One of the important task for Linux administrator is to protect server against illegitimate attack or access. By default Linux system comes with well-configured firewall such as Iptables, Uncomplicated Firewall (UFW), ConfigServer Security Firewall (CSF), etc, which will prevent many kinds of attacks.
Any machine which is connected to the internet is a potential target for malicious attacks. There is a tool called fail2ban is available to mitigate illegitimate access on server.
What is Fail2ban?
Fail2ban is an intrusion prevention software, framework which protect server against brute force attacks. It’s Written in Python programming language. Fail2ban work based on auth log files, by default it will scan the auth log files such as /var/log/auth.log, /var/log/apache/access.log, etc.. and bans IPs that show the malicious signs, too many password failures, seeking for exploits, etc.
Generally fail2Ban is used to update firewall rules to reject the IP addresses for a specified amount of time. Also it will send mail notification too. Fail2Ban comes with many filters for various services such as ssh, apache, nginx, squid, named, mysql, nagios, etc,.
Fail2Ban is able to reduce the rate of incorrect authentications attempts however it cannot eliminate the risk that weak authentication presents. this is one of the security for server which will prevent brute force attacks.
How to install Fail2ban in Linux
Fail2ban is already packaged with most of the Linux distribution so, just use you distribution package manager to install it.
For Debian/Ubuntu, use APT-GET Command or APT Command to install tilda.
$ sudo apt install fail2ban
For Fedora, use DNF Command to install tilda.
$ sudo dnf install fail2ban
For CentOS/RHEL systems, enable EPEL Repository or RPMForge Repository and use YUM Command to install Terminator.
$ sudo yum install fail2ban
For Arch Linux, use Pacman Command to install tilda.
$ sudo pacman -S fail2ban
For openSUSE, use Zypper Command to install tilda.
$ sudo zypper in fail2ban
How to configure Fail2ban
By default Fail2ban keeps all the configuration files in /etc/fail2ban/ directory. The main configuration file is jail.conf, it contains a set of pre-defined filters. So, don’t edit the file and it’s not advisable because whenever new update comes the configuration get reset to default.
Just create a new configuration file called jail.local in the same directory and modify as per your wish.
# cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
By default most of the option was configured perfectly and if you want to enable access to any particular IP then you can add the IP address into ignoreip area, for more then one IP give a speace between the IP address.
The DEFAULT section contains the basic set of rules that Fail2Ban follow and you can adjust any parameter as per your wish.
# nano /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1/8 192.168.1.100/24 bantime = 600 findtime = 600 maxretry = 3 destemail = [email protected]
- ignoreip : This section allow us to white list the list of IP address and Fail2ban will not ban a host which matches an address in this list
- bantime : The number of seconds that a host is banned
- findtime : A host is banned if it has generated “maxretry” during the last “findtime” seconds
- maxretry : “maxretry” is the number of failures before a host get banned.
How to configure service
Fail2ban comes with set of pre-defined filters for various servicess such as ssh, apache, nginx, squid, named, mysql, nagios, etc,. We don’t want to make any changes on configuration file and just add following line enabled = true in the service area to enable jail to any services. To disable make the line to false instead of ture.
# SSH servers [sshd] enabled = true port = ssh logpath = %(sshd_log)s backend = %(sshd_backend)s
- enabled : Determines whether the service is turned on or off.
- port : It’s refering to the particular service. If using the default port, then the service name can be placed here. If using a non-traditional port, this should be the port number.
- logpath : Gives the location of the service’s logs./li>
- backend : “backend” specifies the backend used to get files modification.
Restart Fail2Ban
After making changes restart Fail2Ban to take effect.
[For SysVinit Systems] # service fail2ban restart [For systemd Systems] # systemctl restart fail2ban.service
Verify Fail2Ban iptables rules
You can confirm whether Fail2Ban iptables rules are added into firewall using below command.
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
f2b-apache-auth tcp -- anywhere anywhere multiport dports http,https
f2b-sshd tcp -- anywhere anywhere multiport dports 1234
ACCEPT tcp -- anywhere anywhere tcp dpt:1234
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain f2b-apache-auth (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain f2b-sshd (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
How to test Fail2ban
I have made some failed attempts to test this. To confirm this, I’m going to verify the /var/log/fail2ban.log file.
