Fail2ban scans log files (e.g.
/var/log/httpd/error_log) and bans IPs that show the malicious signs like too many password failures, seeking for exploits, etc. Generally Fail2ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any other arbitrary action (e.g. sending an email) could also be configured.
The fail2ban-client allows monitoring jails (reload, restart, status, etc.), to view all available commands:
To view all enabled jails:
# fail2ban-client status
To check the status of a jail, e.g. for sshd:
# fail2ban-client status sshd
Status for the jail: sshd |- Filter | |- Currently failed: 1 | |- Total failed: 9 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 0.0.0.0
Due to the possibility of the
/etc/fail2ban/jail.conf file being overwritten or improved during a distribution update, it is recommended to create a
/etc/fail2ban/jail.local file. For example to change the default ban time to 1 day:
[DEFAULT] bantime = 1d
Or create separate name.local files under the
/etc/fail2ban/jail.d directory, e.g.
fail2ban.service to apply the configuration changes.
[sshd] enabled = true
See #Custom SSH jail.
Receive an alert e-mail
If you want to receive an e-mail when someone has been banned, you have to configure an SMTP client (e.g. msmtp) and change default action, as given below.
[DEFAULT] destemail = email@example.com sender = firstname.lastname@example.org # to ban & send an e-mail with whois report to the destemail. action = %(action_mw)s # same as action_mw but also send relevant log lines #action = %(action_mwl)s
Firewall and services
[DEFAULT] banaction = nftables
/etc/fail2ban/action.d/ for other examples, e.g. ufw.conf.
Tips and tricks
Custom SSH jail
/etc/fail2ban/jail.d/sshd.local, add this section and update the list of trusted IP addresses in
[sshd] enabled = true filter = sshd banaction = iptables backend = systemd maxretry = 5 findtime = 1d bantime = 2w ignoreip = 127.0.0.1/8
- It may be necessary to set
/etc/ssh/sshd_configto allow full fail2ban monitoring as otherwise password failures may not be logged correctly.
- Fail2ban has IPv6 support since version 0.10. Adapt your firewall accordingly, e.g. start/enable
- When using journal namespaces (by adding
LogNamespace=somethingto a unit file), you can make fail2ban read those logs by setting
backend = systemd[journalfiles="/var/log/journal/*.something/system.journal"].
Currently, Fail2ban must be run as root. Therefore, you may wish to consider hardening the process with systemd.
[Service] PrivateDevices=yes PrivateTmp=yes ProtectHome=read-only ProtectSystem=strict NoNewPrivileges=yes ReadWritePaths=-/var/run/fail2ban ReadWritePaths=-/var/lib/fail2ban ReadWritePaths=-/var/log/fail2ban ReadWritePaths=-/var/spool/postfix/maildrop ReadWritePaths=-/run/xtables.lock CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW
CAP_DAC_READ_SEARCH will allow Fail2ban full read access to every directory and file.
CAP_NET_RAW allow Fail2ban to operate on any firewall that has command-line shell interface. See for more info.
ProtectSystem=strict the filesystem hierarchy will only be read-only,
ReadWritePaths allows Fail2ban to have write access on required paths.
/etc/fail2ban/fail2ban.local with the correct
[Definition] logtarget = /var/log/fail2ban/fail2ban.log
/var/log/fail2ban/ directory as root.