Fail2ban: Difference between revisions
From Leo's Notes
This page was last edited on 14 June 2020, at 22:01.
Created page with "Fail2Ban is a program that monitors failed login attempts and automatically blocks access. == Installation == On Fedora, install the fail2ban package. == Configuration == Ma..." |
mNo edit summary |
||
| (3 intermediate revisions by the same user not shown) | |||
| Line 2: | Line 2: | ||
== Installation == | == Installation == | ||
On Fedora, install the fail2ban package. | On Fedora, install the {{code|fail2ban}} package. | ||
On CentOS or RedHat Enterprise Linux, install the package from EPEL. | |||
== Configuration == | == Configuration == | ||
| Line 28: | Line 30: | ||
enabled = true | enabled = true | ||
}} | }} | ||
== Usage == | |||
Start Fail2Ban: | |||
{{highlight|lang=terminal|code= | |||
systemctl start fail2ban | |||
systemctl enable fail2ban | |||
}} | |||
You can check the status by reading the fail2ban log. | |||
{{highlight|lang=terminal|code= | |||
tail -f /var/log/fail2ban.log | |||
}} | |||
IPTables should also be automatically updated when bans happen. You should see a {{code|f2b-sshd}} chain in IPTables for SSH bans. | |||
== See Also == | == See Also == | ||
* https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-centos-7 | * https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-centos-7 | ||
[[Category:Linux]] | {{Navbox Linux}}[[Category:Linux]] | ||
[[Category:LinuxUtilities]] | |||
Latest revision as of 22:01, 14 June 2020
Fail2Ban is a program that monitors failed login attempts and automatically blocks access.
Installation
On Fedora, install the fail2ban package.
On CentOS or RedHat Enterprise Linux, install the package from EPEL.
Configuration
Make any changes to /etc/fail2ban/jail.local. The default settings and the configuration documentation can be viewed at /etc/fail2ban/jail.conf.
I am currently using the following configuration:
[DEFAULT]
#
# Ban hosts in seconds
#
# One month
bantime = 2592000
# Override /etc/fail2ban/jail.d/00-firewalld.conf:
banaction = iptables-multiport
ignoreip = 127.0.0.1/8 172.20.1.0/24 96.30.20.0/24 67.227.194.37/23
# 12 hours, 3 fail
findtime = 43200
maxretry = 3
[sshd]
enabled = true
Usage
Start Fail2Ban:
systemctl start fail2ban
systemctl enable fail2ban
You can check the status by reading the fail2ban log.
tail -f /var/log/fail2ban.log
IPTables should also be automatically updated when bans happen. You should see a f2b-sshd chain in IPTables for SSH bans.