Difference between revisions of "Fail2ban"

From ArchWiki
Jump to: navigation, search
m (" don't " -> " do not ")
m (codeline -> ic)
Line 16: Line 16:
 
  # pacman -S whois
 
  # pacman -S whois
  
Now you can start the {{Codeline|fail2ban}} daemon:
+
Now you can start the {{Ic|fail2ban}} daemon:
 
  # /etc/rc.d/fail2ban start
 
  # /etc/rc.d/fail2ban start
  
Line 43: Line 43:
 
  maxretry = 5
 
  maxretry = 5
  
{{Note|You can set {{Codeline|BLACKLISTNEWONLY}} to {{Codeline|No}} in {{Filename|/etc/shorewall/shorewall.conf}} otherwise the rule added to ban an IP address will affect only new connections.}}
+
{{Note|You can set {{Ic|BLACKLISTNEWONLY}} to {{Ic|No}} in {{Filename|/etc/shorewall/shorewall.conf}} otherwise the rule added to ban an IP address will affect only new connections.}}
  
 
Also do not forget to add/change:
 
Also do not forget to add/change:

Revision as of 17:33, 11 December 2011

This template has only maintenance purposes. For linking to local translations please use interlanguage links, see Help:i18n#Interlanguage links.


Local languages: Català – Dansk – English – Español – Esperanto – Hrvatski – Indonesia – Italiano – Lietuviškai – Magyar – Nederlands – Norsk Bokmål – Polski – Português – Slovenský – Česky – Ελληνικά – Български – Русский – Српски – Українська – עברית – العربية – ไทย – 日本語 – 正體中文 – 简体中文 – 한국어


External languages (all articles in these languages should be moved to the external wiki): Deutsch – Français – Română – Suomi – Svenska – Tiếng Việt – Türkçe – فارسی

Warning: Using an IP blacklist will stop trivial attacks but it relies on an additional daemon and successful logging (the partition containing /var can become full, especially if an attacker is pounding on the server). Additionally, if the attacker knows your IP address, they can send packets with a spoofed source header and get you locked out of the server. SSH keys provide an elegant solution to the problem of brute forcing without these problems.

Fail2ban scans log files like Template:Filename or Template:Filename and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Installation

First, install Gamin so that Fail2ban can detect modification to the log files:

# pacman -S gamin

Then, install Template:Package Official:

# pacman -S fail2ban

If you want Fail2ban to send an email when someone has been banned, you have to configure SSMTP (for example). You will also have to install Template:Package Official to get some information about the attacker.

# pacman -S whois

Now you can start the fail2ban daemon:

# /etc/rc.d/fail2ban start

You can add it into DAEMONS array in Template:Filename:

DAEMONS=(... fail2ban ...)

SSH jail

Edit Template:Filename and modify the ssh-iptables section to enable it and configure the action.

If your firewall is iptables:

[ssh-iptables]
enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]                                         
           sendmail-whois[name=SSH, dest=your@mail.org, sender=fail2ban@mail.com]
logpath  = /var/log/auth.log                                                                    
maxretry = 5

If your firewall is shorewall:

[ssh-shorewall]
enabled  = true
filter   = sshd
action   = shorewall
           sendmail-whois[name=SSH, dest=your@mail.org, sender=fail2ban@mail.com]
logpath  = /var/log/auth.log                                                                    
maxretry = 5
Note: You can set BLACKLISTNEWONLY to No in Template:Filename otherwise the rule added to ban an IP address will affect only new connections.

Also do not forget to add/change:

LogLevel VERBOSE

in your Template:Filename. Else, password failures are not logged correctly.

See also