Have fail2ban client and server on different machines

Question

I was wondering if it was possible to have fail2ban clients on different machines and have a server on one machine communicating with all the clients?

Here's my situation: I have 4 servers and I'm using fail2ban to protect them. For now I have one client and one server installed per machine. I wonder if I could just have one client on each machine and have only one server total on one machine that would communicate with all clients. All the servers are running on CentOS and I'm using iptables to ban.

Do you have any idea on how to do that?

Answer 1

Theoretically it's possible. Whether or not it would be advisable do to this is another question. If you wanted to implement this, it would require a fair amount of customization of detection and action rules in fail2ban.

The basic idea would be this:

Have all of the "client" systems configured to send their syslogs to the "master" server. Fail2ban would run on this master and would watch the logs coming in from all the client machines. You'd need to configure separate filter and action rules for each client machine, ensuring that each matching rule only matches log entries for that specific server. Then for the action definitions, instead of having it insert iptables rules locally on the server, it would execute a remote iptables command on the client via ssh.