Difference between revisions of "Fail2ban"

From ArchWiki
Jump to: navigation, search
(SSMTP & whois)
(SSH jail)
Line 12: Line 12:
  
 
=SSH jail=
 
=SSH jail=
 +
Edit {{Filename|/etc/fail2ban/jail.conf}} and modify ssh-iptables section to enable it and configure the action.
 +
 +
If your firewall is iptables :
 +
<pre>
 +
[ssh-iptables]
 +
enabled  = true
 +
filter  = sshd
 +
action  = iptables[name=SSH, port=ssh, protocol=tcp]                                       
 +
          sendmail-whois[name=SSH, dest=your@mail.org, sender=fail2ban@mail.com]
 +
logpath  = /var/log/auth.log                                                                   
 +
maxretry = 5
 +
</pre>
 +
 +
If your firewall is shorewall :
 +
<pre>
 +
[ssh-iptables]
 +
enabled  = true
 +
filter  = sshd
 +
action  = shorewall
 +
          sendmail-whois[name=SSH, dest=your@mail.org, sender=fail2ban@mail.com]
 +
logpath  = /var/log/auth.log                                                                   
 +
maxretry = 5
 +
</pre>

Revision as of 16:31, 9 January 2010

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Installation

First, we need to install Gamin so that fail2ban can detect modification to the log files. See this page. Generally, you will just have to do :

#pacman -S gamin

Then you can install fail2ban

#pacman -S fail2ban

If you want fail2ban to send an email when someone has been banned, you have to configure SSMTP (for example). You will also have to install whois to get some information about the attacker.

#pacman -S whois

SSH jail

Edit Template:Filename and modify ssh-iptables section to enable it and configure the action.

If your firewall is iptables :

[ssh-iptables]
enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]                                         
           sendmail-whois[name=SSH, dest=your@mail.org, sender=fail2ban@mail.com]
logpath  = /var/log/auth.log                                                                    
maxretry = 5

If your firewall is shorewall :

[ssh-iptables]
enabled  = true
filter   = sshd
action   = shorewall
           sendmail-whois[name=SSH, dest=your@mail.org, sender=fail2ban@mail.com]
logpath  = /var/log/auth.log                                                                    
maxretry = 5