The fail2ban intrusion prevention framework

Ban-Aid

Article from ADMIN 10/2012

By Chris Binnie

For its size, fail2ban, a utility that scans logfiles and bans suspicious IP addresses, punches well above its weight.

The few sys admins who haven't heard of fail2ban are likely to be just starting out or focus on areas other than server administration. In my experience, it's quite rare that really small utilities can affect the way you run your servers to the extent that fail2ban does, which certainly explains its popularity.

The fail2ban feather-weight set of scripts easily integrate with popular firewalls and, among other things, catches any failed logins for services that you're running and then bans the IP address of the offender after a certain number of failed attempts. Admittedly, that sounds like quite simple functionality, but when you get down to the innards of the software, it's a truly powerful tool.

I had been using fail2ban on SSH login failures, probably it's most common usage, before I became increasingly annoyed with web server logs filling up with nefarious probes attempting to compromise PHP with remote exploits (and a myriad of other HTTP attacks). It got to the point at where a large proportion of the Apache logs were failed attempts to find hidden directories or non-existent Joomla installations among the legitimate hits on the websites.

Also, I ran a few mail servers that allowed mail relaying via SASL password authentication [1], which (and there are other ways of running the authentication side) had system user accounts with PAM [2] checking for correct passwords. I had set the SASL user accounts so that a shell login couldn't be used to access the server, but I was still more than aware that having a piece of software so readily open to abuse by brute force was far from ideal. So, fail2ban stepped forward yet again; I could simply ban any IP that entered the wrong password three times for as long as I wanted.

From the scenarios above, I hope you will agree that fail2ban can be applied in all sorts of

...

Use Express-Checkout link below to read the full article (PDF).