Projekt

Allgemein

Profil

Setup fail2ban » Historie » Version 2

Jeremias Keihsler, 21.07.2025 07:49

1 1 Jeremias Keihsler
h1. Setup fail2ban
2
3
h2. Requirements
4
5
To install fail2ban you will need the following:
6
* a installed and supported operating system (e.g. CentOS 9.x)
7
* root-access
8
* a fast internet connection
9
* [[repo_epel|EPEL]]
10
11
h2. Preliminary Note
12
13
This procedure is based on a documentation taken from:
14
* https://www.howtoforge.com/how-to-install-and-configure-fail2ban-on-fedora-33-centos-8/
15
* https://www.cyberciti.biz/faq/how-to-protect-ssh-with-fail2ban-on-centos-8/
16
17
Most Linux servers offer an SSH login via Port 22 for remote administration purposes. This port is a well-known port, therefore, it is often attacked by brute force attacks. Fail2ban is a software that scans log files for brute force login attempts in real-time and bans the attackers with firewalld or iptables. Fail2ban recognizes unwanted access or security breach efforts to the server within the administrator set time frame and blocks the IP addresses which show signs of brute force attacks or dictionary attacks. This program works in the background and continuously scans the log files for unusual login patterns and security breach attempts.
18
19
h2. Install 
20
21
<pre><code class="bash">
22
dnf install fail2ban
23
</code></pre>
24
25
if you are into noise ...
26
<pre><code class="bash">
27
dnf install whois
28
</code></pre>
29
30
31
h2. Start/Enable Service
32
33
<pre><code class="bash">
34
systemctl enable fail2ban
35
systemctl start fail2ban
36
</code></pre>
37
38
When you are not running the CentOS Firewall yet, then start it:
39
40
<pre><code class="shell">
41
systemctl enable firewalld
42
systemctl start firewalld
43
</code></pre>
44
45
h2. config
46
47 2 Jeremias Keihsler
The @/etc/fail2ban/jail.local@ file overrides defaults set in @/etc/fail2ban/jail.conf@ file. Therefore, create or edit the jail.local if needed.
48 1 Jeremias Keihsler
49
For each jail there may be a local configuration in @/etc/fail2ban/jail.d/@
50
51
h3.  Add a jail file to protect SSH.
52
53
Create a new file with the editor
54
55
<pre><code class="shell">
56
vim /etc/fail2ban/jail.d/sshd.local
57
</code></pre>
58
59
To the above file, add the following lines of code.
60
61
<pre>
62
[sshd]
63 2 Jeremias Keihsler
[sshd]
64 1 Jeremias Keihsler
enabled = true
65 2 Jeremias Keihsler
findtime = 7200
66
maxretry = 2
67
bantime = 7d
68
action = firewallcmd-rich-rules
69
         sendmail-whois[name=sshd, dest=me@example.com]
70 1 Jeremias Keihsler
</pre>
71
72
Parameter enabled is set to true, in order to provide protection, to deactivate protection, it is set to false. 
73
74
The parameter action is used to derive the IP address which needs to be banned using the filter available from /etc/fail2ban/action.d/firewallcmd-rich-rules.conf.
75
76
Port parameter may be changed to a new value such as port=1212, as is the case. When using port 22, there is no need to change this parameter.
77
78
Maxretry is used to set the maximum limit for failed login entries.
79
80
Bantime parameter is used to set the duration of seconds for which a host needs to be banned.
81
82
h3. sendmail-action override to work with postfix-smarthost
83
84
<pre><code class="shell">
85
cp /etc/fail2ban/action.d/sendmail-common.conf /etc/fail2ban/action.d/sendmail-common.local
86
</code></pre>
87
88
change in section init sender from "fail2ban" to "root"
89
90
<pre><code class="ini">
91
[Init]
92
sender = root
93
</code></pre>
94
95
h3. error in log like 'exec: ports="1:65535"; for p in $(echo $ports | tr ", " " "); do firewall-cmd --add-rich-rule'
96
97
change port-definition from <pre>1:65535</pre> to <pre>1-65535</pre> 
98
99
<pre><code class="shell">
100
cp /etc/fail2ban/action.d/firewallcmd-common.conf /etc/fail2ban/action.d/firewallcmd-common.local
101
vim /etc/fail2ban/action.d/firewallcmd-common.local
102
</code></pre>
103
104
<pre><code class="ini">
105
[Init]
106
port = 1-65535
107
</code></pre>
108
109
h2. Status
110
111
<pre><code class="shell">
112
fail2ban-client status
113
fail2ban-client status <jail>
114
fail2ban-client status sshd
115
</code></pre>
116
117
h2. Checking the banned IPs by Fail2Ban
118
119
<pre><code class="shell">
120
firewall-cmd --list-all
121
</code></pre>
122
123
h3. Unbanning an IP address
124
125
In order to remove an IP address from the banned list, parameter IPADDRESS is set to appropriate IP which needs unbanning. The name "sshd" is the name of the jail, in this case the "sshd" jail that we configured above. The following command does the job.
126
127
<pre><code class="shell">
128
fail2ban-client set <jail> unbanip <ip>
129
fail2ban-client set sshd unbanip 123.123.123.123
130
</code></pre>