Fail2ban

Installation

apt-get install fail2ban

Fail2ban Configuration

vim /etc/fail2ban/fail2ban.conf

You can:

• Adjust the log file - default is: /var/log/fail2ban.log
• Adjust the log level

Restart | check fail2ban

Fail2ban is registered as a service by default.

service fail2ban restart

You can check the log in the dedicated log file:

cat /var/log/fail2ban.conf

Ban rules

Edit the ban configuration rule:

vim /etc/fail2ban/jail.conf

Default (generic) properties

 
[DEFAULT]
ignoreip = 127.0.0.1/8 172.16.50.0/24
...
# "bantime" is the number of seconds that a host is banned.
# default 600s ; 86400 = 24h
bantime  = 86400

# Increase max attempt time 'cause lots of scanner are using the default time + 1s.
# default 600
findtime=3600

• In "ignoreip" add your LAN + VPN networks

• Adjust "bantime" and "findtime"

SSH configuration

Enable and adjust:

• SSH
• SSH-DDOS
• SSH-iptables-*

 
[ssh]
enabled  = true
port     = ssh,2200
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 4

...

[ssh-ddos]

enabled  = true
port     = ssh,2200
filter   = sshd-ddos
logpath  = /var/log/auth.log
maxretry = 4


# Here we use blackhole routes for not requiring any additional kernel support
# to store large volumes of banned IPs

[ssh-route]

enabled = true
filter = sshd
action = route
#logpath = /var/log/sshd.log
logpath  = /var/log/auth.log
maxretry = 4


# Here we use a combination of Netfilter/Iptables and IPsets
# for storing large volumes of banned IPs
#
# IPset comes in two versions. See ipset -V for which one to use 
# requires the ipset package and kernel support.

[ssh-iptables-ipset4]

enabled  = true
port     = ssh,2200
filter   = sshd
banaction = iptables-ipset-proto4
#logpath  = /var/log/sshd.log
logpath  = /var/log/auth.log
maxretry = 4

[ssh-iptables-ipset6]

enabled  = true
port     = ssh,2200
filter   = sshd
banaction = iptables-ipset-proto6
#logpath  = /var/log/sshd.log
logpath  = /var/log/auth.log
maxretry = 4

- Note -

• You can use multi-port filtering with port=X,Y

• For IpTables rules you have to adjust the logpath