What is fail2ban ?
fail2ban is a popular security framework to block malicious IPs addresses by scanning log files. It is written in Python.
Installation
To install Fail2ban on Ubuntu 18.04, follow below steps.
sudo apt update
sudo apt install -y fail2banConfiguration
In /etc/fail2ban , you can find number of config files. As per standard practice, we should not edit them directly. Instead local files should be created, which override original files. Lets create local files first.
touch /etc/fail2ban/fail2ban.local
touch /etc/fail2ban/jail.localA local file doesn’t have to include everything from the corresponding config file, only those settings that you wish to override.
Open /etc/fail2ban/fail2ban.conf in your favourite editor like VIM or nano. Here you can see common options like loglevels, log locations, pid file location etc. You can define them again in /etc/fail2ban/fail2ban.local to change values. Most of time, you don’t need to change them.
[Defination]
# change loglevel - CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG
loglevel = INFO
# change log file location if required
logtarget = /var/log/fail2ban.log
# change pidfile location if required
pidfile = /var/run/fail2ban/fail2ban.pidNow open /etc/fail2ban/jail.conf file. Configurations of jails are stored here. First comes DEFAULT section. After DEFAULT section, jails for individual applications are added. Default values for jails are added in DEFAULT section. So we only need to override required options in individual jails. All jails are disabled by default. We will enable them in jail.local file. Lets open /etc/fail2ban/jail.local and add below content.
[DEFAULT]
# "bantime" is the number of seconds that a host is banned.
bantime = 15m
# A host is banned if it has generated "maxretry" during the last "findtime" seconds.
findtime = 15m
# "maxretry" is the number of failures before a host get banned.
maxretry = 6How to enable common Jails
After overriding DEFAULT section, lets enable jails for common applications. Add below content in /etc/fail2ban/jail.local to enable them.
SSH Jail
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 4Apache Jail
# jail for apache auth
[apache]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache*/*error.log
maxretry = 6
[apache-overflows]
enabled = true
logpath = /var/log/apache*/*error.log
[apache-badbots]
enabled = true
logpath = /var/log/apache*/*access.log
Nginx Jail
[nginx-http-auth]
enabled = true
[nginx-botsearch]
enabled = trueNow save file and start fail2ban using below commands.
Management
Once configuration is done. You can start fail2ban service using below commands.
# start service
systemctl start fail2ban.service
# see current status of service - is it running or not
systemctl status fail2ban.service
# stop fail2ban service
systemctl stop fail2ban.service
# restart fail2ban
systemctl restart fail2ban.service
# enable service to start on reboot
systemctl enable fail2ban.service
How to see which jails are enabled
To see which jails are enabled use below command
fail2ban-client statusHow to ignore own IPs
To stop blocking our own IPs, we can added them in DEFAULT section as below
ignoreip = 127.0.0.1/8 ::1 192.168.0.1/32How to unblock IP
Many times we can end blocking our own IPs by mistakes. e.g. suppose your colleague forgot SSH password and tried SSH login many times with wrong password triggering blocking his own IP. You can check if IP is really blocking by viewing IP table rules using below command.
iptables -LAnother way to see such IPs is using fail2ban-client. Run below command to see IPs blocked by specific jail.
fail2ban-client status <jailname>
e.g.
fail2ban-client status sshdIn such cases, you can easily unblock ip using below command.
fail2ban-client set <jailname> unbanip <ip-address>
e.g.
fail2ban-client set ssh unbanip 192.168.0.1How to block IP manually
To block IP manually, use below command
fail2ban-client set <jailname> banip <ip-address>
e.g.
fail2ban-client set ssh banip 192.168.0.1