Difference between revisions of "Fail2ban"

From ArchWiki
Jump to: navigation, search
(added categories)
(clean-up)
Line 1: Line 1:
 
[[Category:Networking (English)]]
 
[[Category:Networking (English)]]
 
[[Category:Security (English)]]
 
[[Category:Security (English)]]
 +
[http://www.fail2ban.org/wiki/index.php/Main_Page Fail2ban] scans log files like {{Filename|/var/log/pwdfail}} or {{Filename|/var/log/apache/error_log}} and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.
  
Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.
+
==Installation==
 +
First, install [[Gamin]] so that Fail2ban can detect modification to the log files:
 +
# pacman -Sy gamin
  
=Installation=
+
Then, install {{Package Official|fail2ban}}:
First, we need to install Gamin so that fail2ban can detect modification to the log files. See this [[Gamin|page]]. Generally, you will just have to do :
+
  # pacman -S fail2ban
  #pacman -S gamin
+
  
Then you can install fail2ban
+
If you want Fail2ban to send an email when someone has been banned, you have to configure [[SSMTP]] (for example). You will also have to install whois to get some information about the ''attacker''.
  #pacman -S fail2ban
+
  # pacman -S whois
  
If you want fail2ban to send an email when someone has been banned, you have to configure [[SSMTP]] (for example). You will also have to install whois to get some information about the ''attacker''.
+
Now you can start the {{Codeline|fail2ban}} daemon:
#pacman -S whois
+
 
+
Now you can start fail2ban :
+
 
  # /etc/rc.d/fail2ban start
 
  # /etc/rc.d/fail2ban start
  
You can add it into DAEMONS array in {{Filename|/etc/rc.conf}} :  
+
You can add it into DAEMONS array in {{Filename|/etc/rc.conf}}:  
 
  DAEMONS=(... fail2ban ...)
 
  DAEMONS=(... fail2ban ...)
  
 +
==SSH jail==
 +
Edit {{Filename|/etc/fail2ban/jail.conf}} and modify the ssh-iptables section to enable it and configure the action.
  
=SSH jail=
+
If your firewall is iptables:
Edit {{Filename|/etc/fail2ban/jail.conf}} and modify ssh-iptables section to enable it and configure the action.
+
 
+
If your firewall is iptables :
+
 
  [ssh-iptables]
 
  [ssh-iptables]
 
  enabled  = true
 
  enabled  = true
Line 33: Line 31:
 
  maxretry = 5
 
  maxretry = 5
  
If your firewall is shorewall :
+
If your firewall is shorewall:
 
  [ssh-iptables]
 
  [ssh-iptables]
 
  enabled  = true
 
  enabled  = true
Line 42: Line 40:
 
  maxretry = 5
 
  maxretry = 5
  
{{Note|You can set BLACKLISTNEWONLY to No in {{Filename|/etc/shorewall/shorewall.conf}} otherwise the rule added to ban an IP address will affect only new connections.}}
+
{{Note|You can set {{Codeline|BLACKLISTNEWONLY}} to {{Codeline|No}} in {{Filename|/etc/shorewall/shorewall.conf}} otherwise the rule added to ban an IP address will affect only new connections.}}

Revision as of 17:12, 9 January 2010

Fail2ban scans log files like Template:Filename or Template:Filename and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Installation

First, install Gamin so that Fail2ban can detect modification to the log files:

# pacman -Sy gamin

Then, install Template:Package Official:

# pacman -S fail2ban

If you want Fail2ban to send an email when someone has been banned, you have to configure SSMTP (for example). You will also have to install whois to get some information about the attacker.

# pacman -S whois

Now you can start the Template:Codeline daemon:

# /etc/rc.d/fail2ban start

You can add it into DAEMONS array in Template:Filename:

DAEMONS=(... fail2ban ...)

SSH jail

Edit Template:Filename and modify the ssh-iptables section to enable it and configure the action.

If your firewall is iptables:

[ssh-iptables]
enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]                                         
           sendmail-whois[name=SSH, dest=your@mail.org, sender=fail2ban@mail.com]
logpath  = /var/log/auth.log                                                                    
maxretry = 5

If your firewall is shorewall:

[ssh-iptables]
enabled  = true
filter   = sshd
action   = shorewall
           sendmail-whois[name=SSH, dest=your@mail.org, sender=fail2ban@mail.com]
logpath  = /var/log/auth.log                                                                    
maxretry = 5
Note: You can set Template:Codeline to Template:Codeline in Template:Filename otherwise the rule added to ban an IP address will affect only new connections.