1

I am working on an course assignment to implement fail2ban to prevent brute force attack on a web site (using standard user authentication). I have set up my apache web server as well as fail2ban setting in my jail.local as follow:

[apache-auth] enabled = true port = http,https logpath = /var/log/httpd/demo-error_log maxretry = 3 bantime = 300

The sequence only works on the 4th failed attempt to block/ 'ban' the ip. The IP address was captured correctly in my logfile.

When I do the debugging, I observed that the authentication part only kicks in after the 3rd attempt, and I can only succeed on the 4th attempt.

Changing the maxretry to '4', I succeed on the 5th attempt (,ie. succeed only on maxretry+1)

Where could be the possible issue(s)? For guidance please. Thank you!

1 Answer 1

1

This is working as expected.

maxretry is how many attempts will be tolerated so you will get a ban after maxretry+1 attempts

reference: https://www.digitalocean.com/community/tutorials/how-fail2ban-works-to-protect-services-on-a-linux-server

5
  • Dear Chris, thank you for your reply.
    – CKSoon
    Dec 30, 2021 at 3:08
  • In the url link you had advised, it was mentioned [QUOTE] The default for number of authentication failures necessary to trigger a ban is overridden in the SSH portion of the default configuration file to allow for 6 failures before the ban takes place. This is entirely configurable by the administrator. [UNQUOTE] how can I set the number of failures = maxretry?
    – CKSoon
    Dec 30, 2021 at 3:10
  • if your maxretry in the SSH section is higher than in the DEFAULT section then you can either change the values to match or remove/comment-out the line in the SSH section and it will use the DEFAULT maxretry value Dec 30, 2021 at 3:17
  • any update? and could you mark my answer as accepted if it helped you? thanks Jan 15, 2022 at 1:11
  • Hi Heath, thank you for your advice. It was good in aiding my work. Cheers!
    – CKSoon
    Jan 16, 2022 at 10:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .