computing:fail2ban
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| computing:fail2ban [2019/11/03 01:45] – oemb1905 | computing:fail2ban [2024/12/13 16:22] (current) – oemb1905 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ------------------------------------------- | ------------------------------------------- | ||
| - | * **apachesurvival** | + | * **fail2ban** |
| * **Jonathan Haack** | * **Jonathan Haack** | ||
| * **Haack' | * **Haack' | ||
| - | * **netcmnd@jonathanhaack.com** | + | * **oemb1905@jonathanhaack.com** |
| ------------------------------------------- | ------------------------------------------- | ||
| - | //apachesurvival// | + | //fail2ban// |
| ------------------------------------------- | ------------------------------------------- | ||
| Line 21: | Line 21: | ||
| <action = %(action_mwl)s> | <action = %(action_mwl)s> | ||
| - | If you attempt to log in via ssh and fail within any 4 hour period 4 different times, then you are immediately blocked. | + | If you attempt to log in via ssh and fail within any 4 hour period 4 different times, then you are immediately blocked |
| [DEFAULT] | [DEFAULT] | ||
| Line 28: | Line 28: | ||
| maxretry = 4 | maxretry = 4 | ||
| - | The recidive filter below states that the last 3 weeks will be reviewed and if the ip address in question was banned | + | TheIf over the last 3 weeks the ip address in question was banned |
| [recidive] | [recidive] | ||
| Line 36: | Line 36: | ||
| bantime | bantime | ||
| findtime = 3w | findtime = 3w | ||
| + | maxretry = 2 | ||
| In order for this to work, the database purge parameter needs to be adjusted to be greater than or equal to what you specify for the find time in recidive. | In order for this to work, the database purge parameter needs to be adjusted to be greater than or equal to what you specify for the find time in recidive. | ||
| Line 42: | Line 43: | ||
| < | < | ||
| | | ||
| - | Okay, so far, fail2ban is installed, configured, and its service might even be running post-installation, | + | Okay, so far, fail2ban is installed, configured, and its service might even be running post-installation, |
| [sshd] | [sshd] | ||
| - | | + | enabled = true |
| port = ssh | port = ssh | ||
| logpath = %(sshd_log)s | logpath = %(sshd_log)s | ||
| backend = %(sshd_backend)s | backend = %(sshd_backend)s | ||
| - | + | After enabling the elements you are in need of, and once all of your other basic configuration changes are done, restart the service, and then check the logs to verify functionality and debug as needed. | |
| - | + | ||
| - | Once your configuration changes are done, restart the service, and then check the logs to verify functionality and debug as needed. | + | |
| | | ||
| sudo systemctl restart fail2ban.service | sudo systemctl restart fail2ban.service | ||
| sudo tail -f / | sudo tail -f / | ||
| sudo iptables -L f2b-sshd | sudo iptables -L f2b-sshd | ||
| + | sudo fail2ban-client status | ||
| - | Hope this helps! | + | Hope this helps! |
| + | |||
| + | fail2ban-client set ssh unbanip 10.xx.15x.12x | ||
| + | fail2ban-client unban --all | ||
| + | |||
| + | Another method that does more than individual services, and instead zaps all records: | ||
| + | |||
| + | sudo systemctl stop fail2ban | ||
| + | sudo truncate -s 0 / | ||
| + | sudo rm / | ||
| + | sudo systemctl restart fail2ban | ||
| + | |||
| + | Systemd log issues. Change the sshd jail as follows | ||
| + | |||
| + | sudo nano / | ||
| + | backend = systemd | ||
| + | #backend = %(sshd_backend)s | ||
| + | |||
| + | Some recommend adding backend = systemd into jail.conf, but I've found that does nothing. The error over ipv6 not being set and using auto can be removed as follows: | ||
| + | |||
| + | sudo nano / | ||
| + | ' | ||
| - | --- //[[oemb1905@jonathanhaack.com|oemb1905]] | + | --- //[[alerts@haacksnetworking.org|oemb1905]] |
computing/fail2ban.1572745542.txt.gz · Last modified: 2019/11/03 01:45 by oemb1905
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: GNU Free Documentation License 1.3
