Fail2ban
Fail2ban scans log files (e.g. /var/log/httpd/error_log
) and bans IPs that show the malicious signs like too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured.
ignoreip
.Contents
Installation
Usage
Configure fail2ban and enable/start fail2ban.service
.
fail2ban-client
The fail2ban-client allows monitoring jails (reload, restart, status, etc.), to view all available commands:
$ fail2ban-client
To view all enabled jails:
# fail2ban-client status
To check the status of a jail, e.g. for sshd:
# fail2ban-client status sshd
Status for the jail: sshd |- Filter | |- Currently failed: 1 | |- Total failed: 9 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 0.0.0.0
Configuration
Due to the possibility of the /etc/fail2ban/jail.conf
file being overwritten or improved during a distribution update, it is recommended to Create /etc/fail2ban/jail.local
file. For example to change default ban time to 1 day:
/etc/fail2ban/jail.local
[DEFAULT] bantime = 1d
Or create separate name.local files under the /etc/fail2ban/jail.d
directory, e.g. /etc/fail2ban/jail.d/sshd.local
.
Restart fail2ban.service
to apply the configuration changes.
Enabling jails
By default all jails are disabled. Append enabled = true
to the jail you want to use, e.g. to enable the OpenSSH jail:
/etc/fail2ban/jail.local
[sshd] enabled = true
See #Custom SSH jail.
Receive an alert e-mail
If you want to receive an e-mail when someone has been banned, you have to configure an SMTP client (e.g. msmtp) and change default action, as given below.
/etc/fail2ban/jail.local
[DEFAULT] destemail = yourname@example.com sender = yourname@example.com # to ban & send an e-mail with whois report to the destemail. action = %(action_mw)s # same as action_mw but also send relevant log lines #action = %(action_mwl)s
Firewall and services
Most firewalls and services should work out of the box. See /etc/fail2ban/action.d/
for examples, e.g. ufw.conf.
Tips and tricks
Custom SSH jail
Edit /etc/fail2ban/jail.d/sshd.local
, add this section and update the list of trusted IP addresses in ignoreip
.
If your firewall is iptables:
[sshd] enabled = true filter = sshd banaction = iptables backend = systemd maxretry = 5 findtime = 1d bantime = 2w ignoreip = 127.0.0.1/8
fail2ban has IPv6 support since version 0.10. Adapt your firewall accordingly, e.g. start and enable ip6tables.service
.
iptables
with shorewall
. You can also set BLACKLIST
to ALL
in /etc/shorewall/shorewall.conf
, otherwise the rule added to ban an IP address will affect only new connections.LogLevel VERBOSE
in /etc/ssh/sshd_config
to allow full fail2ban monitoring as otherwise password failures may not be logged correctly.Service hardening
Currently, fail2ban must be run as root. Therefore, you may wish to consider hardening the process with systemd.
Create a drop-in configuration file for fail2ban.service
:
/etc/systemd/system/fail2ban.service.d/override.conf
[Service] PrivateDevices=yes PrivateTmp=yes ProtectHome=read-only ProtectSystem=strict NoNewPrivileges=yes ReadWritePaths=-/var/run/fail2ban ReadWritePaths=-/var/lib/fail2ban ReadWritePaths=-/var/log/fail2ban ReadWritePaths=-/var/spool/postfix/maildrop CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW
The CapabilityBoundingSet
parameters CAP_DAC_READ_SEARCH
will allow fail2ban full read access to every directory and file, CAP_NET_ADMIN
and CAP_NET_RAW
allow setting of firewall rules with iptables. See capabilities(7) for more info.
By using ProtectSystem=strict
the filesystem hierarchy will only be read-only, ReadWritePaths
allows fail2ban to have write access on required paths.
Create /etc/fail2ban/fail2ban.local
with the correct logtarget
path:
/etc/fail2ban/fail2ban.local
[Definition] logtarget = /var/log/fail2ban/fail2ban.log
Finally, reload systemd daemon to apply the changes of the unit and restart fail2ban.service
.