Trace: Fail2Ban

Fail2Ban

Prev  
 Next

Scans log files and check for in appropriate password activities and update and uses firewall (IPTables) to restrict (stop for a period of time) these activities. So fail2ban limits incorrect authorisation attempts, thereby reducing, but not entirely eliminating associated risks and bandwidths. It is primarily used on port and associated services open to the public. DigitalOcean How To Protect an Apache Server with Fail2Ban on Ubuntu 14.04 and How Fail2Ban Works to Protect Services on a Linux Server. Also see the wiki of Fail2Ban on nftables and Fail2ban Add support for nftables #1118 and Add nftables actions #1292.

  • sudo apt install fail2ban to install fail2ban
  • sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local copy the main configuration file to a local file to be modified. It is recommended not to change the main file as it is updated with the package.
  • sudo vim /etc/fail2ban/jail.local and adjust the following basic settings:
    • ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24
    • bantime = 60m
    • findtime = 60m
    • maxretry = 4
  • then adjust each jail to be activated:
    • [postfix]
      # To use another modes set filter parameter "mode" in jail.local:
      enable  = true
      mode    = more
      bantime = 12h
      port    = smtp,465,submission
      logpath = %(postfix_log)s
      backend = %(postfix_backend)s 
    • [postfix-sasl]
      enabled  = true
      bantime  = 12h
      filter   = postfix[mode=auth]
      port     = smtp,465,submission,imap,imaps,pop3,pop3s
      # You might consider monitoring /var/log/mail.warn instead if you are
      # running postfix since it would provide the same log lines at the
      # "warn" level but overall at the smaller filesize.
      logpath  = %(postfix_log)s
      backend  = %(postfix_backend)s
  • sudo systemctl restart fail2ban
  • sudo systemctl restart fail2ban or journalctl -u fail2ban -xe to check fail2ban start correctly
  • sudo iptables -S to check iptable

/app/www/public/data/pages/home_server/home_server_setup/other_services/fail2ban.txt · Last modified: 2023-04-30 Sun wk17 17:43
CC Attribution-Share Alike 4.0 International Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International