Fail2Ban works by scanning through log files and reacting to offending actions such as repeated failed login attempts, by using iptables to generate blocking-rules for any defined (listening) protocols / services, aimed at specific offending IP-addresses.
I used to utilize DenyHosts, but as the project was discontinued I had to adapt. And so I also had to retract all my recommendations of DenyHosts and update them all to endorse Fail2Ban instead.
If using Ubuntu or Linux Mint, setting up and using Fail2Ban is easy.
It comes pre-configured (on Ubuntu) to detect malicious SSH-activity with basic notification action,
Firstly, you just have to apt-get it:
sudo apt-get install fail2banThen, you just copy over the standard (Ubuntu) "skeleton"-config:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.localThen stop and (re-)start Fail2Ban to load and run the config:
sudo service fail2ban stop && \It can be customized to send e-mail alerts to designated addresses, and various other "actions_".
sudo service fail2ban start
Protocols and / or services are easily added to the config-file if they aren't already present. Fail2Bans config-file uses an easy syntax (layout-format) for somebody with basic networking- and logging-knowledge.
I tend to also enable the "ssh-ddos" detection, since these days we're seeing more and more distributed attacks. There are more SSH-specific detection's, but they're not necessary.
Posts
