Fail2ban: Difference between revisions

From Leo's Notes
This page was last edited on 11 August 2017, at 21:16.
Newer edit →
VisualWikitext
Created page with "Fail2Ban is a program that monitors failed login attempts and automatically blocks access. == Installation == On Fedora, install the fail2ban package. == Configuration == Ma..."
 
No edit summary
Line 2: Line 2:


== Installation ==
== Installation ==
On Fedora, install the fail2ban package.
On Fedora, install the {{code|fail2ban}} package.
 
On CentOS or RedHat Enterprise Linux, install the package from EPEL.


== Configuration ==
== Configuration ==
Line 28: Line 30:
enabled = true
enabled = true
}}
}}
== Usage ==
Start Fail2Ban:
{{highlight|lang=terminal|code=
systemctl start fail2ban
systemctl enable fail2ban
}}
You can check the status by reading the fail2ban log.
{{highlight|lang=terminal|code=
tail -f /var/log/fail2ban.log
}}
IPTables should also be automatically updated when bans happen. You should see a {{code|f2b-sshd}} chain in IPTables for SSH bans.


== See Also ==
== See Also ==

Revision as of 21:16, 11 August 2017

Fail2Ban is a program that monitors failed login attempts and automatically blocks access.

Installation

On Fedora, install the fail2ban package.

On CentOS or RedHat Enterprise Linux, install the package from EPEL.

Configuration

Make any changes to /etc/fail2ban/jail.local. The default settings and the configuration documentation can be viewed at /etc/fail2ban/jail.conf.

I am currently using the following configuration: 

[DEFAULT]
#
# Ban hosts in seconds
#
# One month
bantime = 2592000

# Override /etc/fail2ban/jail.d/00-firewalld.conf:
banaction = iptables-multiport

ignoreip = 127.0.0.1/8 172.20.1.0/24 96.30.20.0/24 67.227.194.37/23

# 12 hours, 3 fail
findtime = 43200
maxretry = 3

[sshd]
enabled = true

Usage

Start Fail2Ban: 

systemctl start fail2ban
systemctl enable fail2ban

You can check the status by reading the fail2ban log. 

tail -f /var/log/fail2ban.log

IPTables should also be automatically updated when bans happen. You should see a f2b-sshd chain in IPTables for SSH bans.

See Also