify it yourself by issuing the following command:

netstat -an | grep LISTEN | wc

The number printed should be larger than the number of ports specified in your haproxy.cfg.