Fail2Ban is an intrusion prevention framework written in the Python programming language. It works by reading SSH, ProFTP, Apache etc. logs and uses iptables profiles to block brute-force attempts.
The reason I prefer fail2ban over other tools is because it is one of the simplest solutions, it is surprisingly effective and there is an active community behind it.
How it works
Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Afterwards it is updating firewall rules to reject malicious IP addresses for a specified amount of time, although any other arbitrary action (e.g. sending an email) could also be configured. Out of the box Fail2Ban comes with filters for various services (apache, courier, ssh, etc). Fail2Ban is able to reduce the rate of incorrect authentications attempts however it cannot eliminate the risk that weak authentication presents. Configure services to use only two factor or public/private authentication mechanisms if you really want to protect services.
Installation & Configuration
To install fail2ban, type I followed the procedure below:
sudo apt-get update sudo apt-get install fail2ban
Configuration: To configure fail2ban, make a 'local' copy the jail.conf file in /etc/fail2ban
cd /etc/fail2ban sudo cp jail.conf jail.local
Now edit the file:
sudo nano jail.local
Set the IPs you want fail2ban to ignore, the ban time (in seconds) and maximum number of user attempts to match your needs:
[DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or a DNS host ignoreip = 127.0.0.1 bantime = 3600 maxretry = 3
Setting up an MTA
For an administrator email notifications are essential. For that, you will need sendmail or any other working MTA to forward emails to your address. If you have a working MTA already, you can skip this step. To install an All send-only MTA - replace sendmail with ssmtp:
sudo apt-get install sendmail sudo apt-get install mailutils ssmtp sudo nano /etc/ssmtp/ssmtp.conf ssmtp firstname.lastname@example.org hello world! sudo service sendmail stop sudo killall sendmail which ssmtp sudo rm -rf /usr/sbin/sendmail sudo ln -s /usr/sbin/ssmtp /usr/sbin/sendmail sudo service fail2ban restart
If you wish to get bans notifications by email, modify this line with your email address:
destemail = email@example.com
Then find the line:
action = %(action_)s
and change it to:
action = %(action_mw)s
Jails are the rules which fail2ban is going to apply to a given application/log:
[ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 3
To enable the other profiles, such as [ssh-ddos], make sure the first line beneath the specific profile is:
enabled = true
After that, restart fail2ban to put those settings into effect:
sudo /etc/init.d/fail2ban restart
If you wish to tweak or add log filters, you can find them under /etc/fail2ban/filter.d
To test fail2ban, look at iptable rules:
sudo iptables -L
Attempt to login to a service that fail2ban is monitoring (preferably from another machine) and look at the iptable rules again to see if that IP source gets added.
Fail2ban is really handy for blocking brute force attacks against your servers but when you have a cluster of servers, it would be quite useful to include the hostname in the subject line of the email you receive when an IP address is blocked. Since fail2ban is not doing that out of the box I followed the simple procedure below to extend the functionality to my needs.
Extending Fail2ban to include the hostname in the mail subject.
There are three steps:
Step 1: Define a variable "host" in you jail.conf, assign the hostname to it and pass it to your action.
Open up /etc/fail2ban/jail.conf and edit the action. In my case the action for dovecot-pop3imap is:
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]
Now add the variable "host", so the action looks like:
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s", host=db01.example.com]
Step 2: Use the value in your action.d script.
You can see in my example that the action being called is sendmail-whois. So next open /etc/fail2ban/action.d/sendmail-whois.conf. There are various sections here that send emails. They are "actionstart", "actionstop" and "actionban".
My actionstart for example looks like this:
actionstart = printf %%b "Subject: [Fail2Ban] <name>: started on <host> From: Fail2Ban <<sender>> To: <dest>\n Hi,\n The jail <name> has been started successfully.\n Regards,\n Fail2Ban" | /usr/sbin/sendmail -f <sender> <dest>
Make similar amendments to the Subject of each section and save the file.
Step 3: Restart fail2ban
For the changes to take effect, you need to restart fail2ban:
service fail2ban restart
Unban an IP
If you are trying to figure out what happens if an IP gets banned by mistake, here is the solution:
$ sudo iptables -L -n > bans.log $ sudo fail2ban-client status # to reveal your JAIL name (mine is ssh) $ sudo fail2ban-client set ssh delignoreip your_ip_address $ sudo nano /etc/hosts.deny # delete your ip address $ sudo fail2ban-client reload