Fail2ban is an intrusion prevention framework written in the Python programming language. It is able to run on POSIX systems that have an interface to a packet-control system or firewall installed locally (for example, iptables or TCP Wrapper).
Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system’s security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator.
Fail2ban is typically set up to unban a blocked host within a certain period, so as to not “lock out” any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.
Fail2ban can perform multiple actions whenever an abusive IP is detected: update Netfilter/iptables or PF firewall rules, TCP Wrapper’s hosts.deny table, to reject an abuser’s IP address; email notifications; or any user-defined action that can be carried out by a Python script.
The standard configuration ships with filters for Apache, Lighttpd, sshd, vsftpd, qmail, Postfix and Courier Mail Server. Filters are defined by Python regexes, which may be conveniently customized by an administrator familiar with regular expressions. A combination of a filter and an action is known as a “jail”, and is what causes a malicious host to be blocked from accessing specified network services. As well as the examples that are distributed with the software, a “jail” may be created for any network-facing process that creates a log file of access
Fail2ban fails to protect against a distributed brute force attack.
DenyHosts. “Fail2ban is similar to DenyHosts … but unlike DenyHosts which focuses on SSH, fail2ban can be configured to monitor any service that writes login attempts to a log file, and instead of using /etc/hosts.deny only to block IP addresses/hosts, fail2ban can use Netfilter/iptables and TCP Wrappers /etc/hosts.deny.”
list of the main features available in Fail2ban:
Parses log files and looks for given patterns.
Executes commands when a pattern has been detected for the same IP address for more than X times. X can be changed.
After a given amount of time, executes another command in order to unban the IP address.
Uses Netfilter/Iptables by default but can also use TCP Wrapper (/etc/hosts.deny) and many other firewalls/actions.
Handles log files rotation.
Can handle multiple service (sshd, apache, vsftpd, etc).
Resolves DNS hostname to IP address (use with caution, disable by usedns = no).
# yum install fail2ban
You should follow the securinng SSH howto before configuring Fail2ban as most attacks on the system will be attempting to gain access to your system via SSH. Pay close attention to things such as not allowing root logins, max retry attempts, and use of ssh keys. You can use sudo or (su -) to gain root access once logged into the system as a normal user.
# vi /etc/jail.conf
ignoreip = 127.0.0.1
Add another ignoreip directive here and put your ip if it doesn’t change.This will prevent you from banning yourself by accident.
bantime = 600
This effectively sets the ban infintely. Adjust to your needs. The default is 10 minutes, or 600 seconds.
findtime = 600
A host is banned if it has generated “maxretry” during the last “findtime” seconds.
maxretry = 3
It’s ok to leave this at 3, for more security or if you use keys only, set it to 1.
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois[name=SSH, email@example.com, firstname.lastname@example.org]
logpath = /var/log/secure
maxretry = 5
This is the most popular/necessary chain, set your email destination and sender here.This will notify you when a user is added/banned in this chain. dest= is your email address, sender= is the address the email comes from for filtering purposes. A setting of one will ban anyone who attempts to login without a key.
# chkconfig –level 23 fail2ban on
# service fail2ban start