Fail2ban scans log files like
/var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.
First, install Gamin so that Fail2ban can detect modification to the log files:
# pacman -S gamin
# pacman -S fail2ban
If you want Fail2ban to send an email when someone has been banned, you have to configure SSMTP (for example). You will also have to install to get some information about the attacker.
# pacman -S whois
Now you can start the
# /etc/rc.d/fail2ban start
You can add it into DAEMONS array in
DAEMONS=(... fail2ban ...)
If using systemd, the service file that ships with fail2ban does not create the working directly and will fail. In stead, override with your own service file:
[Unit] Description=Ban IPs that make too many password failures After=syslog.target network.target [Service] Type=forking PIDFile=/run/fail2ban/fail2ban.pid ExecStartPre=/bin/mkdir -p /var/run/fail2ban ExecStart=/usr/bin/fail2ban-client start ExecReload=/usr/bin/fail2ban-client reload ExecStop=/usr/bin/fail2ban-client stop [Install] WantedBy=multi-user.target
# systemctl start fail2ban.service
And enable it at boot if you like:
# systemctl enable fail2ban.service
Currently, fail2ban requires to run as root, therefore you may wish to consider some additional hardening on the process with systemd. Ref:systemd for Administrators, Part XII
For added security consider limiting fail2ban capabilities by adding CapabilityBoundingSet under
[Service] section of the systemd service file, e.g.:
CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW
In the example above, CAP_DAC_READ_SEARCH will allow fail2ban full read access, and CAP_NET_ADMIN and CAP_NET_RAW allow setting of firewall rules with iptables. Additional capabilities may be required, depending on your fail2ban configuration. See
man capabilities for more info.
Also considering limiting file system read and write access, by using ReadOnlyDirectories and ReadWriteDirectories, again under the under
[Service] section. For example:
ReadOnlyDirectories=/ ReadWriteDirectories=/var/run/fail2ban /var/spool/postfix/maildrop
In the example above, this limits the file system to read-only, except for
/var/run/fail2ban for pid and socket files, and
/var/spool/postfix/maildrop for postfix sendmail. Again, this will be dependent on you system configuration and fail2ban configuration.
/etc/fail2ban/jail.conf and modify the ssh-iptables section to enable it and configure the action.
If your firewall is iptables:
[ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois[name=SSH, email@example.com, firstname.lastname@example.org] logpath = /var/log/auth.log maxretry = 5
If your firewall is shorewall:
[ssh-shorewall] enabled = true filter = sshd action = shorewall sendmail-whois[name=SSH, email@example.com, firstname.lastname@example.org] logpath = /var/log/auth.log maxretry = 5
Also do not forget to add/change:
/etc/ssh/sshd_config. Else, password failures are not logged correctly.