Fail2ban scans log files like
/var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.
First, install Gamin so that Fail2ban can detect modification to the log files:
# pacman -S gamin
# pacman -S fail2ban
If you want Fail2ban to send an email when someone has been banned, you have to configure SSMTP (for example). You will also have to install to get some information about the attacker.
# pacman -S whois
Now you can start the
# /etc/rc.d/fail2ban start
You can add it into DAEMONS array in
DAEMONS=(... fail2ban ...)
If using systemd, the service file that ships with fail2ban does not create the working directly and will fail. In stead, override with your own service file:
[Unit] Description=Ban IPs that make too many password failures After=syslog.target network.target [Service] Type=forking PIDFile=/run/fail2ban/fail2ban.pid ExecStartPre=/bin/mkdir -p /var/run/fail2ban ExecStart=/usr/bin/fail2ban-client start ExecReload=/usr/bin/fail2ban-client reload ExecStop=/usr/bin/fail2ban-client stop [Install] WantedBy=multi-user.target
# systemctl start fail2ban.service
And enable it at boot if you like:
# systemctl enable fail2ban.service
/etc/fail2ban/jail.conf and modify the ssh-iptables section to enable it and configure the action.
If your firewall is iptables:
[ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois[name=SSH, email@example.com, firstname.lastname@example.org] logpath = /var/log/auth.log maxretry = 5
If your firewall is shorewall:
[ssh-shorewall] enabled = true filter = sshd action = shorewall sendmail-whois[name=SSH, email@example.com, firstname.lastname@example.org] logpath = /var/log/auth.log maxretry = 5
/etc/shorewall/shorewall.confotherwise the rule added to ban an IP address will affect only new connections.
Also do not forget to add/change:
/etc/ssh/sshd_config. Else, password failures are not logged correctly.