Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a fail2ban configured like below:

  • block the ip after 3 failed attempts
  • release the IP after 300 sec timeout

This works perfectly and I want to keep it this way such that a valid user gets a chance to retry the login after the timeout. Now, I want to implement a rule where if same IP is been detected as attack and blocked, unblocked 5 times, permanently block the IP and never unblock again. Can this be achieved with fail2ban alone or I need to write my own script to do that?

I am doing this in centos.

share|improve this question
1  
It's a rather silly idea - the more rules you add to iptables the slower it gets. –  symcbean Aug 7 '12 at 13:19
1  
Appreciate your comment but what I need is an answer and not a suggestion. Thanks anyway. –  BTR Naidu Aug 7 '12 at 13:29
1  
Sometimes the right answer to "how do I do X" is "don't do X". –  ceejayoz Feb 20 '13 at 16:08
add comment

3 Answers

up vote 2 down vote accepted

There is no default feature or a setting within fail2ban to achieve this. But, you are probably looking for setting up fail2ban to monitor its own log file. It is a two step process...

Step 1

We could need to create a filter to check for BAN's in the log file (fail2ban's log file)

Step 2

We need to define the jail, similar to the following...

[fail2ban]
enabled = true
filter = fail2ban
action = iptables-allports[name=fail2ban]
logpath = /path/to/fail2ban.log
# findtime: 1 day
findtime = 86400
# bantime: 1 year
bantime = 31536000

Technically, it is not a permanent block, but only blocks for a year (that we can increase too).

Anyway, for your question (Can this be achieved with fail2ban alone or I need to write my own script to do that?)... writing own script might work well. Setting up the script to extract the frequently banned IPs and then putting them into /etc/hosts.deny is what I'd recommend.

share|improve this answer
add comment

I believe if you put bantime = -1 in that config section, it is a permanent block.

share|improve this answer
    
Indeed, setting bantime to any negative value is a permanent ban (as of Fail2Ban ver. 0.6.1 (2006/03/16)) –  voretaq7 Mar 21 '13 at 16:41
add comment

To expand on Chin's answer this is pretty simple. Just edit the 2 settings in /etc/fail2ban/jail.conf to match your preferences.

 # ban time in seconds. Use -1 for forever. Example is 1 week.
 bantime  = 604800
 # number of failures before banning
 maxretry = 5
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.