Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've recently installed fail2ban as a way of keeping one of our web servers secure from SSH attacks and HTTP attacks. At the moment I'm getting a lot of ssh attacks but fail2ban are banning and then unbanning these. Is they a way to permanently ban these IP's due to the level of attacks.

Also in fail2ban how to do allow HTTP requests from a certain IP so these dont get banned as our developers will be making lots of strange requests under the /var/www/dev folder that will show file not exists, etc.

All advice welcomed cheers

share|improve this question

migrated from stackoverflow.com May 4 '11 at 11:40

This question came from our site for professional and enthusiast programmers.

3 Answers 3

up vote 4 down vote accepted

You can add an IP/network to the fail2ban whitelist to accomplish just that (the second part, I mean). Edit the ignoreip parameter on your jail.conf (probably on /etc/fail2ban).

As for the first part, I saw this workaround mentioned on the fail2ban wiki:

http://whyscream.net/wiki/index.php/Fail2ban_monitoring_Fail2ban

share|improve this answer
    
@eduardo-ivanec thanks for the advice, with the ignore IP done just by a space or comma, e.g. 127.0.0.1,192.168.0.1 –  Grimlockz May 4 '11 at 12:55
    
@Grimlockz I would strongly advise against permanent bans, and instead just increase the duration of the ban (default is 10 minutes, bump that up to e.g. 24 hours) combined with adding the "Fail2ban monitoring Fail2ban" jail that @Eduardo linked above, using a very long duration on that one. That said, while I see a lot of traffic against my server, the overwhelming majority of attackers cease after that first 10-minute ban, so you might not see the benefit you're hoping for here. –  Kromey May 4 '11 at 18:02

I use denyhosts

By default, it does not lift bans

You can have exclusions in /etc/hosts.allow

share|improve this answer

I think you will need to use a combination of fail2ban (for temporary bans) and denyhosts (for permanent bans).

I would advise to be very careful about permanent bans, this can backfire in unexpected ways (such as valid requests and hack attempts coming from the same public IP, because the real source is behind a masquerading firewall, e.g. a university network). It's probably a better idea to play around with the jail settings for particular hack attempts in fail2ban until you achieve a good compromise.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.