From ArchWiki
Revision as of 10:38, 11 October 2012 by Cmrx64 (talk | contribs) (Path to service file has since changed)
Jump to: navigation, search
Warning: Using an IP blacklist will stop trivial attacks but it relies on an additional daemon and successful logging (the partition containing /var can become full, especially if an attacker is pounding on the server). Additionally, if the attacker knows your IP address, they can send packets with a spoofed source header and get you locked out of the server. SSH keys provide an elegant solution to the problem of brute forcing without these problems.

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.


First, install Gamin so that Fail2ban can detect modification to the log files:

# pacman -S gamin

Then, install fail2ban:

# pacman -S fail2ban

If you want Fail2ban to send an email when someone has been banned, you have to configure SSMTP (for example). You will also have to install whois to get some information about the attacker.

# pacman -S whois

Now you can start the fail2ban daemon:

# /etc/rc.d/fail2ban start

You can add it into DAEMONS array in /etc/rc.conf:

DAEMONS=(... fail2ban ...)

If using systemd, the service file that ships with fail2ban does not create the working directly and will fail. In stead, override with your own service file:

Description=Ban IPs that make too many password failures

ExecStartPre=/bin/mkdir -p /var/run/fail2ban
ExecStart=/usr/bin/fail2ban-client start
ExecReload=/usr/bin/fail2ban-client reload
ExecStop=/usr/bin/fail2ban-client stop


Then use:

# systemctl start fail2ban.service

And enable it at boot if you like:

# systemctl enable fail2ban.service

SSH jail

Edit /etc/fail2ban/jail.conf and modify the ssh-iptables section to enable it and configure the action.

If your firewall is iptables:

enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]                                         
logpath  = /var/log/auth.log                                                                    
maxretry = 5

If your firewall is shorewall:

enabled  = true
filter   = sshd
action   = shorewall
logpath  = /var/log/auth.log                                                                    
maxretry = 5
Note: You can set BLACKLISTNEWONLY to No in /etc/shorewall/shorewall.conf otherwise the rule added to ban an IP address will affect only new connections.

Also do not forget to add/change:


in your /etc/ssh/sshd_config. Else, password failures are not logged correctly.

See also