Difference between revisions of "Fail2ban"

From ArchWiki
Jump to navigation Jump to search
m (fail2ban-client: typo)
(fail2ban-client: Change order)
Line 28: Line 28:
  $ fail2ban-client
  $ fail2ban-client
E.g. to check the status of the ''sshd'' jail:
To view all enabled jails:
# fail2ban-client status
To check the status of a jail, e.g. for ''sshd'':
{{hc|# fail2ban-client status sshd|<nowiki>
{{hc|# fail2ban-client status sshd|<nowiki>
Line 41: Line 45:
   `- Banned IP list:
   `- Banned IP list:
To view all enabled jails:
# fail2ban-client status
== Service hardening ==
== Service hardening ==

Revision as of 15:06, 20 June 2018

ro:Fail2ban Fail2ban scans log files (e.g. /var/log/httpd/error_log) and bans IPs that show the malicious signs like too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured.

Warning: Using an IP banning software will stop trivial attacks but it relies on an additional daemon and successful logging. Additionally, if the attacker knows your IP address, they can send packets with a spoofed source header and get your IP address banned.


Install fail2ban.

If you want Fail2ban to send an email when someone has been banned, you have to configure SSMTP (for example).


Enable/start fail2ban.service.


The fail2ban-client allows monitoring jails (reload, restart, status, etc.), to view all available commands:

$ fail2ban-client

To view all enabled jails:

# fail2ban-client status

To check the status of a jail, e.g. for sshd:

# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     9
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list:

Service hardening

Currently, fail2ban must be run as root. Therefore, you may wish to consider hardening the process with systemd.

Create a drop-in configuration file for fail2ban.service:


The CapabilityBoundingSet parameters CAP_DAC_READ_SEARCH will allow fail2ban full read access to every directory and file, CAP_NET_ADMIN and CAP_NET_RAW allow setting of firewall rules with iptables. See capabilities(7) for more info.

By using ProtectSystem=strict the filesystem hierarchy will only be read-only, ReadWritePaths allows fail2ban to have write access on required paths.

Create /etc/fail2ban/fail2ban.local with the correct logtarget path:

logtarget = /var/log/fail2ban/fail2ban.log

Finally, reload systemd to apply the changes of the unit:

# systemctl daemon-reload


Due to the possibility of the /etc/fail2ban/jail.conf file being overwritten or improved during a distribution update, it is recommended to Create /etc/fail2ban/jail.local file. For example to change default ban time to 1 day:

bantime = 1d

Or create separate name.local files under the /etc/fail2ban/jail.d directory, e.g. /etc/fail2ban/jail.d/ssh-iptables.local.

Enabling jails

Append enabled = true to service one want to use, e.g. to enable the OpenSSH jail:


# SSH servers


#mode   = normal
enabled = true
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
Note: It may be necessary to set LogLevel INFO in /etc/ssh/sshd_config to allow full fail2ban monitoring.

Restart fail2ban.service to apply configuration changes.

Firewall and services

Most firewalls and services should work out of the box. See /etc/fail2ban/action.d/ for examples, e.g. ufw.conf.

Tips and tricks

Custom SSH jail

Warning: If the attacker knows your IP address, they can send packets with a spoofed source header and get your IP address locked out of the server. SSH keys provide an elegant solution to the problem of brute forcing without these problems.

Edit /etc/fail2ban/jail.d/sshd.local, add this section and update the list of trusted IP addresses in ignoreip.

If your firewall is iptables:

enabled  = true
filter   = sshd
action   = iptables
backend  = systemd
maxretry = 5
findtime = 1d
bantime  = 2w
ignoreip =

fail2ban has IPv6 support since version 0.10. Adapt your firewall accordingly, e.g. start and enable ip6tables.service.

Note: If your firewall is shorewall, replace iptables with shorewall. You can also set BLACKLIST to ALL in /etc/shorewall/shorewall.conf, otherwise the rule added to ban an IP address will affect only new connections.

Also do not forget to add/change:


in your /etc/ssh/sshd_config. Else, password failures are not logged correctly.

See also