DokuWiki » Infrastructure » Operating System » CentOS 9

h1. Setup fail2ban

h2. Requirements

To install fail2ban you will need the following:

* a installed and supported operating system (e.g. CentOS 9.x)

* root-access

* a fast internet connection

* [[repo_epel|EPEL]]

h2. Preliminary Note

This procedure is based on a documentation taken from:

* https://www.howtoforge.com/how-to-install-and-configure-fail2ban-on-fedora-33-centos-8/

* https://www.cyberciti.biz/faq/how-to-protect-ssh-with-fail2ban-on-centos-8/

Most Linux servers offer an SSH login via Port 22 for remote administration purposes. This port is a well-known port, therefore, it is often attacked by brute force attacks. Fail2ban is a software that scans log files for brute force login attempts in real-time and bans the attackers with firewalld or iptables. Fail2ban recognizes unwanted access or security breach efforts to the server within the administrator set time frame and blocks the IP addresses which show signs of brute force attacks or dictionary attacks. This program works in the background and continuously scans the log files for unusual login patterns and security breach attempts.

h2. Install 

<pre><code class="bash">

dnf install fail2ban

</code></pre>

if you are into noise ...

<pre><code class="bash">

dnf install whois

</code></pre>

h2. Start/Enable Service

<pre><code class="bash">

systemctl enable fail2ban

systemctl start fail2ban

</code></pre>

When you are not running the CentOS Firewall yet, then start it:

<pre><code class="shell">

systemctl enable firewalld

systemctl start firewalld

</code></pre>

h2. config

The @/etc/fail2ban/jail.local@ file overrides defaults set in @/etc/fail2ban/jail.conf@ file. Therefore, create or edit the jail.local

<pre>

[DEFAULT]

# Ban IP/hosts for 24 hour ( 24h*3600s = 86400s):

bantime = 86400

# An ip address/host is banned if it has generated "maxretry" during the last "findtime" seconds.

findtime = 600

maxretry = 3

# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban

# will not ban a host which matches an address in this list. Several addresses

# can be defined using space (and/or comma) separator. For example, add your 

# static IP address that you always use for login such as 103.1.2.3

#ignoreip = 127.0.0.1/8 ::1 103.1.2.3

# Call iptables to ban IP address

banaction = firewallcmd-rich-rules[actiontype=<multiport>]

# Enable sshd protection

[sshd]

enabled = true

</pre>

For each jail there may be a local configuration in @/etc/fail2ban/jail.d/@

h3.  Add a jail file to protect SSH.

Create a new file with the editor

<pre><code class="shell">

vim /etc/fail2ban/jail.d/sshd.local

</code></pre>

To the above file, add the following lines of code.

<pre>

[sshd]

enabled = true

findtime = 3600

maxretry = 3

bantime = -1

</pre>

Parameter enabled is set to true, in order to provide protection, to deactivate protection, it is set to false. 

The parameter action is used to derive the IP address which needs to be banned using the filter available from /etc/fail2ban/action.d/firewallcmd-rich-rules.conf.

Port parameter may be changed to a new value such as port=1212, as is the case. When using port 22, there is no need to change this parameter.

Maxretry is used to set the maximum limit for failed login entries.

Bantime parameter is used to set the duration of seconds for which a host needs to be banned.

h3. sendmail-action override to work with postfix-smarthost

<pre><code class="shell">

cp /etc/fail2ban/action.d/sendmail-common.conf /etc/fail2ban/action.d/sendmail-common.local

</code></pre>

change in section init sender from "fail2ban" to "root"

<pre><code class="ini">

[Init]

sender = root

</code></pre>

h3. error in log like 'exec: ports="1:65535"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule'

change port-definition from <pre>1:65535</pre> to <pre>1-65535</pre> 

<pre><code class="shell">

cp /etc/fail2ban/action.d/firewallcmd-common.conf /etc/fail2ban/action.d/firewallcmd-common.local

vim /etc/fail2ban/action.d/firewallcmd-common.local

</code></pre>

<pre><code class="ini">

[Init]

port = 1-65535

</code></pre>

h2. Status

<pre><code class="shell">

fail2ban-client status

fail2ban-client status <jail>

fail2ban-client status sshd

</code></pre>

h2. Checking the banned IPs by Fail2Ban

<pre><code class="shell">

firewall-cmd --list-all

</code></pre>

h3. Unbanning an IP address

In order to remove an IP address from the banned list, parameter IPADDRESS is set to appropriate IP which needs unbanning. The name "sshd" is the name of the jail, in this case the "sshd" jail that we configured above. The following command does the job.

<pre><code class="shell">

fail2ban-client set <jail> unbanip <ip>

fail2ban-client set sshd unbanip 123.123.123.123

</code></pre>