Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Hello and happy new year,

I am wondering if I can use fail2ban on a virtual host that uses bridge-util. I am using LXC containers for virtualization and have therefore direct access to all the log files from the host environment. It would be great if I could install fail2ban just on the host and secure all the virtual boxes at once.

I am just not sure how well fail2ban works with bridge-util, or if there is anything I have to consider with this approach.

Thanks, and lets hope for a better year (2012)

share|improve this question

1 Answer 1

Happy new year :)

fail2ban can work with custom commands. You need:

cd /etc/fail2ban

cp jail.conf jail.local

In jail.local:

[ssh-host1]
enabled = true
port=ssh
filter=sshd
logpath=/path/to/host1/logs/auth.log
maxretry=6
banaction=bridge-utils

Create action.d/bridge-utils.local:

[Definition]
# executed once at the start of fail2ban
actionstart = brctl ...
# executed once at the end of fail2ban
actionstop = brctl ...
# executed once before each actionban command
actioncheck = ...
# ban action
actionban = brctl ...
            brctl ...
# unban action
actionunban = brctl ...
              brctl ...

[Init]
# some default variables here

Restart fail2ban and test if it's working right.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.