DokuWiki » Infrastructure » Operating System » CentOS 7

h1. Setup fail2ban

h2. Requirements

To install fail2ban you will need the following:

* a installed and supported operating system (e.g. CentOS 7.x)

* root-access

* a fast internet connection

* [[repo_epel|EPEL]]

h2. Preliminary Note

This procedure is based on a documentation taken from https://www.howtoforge.com/tutorial/how-to-install-fail2ban-on-centos/

Most Linux servers offer an SSH login via Port 22 for remote administration purposes. This port is a well-known port, therefore, it is often attacked by brute force attacks. Fail2ban is a software that scans log files for brute force login attempts in real-time and bans the attackers with firewalld or iptables. Fail2ban recognizes unwanted access or security breach efforts to the server within the administrator set time frame and blocks the IP addresses which show signs of brute force attacks or dictionary attacks. This program works in the background and continuously scans the log files for unusual login patterns and security breach attempts.

h2. Install 

<pre><code class="bash">

yum install fail2ban fail2ban-systemd

</code></pre>

If you have SELinux installed, then update the SELinux policies:

<pre><code class="bash">

yum update -y selinux-policy*

</code></pre>

h2. Configure settings for Fail2Ban

Once installed, we will have to configure and customize the software with a jail.local configuration file. The jail.local file overrides the jail.conf file and is used to make your custom configuration update safe.

Make a copy of the jail.conf file and save it with the name jail.local:

<pre><code class="bash">

cp -pf /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

</code></pre>

Open the jail.local file for editing in Nano with the following command.

<pre><code class="bash">

vim /etc/fail2ban/jail.local

</code></pre>

The file code may consist of many lines of codes which execute to prevent a ban on one or many IP addresses, set bantime duration, etc. A typical jail configuration file contains the following lines.

<pre><code class="ini">

[DEFAULT]

#

# MISCELLANEOUS OPTIONS

#

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not

# ban a host which matches an address in this list. Several addresses can be

# defined using space separator.

ignoreip = 127.0.0.1/8

# External command that will take an tagged arguments to ignore, e.g. <ip>,

# and return true if the IP is to be ignored. False otherwise.

#

# ignorecommand = /path/to/command <ip>

ignorecommand =

# "bantime" is the number of seconds that a host is banned.

bantime = 600

# A host is banned if it has generated "maxretry" during the last "findtime"

# seconds.

findtime = 600

# "maxretry" is the number of failures before a host get banned.

maxretry = 5

</code></pre>