0

I am new to fail2ban. I want to setup Fail2Ban such that it bans an IP for one hour on two failed login attempts. I have the following setup:

/etc/fail2ban/jail.local.conf

[DEFAULT]
bantime = 3600
maxretry = 2
backend = systemd
usedns = warn
mode = normal
destemail = <MYEMAIL>
sender = <MYSENDER>
protocol = tcp
chain = <known/chain>
port = 0:65535
fail2ban_agent = Fail2Ban/%(fail2ban_version)s
...
# Choose default action.  To change, just override value of 'action' with
# the interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
# globally (section [DEFAULT]) or per specific section
action = %(action_mw)s

[sshd]

# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
#mode   = normal
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s


[dropbear]

port     = ssh
logpath  = %(dropbear_log)s
backend  = %(dropbear_backend)s


[selinux-ssh]

port     = ssh
logpath  = %(auditd_log)s

On systemctl status fail2ban.service I see the service is up. My assumption is it is using the jail.local.conf file. There are no errors reported. I don't have iptables installed. Is that necessary? If so, how do I set it up with my existing fail2ban setup?

1

I guess better later than never, so I'll post an answer to this, if anyone stumbles upon it like I did.

Do you need iptables?

Basically, Yes, you need iptables. At least for fail2ban to work properly.

Simply use the apt-get install iptables to make that happen.



How to setup your fail2ban jails?

Now to the first question.

Basically to setup your fail2ban to run properly (after installing it properly), you need to make a copy of the file jail.conf and edit that file. Then reload the service to have it run according to your setup.

I'm detailing that below, but first: install fail2ban.


  1. Copy of the jail.conf file:
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

  1. Now that you have the copy, make the edits you want, then save the edits and exit the file.
nano /etc/fail2ban/jail.local

You could add your own IP to prevent locking yourself out for example.
For that, find the [DEFAULT] row, below that, find the row that starts with #ignoreip, uncomment it, and paste your IPs (separated by a space).


  1. You're all set now, you just need to restart fail2ban. For that just use the following command.
service fail2ban restart

You can check the status of your jails with the following command:
fail2ban-client status sshd

1
  • 1
    It's not necessary and usually considered bad practice to copy the jail.conf file. Just make your desired changes in an otherwise empty jail.local file. – Michael Hampton Jan 16 at 22:20
1

Your file has the wrong name. fail2ban will read a file named jail.local, not jail.local.conf. Rename the file and restart fail2ban.

1
  • Well that works too :) I should probably have read the first row of the setup properly! So this is actually the simplest reply to the question indeed! Thank you Michael! – David Jan 17 at 13:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.