Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have set up a custom jail for a spambot that is giving me trouble. Using "bantime -1" I was trying to permanently ban the botnet. I thought it was working, but when the weekly logrotate occured fail2ban unbanned all IPs.

What is the best way to permanently and persistently ban an IP using fail2ban?

Is doing something like this + logging permanently banned IP to a seperate files (that does not get rotated) a good solution?

Cheers, Thomas

P.S.: I would like to do this without new cronjobs and scripts.
P.P.S.: I'm using Debian.

share|improve this question
    
If i have persistant spambots, I manually blacklist them. However, I find that I don't get a lot of hits from manually blacklisted items. Fail2ban does not normally maintain state over firewall reload. –  BillThor Oct 18 '10 at 15:26
    
If you don't want to script it then you'll have to do it manually. How you do that depends on the unix variant you're using. –  Iain Oct 19 '10 at 6:51
add comment

4 Answers

Put the ban in your permanent iptables configuration file (possibly /etc/sysconfig/iptables).

share|improve this answer
add comment

My peraban action file appends the IP the a file that my firewall loads on boot, so it's never lost. How you achieve that will depend on your setup and system.

share|improve this answer
add comment

Fail2ban monitors various logs and takes action based on what it finds. In this particular case it will be adding rules to the iptables firewall. You will have to save the state of your firewall before the ban rules are deleted.

How and where to do this depends on your system. For Red Hat systems and the like you can use

sudo service iptables save

which will write the current state of your iptables firewall to /etc/sysconfig/iptables

for Ubuntu systems have a look at this document which give guidance on how and where to make changes to the startup/shutdown files to save and restore the iptables configuration.

For Debian systems have a look at this article.

Once you know how to save the state of your firewall you could do the save/restore in logrotate prerotate and postrotate scripts.

share|improve this answer
add comment

I scoured the net for a couple hours trying to find a solid way of doing this. This article was a godsend for me! Fail2Ban: Permanent SSH Bans. It suggests a separate file to store and recall permanently-banned IPs, which is read on fail2ban launch and written to whenever an address is banned. A similar could be used to store bans in a database or the system-wide iptables rules.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.