2017-11-05 14:43:22,901 fail2ban.server [7141]: INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.9.6
2017-11-05 14:43:22,987 fail2ban.database [7141]: INFO Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
2017-11-05 14:43:22,996 fail2ban.database [7141]: WARNING New database created. Version '2'
2017-11-05 14:43:22,998 fail2ban.jail [7141]: INFO Creating new jail 'sshd'
2017-11-05 14:43:23,002 fail2ban.jail [7141]: INFO Jail 'sshd' uses poller {}
2017-11-05 14:43:23,019 fail2ban.jail [7141]: INFO Initiated 'polling' backend
2017-11-05 14:43:23,019 fail2ban.filter [7141]: INFO Set maxRetry = 5
2017-11-05 14:43:23,020 fail2ban.filter [7141]: INFO Set jail log file encoding to UTF-8
2017-11-05 14:43:23,020 fail2ban.filter [7141]: INFO Added logfile = /var/log/auth.log
2017-11-05 14:43:23,021 fail2ban.actions [7141]: INFO Set banTime = 600
2017-11-05 14:43:23,021 fail2ban.filter [7141]: INFO Set findtime = 600
2017-11-05 14:43:23,022 fail2ban.filter [7141]: INFO Set maxlines = 10
2017-11-05 14:43:23,070 fail2ban.server [7141]: INFO Jail sshd is not a JournalFilter instance
2017-11-05 14:43:23,081 fail2ban.jail [7141]: INFO Jail 'sshd' started
2017-11-05 14:43:23,763 fail2ban.filter [7141]: INFO [sshd] Found 103.5.134.167
2017-11-05 14:43:23,763 fail2ban.filter [7141]: INFO [sshd] Found 103.5.134.167
2017-11-05 14:43:23,764 fail2ban.filter [7141]: INFO [sshd] Found 181.129.54.170
2017-11-05 14:43:23,764 fail2ban.filter [7141]: INFO [sshd] Found 181.129.54.170
2017-11-05 14:43:23,765 fail2ban.filter [7141]: INFO [sshd] Found 181.129.54.170
2017-11-05 14:43:23,765 fail2ban.filter [7141]: INFO [sshd] Found 181.129.54.170
2017-11-05 15:19:06,192 fail2ban.server [7141]: INFO Stopping all jails
2017-11-05 15:19:06,874 fail2ban.jail [7141]: INFO Jail 'sshd' stopped
2017-11-05 15:19:06,879 fail2ban.server [7141]: INFO Exiting Fail2ban
2017-11-05 15:19:07,123 fail2ban.server [8528]: INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.9.6
2017-11-05 15:19:07,123 fail2ban.database [8528]: INFO Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
2017-11-05 15:19:07,126 fail2ban.jail [8528]: INFO Creating new jail 'sshd'
2017-11-05 15:19:07,129 fail2ban.jail [8528]: INFO Jail 'sshd' uses poller {}
2017-11-05 15:19:07,141 fail2ban.jail [8528]: INFO Initiated 'polling' backend
2017-11-05 15:19:07,142 fail2ban.actions [8528]: INFO Set banTime = 60
2017-11-05 15:19:07,142 fail2ban.filter [8528]: INFO Set findtime = 60
2017-11-05 15:19:07,142 fail2ban.filter [8528]: INFO Set jail log file encoding to UTF-8
2017-11-05 15:19:07,143 fail2ban.filter [8528]: INFO Set maxRetry = 3
2017-11-05 15:19:07,144 fail2ban.filter [8528]: INFO Added logfile = /var/log/auth.log
2017-11-05 15:19:07,144 fail2ban.filter [8528]: INFO Set maxlines = 10
2017-11-05 15:19:07,189 fail2ban.server [8528]: INFO Jail sshd is not a JournalFilter instance
2017-11-05 15:19:07,195 fail2ban.jail [8528]: INFO Jail 'sshd' started
2017-11-05 15:20:03,263 fail2ban.filter [8528]: INFO [sshd] Found 103.5.134.167
2017-11-05 15:20:05,267 fail2ban.filter [8528]: INFO [sshd] Found 103.5.134.167
2017-11-05 15:20:12,276 fail2ban.filter [8528]: INFO [sshd] Found 103.5.134.167
2017-11-05 15:20:12,380 fail2ban.actions [8528]: NOTICE [sshd] Ban 103.5.134.167
2017-11-05 15:21:12,659 fail2ban.actions [8528]: NOTICE [sshd] Unban 103.5.134.167
To Check list of jail enabled, run the following command.
# fail2ban-client status Status |- Number of jail: 2 `- Jail list: apache-auth, sshd
To get the blocked Ip address by running following command.
# fail2ban-client status ssh Status for the jail: ssh |- filter | |- File list: /var/log/auth.log | |- Currently failed: 1 | `- Total failed: 3 `- action |- Currently banned: 1 | `- IP list: 192.168.1.115 `- Total banned: 1
To remove blocked IP address from Fail2Ban, run the following command.
# fail2ban-client set ssh unbanip 192.168.1.115
