Fail2ban scans log files (e.g.
/var/log/httpd/error_log) and bans IPs that show the malicious signs like too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured.
The fail2ban-client allows monitoring jails (reload, restart, status, etc.), to view all available commands:
To view all enabled jails:
# fail2ban-client status
To check the status of a jail, e.g. for sshd:
# fail2ban-client status sshd
Status for the jail: sshd |- Filter | |- Currently failed: 1 | |- Total failed: 9 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 0.0.0.0
Due to the possibility of the
/etc/fail2ban/jail.conf file being overwritten or improved during a distribution update, it is recommended to Create
/etc/fail2ban/jail.local file. For example to change default ban time to 1 day:
[DEFAULT] bantime = 1d
Or create separate name.local files under the
/etc/fail2ban/jail.d directory, e.g.
fail2ban.service to apply the configuration changes.
[sshd] enabled = true
See #Custom SSH jail.
Receive an alert e-mail
If you want to receive an e-mail when someone has been banned, you have to configure an SMTP client (e.g. msmtp) and change default action, as given below.
[DEFAULT] destemail = firstname.lastname@example.org sender = email@example.com # to ban & send an e-mail with whois report to the destemail. action = %(action_mw)s # same as action_mw but also send relevant log lines #action = %(action_mwl)s
Firewall and services
Tips and tricks
Custom SSH jail
/etc/fail2ban/jail.d/sshd.local, add this section and update the list of trusted IP addresses in
If your firewall is iptables:
[sshd] enabled = true filter = sshd banaction = iptables backend = systemd maxretry = 5 findtime = 1d bantime = 2w ignoreip = 127.0.0.1/8
fail2ban has IPv6 support since version 0.10. Adapt your firewall accordingly, e.g. start and enable
shorewall. You can also set
/etc/shorewall/shorewall.conf, otherwise the rule added to ban an IP address will affect only new connections.
/etc/ssh/sshd_configto allow full fail2ban monitoring as otherwise password failures may not be logged correctly.
Currently, fail2ban must be run as root. Therefore, you may wish to consider hardening the process with systemd.
Create a drop-in configuration file for
[Service] PrivateDevices=yes PrivateTmp=yes ProtectHome=read-only ProtectSystem=strict NoNewPrivileges=yes ReadWritePaths=-/var/run/fail2ban ReadWritePaths=-/var/lib/fail2ban ReadWritePaths=-/var/log/fail2ban ReadWritePaths=-/var/spool/postfix/maildrop CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW
CAP_DAC_READ_SEARCH will allow fail2ban full read access to every directory and file,
CAP_NET_RAW allow setting of firewall rules with iptables. See for more info.
ProtectSystem=strict the filesystem hierarchy will only be read-only,
ReadWritePaths allows fail2ban to have write access on required paths.
/etc/fail2ban/fail2ban.local with the correct
[Definition] logtarget = /var/log/fail2ban/fail2ban.log