fail2ban

This article is a Draft. Help us to complete it.

wikipedia:fail2ban (2004, Python) is an intrusion prevention software framework that protects computer servers from brute-force attacks

The standard configuration ships with filters for Apache, Lighttpd, sshd, vsftpd, qmail, Postfix and Courier Mail Server.

• fail2ban-client status
• fail2ban-client status sshd

fail2ban-client -t
OK: configuration test is successful

fail2ban-client set YOURJAILNAMEHERE unbanip IPADDRESSHERE

fail2ban-client -i 
fail2ban> status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed:	5
|  |- Total failed:	5
|  `- File list:	/var/log/auth.log
`- Actions
   |- Currently banned:	11
   |- Total banned:	11
   `- Banned IP list:	106.13.50.xx 111.229.16.xx 117.57.98.xx 142.44.211.xx 151.177.108.xx 157.230.55.xx 161.35.58.xx 186.206.129.xx 189.209.7.xx 208.68.39.xx 
3.135.129.xx

Binaries

• fail2ban-client
• fail2ban-regex
• fail2ban-server
• fail2ban-testcases
• fail2ban-python

cat /etc/fail2ban/fail2ban.conf | grep -v "#" | grep .
[DEFAULT]
loglevel = INFO
logtarget = /var/log/fail2ban.log
syslogsocket = auto
socket = /var/run/fail2ban/fail2ban.sock
pidfile = /var/run/fail2ban/fail2ban.pid
dbfile = /var/lib/fail2ban/fail2ban.sqlite3
dbpurgeage = 1d
dbmaxmatches = 10
[Definition]
[Thread]

Related terms

• /var/log/auth.log
• iptables
• RdpGuard
• sshd logs: Failed password for
• Dictionary attack
• OSSEC
• shorewall
• fail2ban: sshd

Activities

• Read ArchLinux fail2ban article

See also

• Port knocking, fail2ban fwknop, DenyHosts
• IDS, HIDS: snort, fail2ban, RdpGuard, suricata, OSSEC, Wazuh, Palo Alto WildFire, Malware analysis, SIEM, Samhain
• SIEM: Splunk, Elastic SIEM, graylog, IBM QRadar, SIEM Magic Quadrant, Micro Focus ArcSight, SentinelOne, Datadog Cloud SIEM
• Mail, SMTP, submission, SMTPS, POP, IMAP, StartTLS, Exim, Postfix, IRedMail, Fail2ban, Dovecot, Roundcube, DKIM, SPF, DMARC, MX, ssmtp, mailx, Swaks

https://serverfault.com/a/608976