If you want Fail2ban to send an email when someone has been banned, you have to configure SSMTP (for example).
Currently, fail2ban must be run as root. Therefore, you may wish to consider hardening the process with systemd. Ref:systemd for Administrators, Part XII
For added security, consider limiting fail2ban capabilities by specifying
CapabilityBoundingSet in the drop-in configuration file for the provided
[Service] CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW
In the example above,
CAP_DAC_READ_SEARCH will allow fail2ban full read access, and
CAP_NET_RAW allow setting of firewall rules with iptables. Additional capabilities may be required, depending on your fail2ban configuration. See for more info.
Consider limiting file system read and write access by using ReadOnlyDirectories and ReadWriteDirectories, under the
[Service] section. For example:
ReadOnlyDirectories=/ ReadWriteDirectories=/var/run/fail2ban /var/lib/fail2ban /var/spool/postfix/maildrop /tmp /var/log/fail2ban
In the example above, this limits the file system to read-only, except for
/var/run/fail2ban for pid and socket files, and
/var/spool/postfix/maildrop for postfix sendmail. Again, this will be dependent on you system configuration and fail2ban configuration. The
/tmp directory is needed for some fail2ban actions. Note that adding
/var/log/fail2ban is necessary if you want fail2ban to log its activity. Make sure all the directories exist, or you will get error code 226 on starting the service. And modify logtarget in
logtarget = /var/log/fail2ban/fail2ban.log
jail.conffile being overwritten or improved during a distribution update, it is recommended to provide customizations in a
jail.localfile, or separate .conf files under the
Jails for many different services are already present in
/etc/fail2ban/jail.conf but not enabled by default. You can copy the section headers into a .local file of your choice, enable them (and optionally override settings).
There is currently basic support for archlinux, to activate that configuration, add or alter the following section in the
[INCLUDES] before = paths-arch.conf
fail2ban.service to test your configuration. Watch out for "file not found errors" from fail2ban-client if the fail2ban service fails to start. Adjust the paths
jail.local as needed. Many of the default jails might not work out of the box.
Custom SSH jail
/etc/fail2ban/jail.d/jail.conf, add this section and update the list of trusted IP addresses.
If your firewall is iptables:
[DEFAULT] bantime = 1d ignoreip = 127.0.0.1/8 [sshd] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois[name=SSH, email@example.com, firstname.lastname@example.org] backend = systemd maxretry = 5 findtime = 1d bantime = 2w
fail2ban has IPv6 support since version 0.10. Adapt your firewall accordingly, e.g. start and enable ip6tables.service.
iptables[name=SSH, port=ssh, protocol=tcp]with
shorewall. You can also set
/etc/shorewall/shorewall.conf, otherwise the rule added to ban an IP address will affect only new connections.
Also do not forget to add/change:
/etc/ssh/sshd_config. Else, password failures are not logged correctly.