5

Fail2ban can be configured in so many places.

$ fail2ban-client -i 
Fail2Ban v0.10.2 reads log file that contains password failure report
and bans the corresponding IP addresses using firewall rules.

On Debian Buster I can edit my settings in several config files:

/etc/fail2ban/jail.d/defaults-debian.conf
/etc/fail2ban/fail2ban.conf
/etc/fail2ban/jail.conf
/etc/fail2ban/action.d/

And - last but not least - some tutorials recommend:

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

The Documentation of fail2ban says:

Modifications should take place in the .local and not in the .conf. This avoids merging problem when upgrading. These files are well documented and detailed information should be available there.

Does that mean, that every .conf File I want to edit should exist as a .local file?

I am confused! Can someone shed some light on this please?

2
  • 1
    Adding to your line from the docs: Every .conf file can be overridden with a file named .local. The .conf file is read first, then .local, with later settings overriding earlier ones. Thus, a .local file doesn't have to include everything in the corresponding .conf file, only those settings that you wish to override.. So yes, your assumption is correct. Nothing stops you from altering the .conf files, if you want to, though.
    – Lenniey
    Dec 30, 2019 at 11:38
  • If you accepted the answer from @corni, it seems his answer is also worth an upvoat? Cheers.
    – Citizen
    Dec 30, 2019 at 18:37

1 Answer 1

8

You only need to edit one file.

To avoid problems during system upgrades, you should always copy jail.conf to jail.local and modify the latter only. The same for all other fail2ban config files.

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Then edit this file and scroll down to the filters you want to use.

In those filters, add enabled = true. I recommend not to enable too many filters at the beginning. One or two is enough. Be carefull with the SSH filter if you're are connected via SSH. You might lock yourself out.

Filters

Look in the filter.d directory to see all available filters. Choose one or two suitable ones. Be sure to understand what their regexes match and what log files you need.

Fail2ban works with log files. So the filters must match the appropriate log files. You can test this with

fail2ban-regex <logfile> <filter>

For example

fail2ban-regex /var/log/nginx/default_access.log /etc/fail2ban/filter.d/nginx-botsearch.conf

This filter - for example - looks for 404 errors in your NGINX access.log and blocks them, if the conditions match. For the conditions, see below.

Restart fail2ban after you finished editing:

systemctl restart fail2ban

Other settings in your jail.local file:

All settings can be made global as well as filter specific.

bantime  = 7200
findtime  = 10m
maxretry = 10

means 10 errors in 10 minutes will result in a 2 hour ban.

If you don't want to use iptables for the banning, you can change your banaction. The default banaction uses iptables, which should work on all systems I know but you might not see the bans in your familiar firewall interface.

banaction = ufw

See the actions in action.d. With this setting, fail2ban will use ufw to block IPs. Then you can see the ban via ufw status.

Especially for SSH, be sure to exclude your local IP range from banning, so you can't ban yourself :

ignoreip = 127.0.0.1/8 ::1 192.168.178.0/24

I would suggest you not to create or modify new filters or actions. Use the included ones and be happy. It's not easy to buiild your own regex patterns and the log file format changes from time to time - which will break your filters. Your system won't be secured then. You should not edit Apaches default log format, too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.