Fail2Ban : Intrusion Prevention System2025/12/10 |
|
Install and configure [Fail2Ban] that is the kind of Intrusion Detection System. |
|
| [1] | Install Fail2Ban. |
|
dlp:~ # zypper -n install fail2ban
|
| [2] | The default configuration is defined in [/etc/fail2ban/jail.conf]. The default values may change with package updates, so if you want to change the settings, create a [jail.local] file and modify it. |
|
dlp:~ #
vi /etc/fail2ban/jail.conf # line 87 : ignore your own local IP #ignoreself = true # line 92 : possible to add ignored networks #ignoreip = 127.0.0.1/8 ::1 # line 103 : number of seconds that a host is banned # - 1m ⇒ 1 minutes # - 1h ⇒ 1 houer # - 1d ⇒ 1 day # - 1mo ⇒ 1 month # - 1y ⇒ 1 year bantime = 10m # line 107 : A host is banned if it has generated "maxretry" during the last "findtime" findtime = 10m # line 110 : "maxretry" is the number of failures before a host get banned maxretry = 5 # line 132 : "backend" specifies the backend used to get files modification backend = auto # line 178 : destination email address if enabling email notification destemail = root@localhost # line 181 : sender address if enabling email notification sender = root@<fq-hostname> # line 263 : default action # - %(action_)s ⇒ ban only # - %(action_mw)s ⇒ band and email notification (includes Whois info) # - %(action_mwl)s ⇒ band and email notification (includes Whois info and logs) action = %(action_)s
dlp:~ #
vi /etc/fail2ban/jail.local
# create new
# possible to override the default values
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
bantime = 1d
findtime = 5m
maxretry = 5
destemail = root@localhost
sender = root@dlp.srv.world
systemctl enable --now fail2ban
|
| [3] | If you want to monitor services, add settings. (Default is unset) As an example, set the SSH as the service to be monitored. |
|
dlp:~ # fail2ban-client status Status |- Number of jail: 0 `- Jail list:
dlp:~ #
vi /etc/fail2ban/jail.d/sshd.conf # create new [sshd] enabled = true # possible to override the default values by service bantime = 600 findtime = 3m maxretry = 5 action = %(action_mw)s
dlp:~ #
systemctl reload fail2ban
# show status dlp:~ # fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 0 |- Total banned: 0 `- Banned IP list: # some hosts that exceed the threshold are banned dlp:~ # fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 5 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 10.0.0.211 # actual ban action is controlled by nftables dlp:~ # nft list table ip filter
# Warning: table ip filter is managed by iptables-nft, do not touch!
table ip filter {
chain f2b-sshd {
ip saddr 10.0.0.211 counter packets 21 bytes 2840 xt target "REJECT"
counter packets 0 bytes 0 return
}
# if enabled email notifications, you will receive the following email dlp:~ # mail
"/root/Maildir": 4 messages 1 new 1 unread
U 3 Fail2Ban Wed Dec 10 01:14 18/478 [Fail2Ban] sshd: started on dlp.srv.world
>N 4 Fail2Ban Wed Dec 10 01:20 90/3309 [Fail2Ban] sshd: banned 10.0.0.211 from dlp.srv.world
& 4
Return-Path: <root@dlp.srv.world>
X-Original-To: root@dlp.srv.world
Delivered-To: root@dlp.srv.world
Received: by dlp.srv.world (Postfix, from userid 0)
id 903E2903E; Wed, 10 Dec 2025 10:20:21 +0900 (JST)
Subject: [Fail2Ban] sshd: banned 10.0.0.211 from dlp.srv.world
Date: Wed, 10 Dec 2025 10:20:21 +0900
From: Fail2Ban <root@dlp.srv.world>
To: root@dlp.srv.world
Message-Id: <20251210012021.903E2903E@dlp.srv.world>
Hi,
The IP 10.0.0.211 has just been banned by Fail2Ban after
5 attempts against sshd.
Here is more information about 10.0.0.211 :
.....
.....
|
| [4] | If you want to manually add or remove banned hosts, run the following. |
|
dlp:~ # fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 5 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 10.0.0.211 # unban [10.0.0.211] dlp:~ # fail2ban-client set sshd unbanip 10.0.0.211 1 fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 5 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 0 |- Total banned: 1 `- Banned IP list: # ban [10.0.0.192/28] dlp:~ # fail2ban-client set sshd banip 10.0.0.192/28 1 fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 5 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 1 |- Total banned: 2 `- Banned IP list: 10.0.0.192/28 # to remove all banned hosts, run like follows dlp:~ # fail2ban-client unban --all |
| [5] | [jail.conf] has many predefined services other than SSH, so you can set them as monitoring targets by specifying the definition name. |
|
dlp:~ # grep '^\[' /etc/fail2ban/jail.conf | tail -n +3 [sshd] [dropbear] [selinux-ssh] [apache-auth] [apache-badbots] [apache-noscript] [apache-overflows] [apache-nohome] [apache-botsearch] [apache-fakegooglebot] [apache-modsecurity] [apache-shellshock] [openhab-auth] ..... ..... # create new [apache-auth] enabled = true bantime = 600 findtime = 3m maxretry = 5 action = %(action_mw)s # create new [vsftpd] enabled = true backend = systemd journalmatch = _SYSTEMD_UNIT=vsftpd.service action = %(action_mw)s # create new [postfix-sasl] enabled = true action = %(action_mw)s
dlp:~ #
dlp:~ # systemctl reload fail2ban
fail2ban-client status Status |- Number of jail: 4 `- Jail list: apache-auth, postfix-sasl, sshd, vsftpd # verify settings by failing authentication manually dlp:~ # fail2ban-client status apache-auth Status for the jail: apache-auth |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- File list: /var/log/apache2/error_log `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 10.0.0.215dlp:~ # fail2ban-client status vsftpd Status for the jail: vsftpd |- Filter | |- Currently failed: 1 | |- Total failed: 1 | `- Journal matches: _SYSTEMD_UNIT=vsftpd.service `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 10.0.0.215 |
| Sponsored Link |
|
|