Fail2ban

From wiki.linuxonlinehelp.de
Jump to: navigation, search

On Servers a "must have" is the Fail2Ban Log Monitor (Linux + FreeBSD) copy the template jail.conf to jail.local! edit jail.local and set at "TOP" for all services:

bantime = -1 #forever or "3600" for 1hour
maxretry = 1

for SSH:

[sshd]
port = 22
logpath = /var/log/auth.log
backend = %(sshd_backend)s
maxretry = 1
enabled = true

Remarks: on FreeBSD the banaction = bsd-ipfw #if ipfw is used!

DO ALWAYS TEST THE SETTINGS by looking into the fail2ban.log!

Should show X.Y.Z IP banned..if attacked or tested with wrong password login. do:

tail -f -n100 /var/log/fail2ban.log