fail2ban with bridge-util

Question

Hello and happy new year,

I am wondering if I can use fail2ban on a virtual host that uses bridge-util. I am using LXC containers for virtualization and have therefore direct access to all the log files from the host environment. It would be great if I could install fail2ban just on the host and secure all the virtual boxes at once.

I am just not sure how well fail2ban works with bridge-util, or if there is anything I have to consider with this approach.

Thanks, and lets hope for a better year (2012)

Answer 1

Happy new year :)

fail2ban can work with custom commands. You need:

cd /etc/fail2ban

cp jail.conf jail.local

In jail.local:

[ssh-host1]
enabled = true
port=ssh
filter=sshd
logpath=/path/to/host1/logs/auth.log
maxretry=6
banaction=bridge-utils

Create action.d/bridge-utils.local:

[Definition]
# executed once at the start of fail2ban
actionstart = brctl ...
# executed once at the end of fail2ban
actionstop = brctl ...
# executed once before each actionban command
actioncheck = ...
# ban action
actionban = brctl ...
            brctl ...
# unban action
actionunban = brctl ...
              brctl ...

[Init]
# some default variables here

Restart fail2ban and test if it's working right.