Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I was wondering if it was possible to have fail2ban clients on different machines and have a server on one machine communicating with all the clients?

Here's my situation: I have 4 servers and I'm using fail2ban to protect them. For now I have one client and one server installed per machine. I wonder if I could just have one client on each machine and have only one server total on one machine that would communicate with all clients. All the servers are running on CentOS and I'm using iptables to ban.

Do you have any idea on how to do that?

share|improve this question

1 Answer 1

Theoretically it's possible. Whether or not it would be advisable do to this is another question. If you wanted to implement this, it would require a fair amount of customization of detection and action rules in fail2ban.

The basic idea would be this:

Have all of the "client" systems configured to send their syslogs to the "master" server. Fail2ban would run on this master and would watch the logs coming in from all the client machines. You'd need to configure separate filter and action rules for each client machine, ensuring that each matching rule only matches log entries for that specific server. Then for the action definitions, instead of having it insert iptables rules locally on the server, it would execute a remote iptables command on the client via ssh.

share|improve this answer
    
Ok so it's possible. Now is it advisable? if not why? –  Martin Beydon Sep 28 '11 at 7:51
    
Well, the product isn't really meant to be run in this way. –  EEAA Sep 28 '11 at 13:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.