Setup fail2ban » Historie » Revision 4
Revision 3 (Jeremias Keihsler, 22.10.2021 13:32) → Revision 4/9 (Jeremias Keihsler, 22.10.2021 13:32)
h1. Setup fail2ban
h2. Requirements
To install fail2ban you will need the following:
* a installed and supported operating system (e.g. CentOS 8.x)
* root-access
* a fast internet connection
* [[repo_epel|EPEL]]
h2. Preliminary Note
This procedure is based on a documentation taken from:
* https://www.howtoforge.com/how-to-install-and-configure-fail2ban-on-fedora-33-centos-8/
* https://www.cyberciti.biz/faq/how-to-protect-ssh-with-fail2ban-on-centos-8/
Most Linux servers offer an SSH login via Port 22 for remote administration purposes. This port is a well-known port, therefore, it is often attacked by brute force attacks. Fail2ban is a software that scans log files for brute force login attempts in real-time and bans the attackers with firewalld or iptables. Fail2ban recognizes unwanted access or security breach efforts to the server within the administrator set time frame and blocks the IP addresses which show signs of brute force attacks or dictionary attacks. This program works in the background and continuously scans the log files for unusual login patterns and security breach attempts.
h2. Install
<pre><code class="bash">
yum install fail2ban
</code></pre>
if you are into noise ...
<pre><code class="bash">
yum install whois
</code></pre>
h2. Start/Enable Service
<pre><code class="bash">
systemctl enable fail2ban
systemctl start fail2ban
</code></pre>
h2. config
The @/etc/fail2ban/jail.local@ file overrides defaults set in @/etc/fail2ban/jail.conf@ file. Therefore, create or edit the jail.local
<pre>
[DEFAULT]
# Ban IP/hosts for 24 hour ( 24h*3600s = 86400s):
bantime = 86400
# An ip address/host is banned if it has generated "maxretry" during the last "findtime" seconds.
findtime = 600
maxretry = 3
# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
# will not ban a host which matches an address in this list. Several addresses
# can be defined using space (and/or comma) separator. For example, add your
# static IP address that you always use for login such as 103.1.2.3
#ignoreip = 127.0.0.1/8 ::1 103.1.2.3
# Call iptables to ban IP address
banaction = iptables-multiport
# Enable sshd protection
[sshd]
enabled = true
</pre>
For each jail there may be a local configuration in @/etc/fail2ban/jail.d/@
<pre>
banaction = iptables-multiport
# Enable sshd protection
[sshd]
enabled = true
findtime = 3600
maxretry = 3
bantime = -1
action = iptables-multiport
sendmail-whois[name=sshd, dest=mailuser@example.com]
</pre>
h2. Status
<pre><code class="shell">
fail2ban-client status
fail2ban-client status <jail>
fail2ban-client status sshd
</code></pre>
h3. unban IP
<pre><code class="shell">
fail2ban-client set <jail> unbanip <ip>
fail2ban-client set sshd unbanip 123.123.123.123
</code></pre>