1

I've recently installed fail2ban as a way of keeping one of our web servers secure from SSH attacks and HTTP attacks. At the moment I'm getting a lot of ssh attacks but fail2ban are banning and then unbanning these. Is they a way to permanently ban these IP's due to the level of attacks.

Also in fail2ban how to do allow HTTP requests from a certain IP so these dont get banned as our developers will be making lots of strange requests under the /var/www/dev folder that will show file not exists, etc.

All advice welcomed cheers

3 Answers 3

4

You can add an IP/network to the fail2ban whitelist to accomplish just that (the second part, I mean). Edit the ignoreip parameter on your jail.conf (probably on /etc/fail2ban).

As for the first part, I saw this workaround mentioned on the fail2ban wiki:

http://whyscream.net/wiki/index.php/Fail2ban_monitoring_Fail2ban

2
  • @eduardo-ivanec thanks for the advice, with the ignore IP done just by a space or comma, e.g. 127.0.0.1,192.168.0.1
    – Grimlockz
    May 4, 2011 at 12:55
  • @Grimlockz I would strongly advise against permanent bans, and instead just increase the duration of the ban (default is 10 minutes, bump that up to e.g. 24 hours) combined with adding the "Fail2ban monitoring Fail2ban" jail that @Eduardo linked above, using a very long duration on that one. That said, while I see a lot of traffic against my server, the overwhelming majority of attackers cease after that first 10-minute ban, so you might not see the benefit you're hoping for here.
    – Kromey
    May 4, 2011 at 18:02
2

I use denyhosts

By default, it does not lift bans

You can have exclusions in /etc/hosts.allow

2

I think you will need to use a combination of fail2ban (for temporary bans) and denyhosts (for permanent bans).

I would advise to be very careful about permanent bans, this can backfire in unexpected ways (such as valid requests and hack attempts coming from the same public IP, because the real source is behind a masquerading firewall, e.g. a university network). It's probably a better idea to play around with the jail settings for particular hack attempts in fail2ban until you achieve a good compromise.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .