How can I install an upgraded version of Fail2Ban on my Ubuntu 12.04.5 LTS (Precise Pangolin) so I can have a
recidive filter set. Ubuntu 12.04.5 LTS installs Fail2Ban 0.8.6 and I need Fail2Ban 0.8.7 to use the
I manage a bunch of Ubuntu 12.04.5 LTS (Precise Pangolin) servers and have installed Fail2Ban specifically to block repeated SSH brute force attempts. These attacks are targeted at
root and the
root user is disabled on all of these systems, but I just want to add another layer of protection to my mix as well as cut down on the added “noise” of having to sift through failed login attempts in my SSH
Anyway, the version of Fail2Ban—version 0.8.6—that is installed for Ubuntu 12.04.5 LTS from the default repositories works great for the most part. But it seems to be missing support for blocking repeat offenders. And these servers are definitely getting a lot of persistent brute force attempts. So I want to make sure that these clowns are blocked for a longer time.
I checked this blog post titled, “Permanently Ban Repeat Offenders With fail2ban (UPDATED)” and it recommends using the
recidive filter. The rest of that post shows how to set up a customized equivalent of
recidive but I don’t have any desire to use a custom solution if a built in solution such as
But when I attempt to set the
recidive filter in Fail2Ban 0.8.6 and restart the service, it fails saying the filter
recidive doesn’t exist.
When I check the Fail2Ban changelog on GitHub I can see that
recidive support was added around version 0.8.7:
Tom Hendrikx * [f94a121..] 'recidive' filter/jail to monitor fail2ban.conf to ban repeated offenders. Close gh-19
Well, isn’t that special. I’m using 0.8.6 and version 0.8.7 has support for this.
So how can I easily install anything newer than Fail2Ban 0.8.6 on Ubuntu 12.04.5 LTS? I tried to install version 0.9.3 by cloning the GitHub repository, switching to the Debian branch (since Ubuntu is Debian-based) and it seemed to work. But the startup service didn’t work and it also seems like that 0.9.3 won’t work with the version of IPTables I have installed in Ubuntu 12.04.5 LTS unless I tweak some config files or possibly upgrade IPTables itself.
Maybe there’s a way to tweak it all to work for Ubuntu 12.04.5 LTS but I don’t have the time or will to deal with that since all I want is
recidive support and don’t care about anything else. What can I do?