Fail2ban


Installation

apt-get install fail2ban


Fail2ban Configuration

vim /etc/fail2ban/fail2ban.conf


You can:

  • Adjust the log file - default is: /var/log/fail2ban.log
  • Adjust the log level


Restart | check fail2ban

Fail2ban is registered as a service by default.

service fail2ban restart


You can check the log in the dedicated log file:

cat /var/log/fail2ban.log

Ban rules

Edit the ban configuration rule:

vim /etc/fail2ban/jail.conf

Default (generic) properties

 
[DEFAULT]
ignoreip = 127.0.0.1/8 172.16.50.0/24
...
# "bantime" is the number of seconds that a host is banned.
# default 600s ; 86400 = 24h
bantime  = 86400

# Increase max attempt time 'cause lots of scanner are using the default time + 1s.
# default 600
findtime=3600


  • In "ignoreip" add your LAN + VPN networks
  • Adjust "bantime" and "findtime"


SSH configuration

Enable and adjust:

  • SSH
  • SSH-DDOS
  • SSh-Route
  • SSH-iptables-*
 
[ssh]
enabled  = true
port     = ssh,2200
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 4

...

[ssh-ddos]

enabled  = true
port     = ssh,2200
filter   = sshd-ddos
logpath  = /var/log/auth.log
maxretry = 4


# Here we use blackhole routes for not requiring any additional kernel support
# to store large volumes of banned IPs

[ssh-route]

enabled = true
filter = sshd
action = route
#logpath = /var/log/sshd.log
logpath  = /var/log/auth.log
maxretry = 4


# Here we use a combination of Netfilter/Iptables and IPsets
# for storing large volumes of banned IPs
#
# IPset comes in two versions. See ipset -V for which one to use 
# requires the ipset package and kernel support.

[ssh-iptables-ipset4]

enabled  = true
port     = ssh,2200
filter   = sshd
banaction = iptables-ipset-proto4
#logpath  = /var/log/sshd.log
logpath  = /var/log/auth.log
maxretry = 4

[ssh-iptables-ipset6]

enabled  = true
port     = ssh,2200
filter   = sshd
banaction = iptables-ipset-proto6
#logpath  = /var/log/sshd.log
logpath  = /var/log/auth.log
maxretry = 4


- Note -

  • You can use multi-port filtering with port=X,Y
  • For IpTables rules you have to adjust the logpath


Apache2 Virtual Host

To secure your virtual hosts, you can duplicate some rules using the same filter:

  • New rule name in "[" myRuleName "]"
  • You just need to adjust the logpath


 

[apache-default]
enabled  = true
port     = http,https
filter   = apache-auth
logpath  = /var/log/apache*/*error.log
maxretry = 6

[apache-daxiongmao]
enabled  = true
port     = http,https
filter   = apache-auth
logpath  = /var/log/apache/daxiongmao*/*error.log
maxretry = 6




VPN rule

It's a good idea to protect your server against brute force attacks and intruders.


Create new VPN rule

Create a new rule in Fail2Ban:

vim /etc/fail2ban/filter.d/openvpn.conf


Add:

[Definition]
failregex = [a-b]*ovpn-server.*:.<HOST>:[0-9]{4,5} TLS Auth Error:.*
     [a-b]*ovpn-server.*:.<HOST>:[0-9]{4,5} VERIFY ERROR:.*
     [a-b]*ovpn-server.*:.<HOST>:[0-9]{4,5} TLS Error: TLS handshake failed.*


Apply VPN rule

Edit Fail2Ban main configuration:

vim /etc/fail2ban/jail.conf


At the end of the file, add:

[openvpn]
enabled = true
port = 8080
protocol = udp
filter = openvpn
logpath = /etc/openvpn/openvpn.log
maxretry = 3



Custom filters and rules

You can create your own custom filters and rules that use them.


Create filter

Create new .conf file like that

 
vim /etc/fail2ban/filter.d/myFilter.conf


 
# My filter
# Blocks IPs that …
[Definition]
 
failregex = regex expression
ignoreregex =


The key point is the filter regex.


Test your filter

You have to test your new filter against a log file with "fail2ban-regex":

 
# fail2ban-regex <log file> <filter configuration>
fail2ban-regex /var/log/apache2/access.log /etc/fail2ban/filter.d/auth-login.conf


Create rule(s) for the new filter

Now you have to update your rules to use that new filter:

 
vim /etc/fail2ban/jail.conf


 
[myFilter-apache]
enabled  = true
port     = http,https
filter   = myFilter
logpath  = /var/log/apache*/*access*.log
maxretry = 6


The filter attribute matches the file name without '.conf'.