Fail2ban It is an application written in Python for the prevention of intrusions in a system, which is based on the connection penalty (block connection) to the sources that attempt access by brute force. It is distributed under the license GNU and typically works on all systems POSIXthat interface with a packet control system or a firewall local.
How Fail2ban works
Fail2ban is responsible for searching the logs of the specified programs for the rules that the user decides in order to apply a penalty. The penalty can be blocking the application that has failed on a certain port, blocking it for all ports, etc. The penalties, as well as the rules, are defined by the user.
Usually, if the attacking IPs are banned for a reasonable period of time, the network overhead caused by the attacks is lowered, and the probability that a dictionary-based brute force attack will be successful is also lowered.
Facility
We install fail2ban from your package manager.
apt-get install fail2ban
Configuration.
The configuration file is located in /etc/fail2ban/jail.conf
vi/etc/fail2ban/jail.conf
Within this configuration file there are different sections, let's see a little above...
[DEFAULT]
We can define the IP addresses which we do not want to ban.
ignoreip = 127.0.0.1
The time that the IP addresses will be banned
bantime = 600
and the number of attempts.
maxretry = 3
We define the email which we want to notify us when it detects an attack.
destemail = rokitoh@red-orbita.com
The type of email that we are going to use to send said emails. By default it is sendmail.
mta = sendmail
The action we want to use, I have used a very simple one…
action = %(action_mwl)s
and further down you will find all the services that it monitors.
The SSH service is already enabled by default. Which for now is the one I'm going to leave... since this is a laptop and it has few services.
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 6
We start fail2ban
/etc/init.d/fail2ban start
and we check that it works.
Greetings and I hope it is useful to you. rokitoh!
Comments