Fail2Ban - blocking brute force attacks

Dominik Świtkowski
01 Jan, 2015

Fail2Ban is an application that should basically be installed on every machine running Unix / Linux / BSD that is exposed to the world (external IP). The main task of Fail2Ban is to block suspicious, failed login attempts to services provided by our server. In summary, it protects against brute force attacks.

The operation of Fail2Ban is based on analyzing logs and catching unauthorized login attempts to various types of services (e.g. ssh, smtp, pop3, imap...), after which it blocks the attacker's IP address using iptables rules or by adding an entry to the /etc/hosts.deny file. The configuration description will concern blocking using iptables rules.

Fail2Ban is available in many distributions as a ready-made package, so installation is dead simple.

Installing fail2ban

Debian/Ubuntu: aptitude install fail2ban
RedHat/CentOS/Fedora: yum install fail2ban

Configuration directory structure

After installing the package we'll have a directory structure similar to /etc/fail2ban/:

/etc/fail2ban/
|-- action.d
|   |-- complain.conf
|   |-- dshield.conf
|   |-- hostsdeny.conf
|   |-- ipfilter.conf
|   |-- ipfw.conf
|   |-- iptables-allports.conf
|   |-- iptables-multiport-log.conf
|   |-- iptables-multiport.conf
|   |-- iptables-new.conf
|   |-- iptables.conf
|   |-- mail-buffered.conf
|   |-- mail-whois-lines.conf
|   |-- mail-whois.conf
|   |-- mail.conf
|   |-- mynetwatchman.conf
|   |-- sendmail-buffered.conf
|   |-- sendmail-whois-lines.conf
|   |-- sendmail-whois.conf
|   |-- sendmail.conf
|   `-- shorewall.conf
|-- fail2ban.conf
|-- filter.d
|   |-- apache-auth.conf
|   |-- apache-badbots.conf
|   |-- apache-common.conf
|   |-- apache-nohome.conf
|   |-- apache-noscript.conf
|   |-- apache-overflows.conf
|   |-- common.conf
|   |-- courierlogin.conf
|   |-- couriersmtp.conf
|   |-- cyrus-imap.conf
|   |-- exim.conf
|   |-- gssftpd.conf
|   |-- lighttpd-fastcgi.conf
|   |-- named-refused.conf
|   |-- nginx-w00tw00t.conf
|   |-- pam-generic.conf
|   |-- php-url-fopen.conf
|   |-- postfix.conf
|   |-- proftpd.conf
|   |-- pure-ftpd.conf
|   |-- qmail.conf
|   |-- sasl.conf
|   |-- sieve.conf
|   |-- sshd-ddos.conf
|   |-- sshd.conf
|   |-- vsftpd.conf
|   |-- webmin-auth.conf
|   |-- wuftpd.conf
|   `-- xinetd-fail.conf
|-- jail.conf

The basic settings are contained in the file /etc/fail2ban/fail2ban.conf: loglevel, logtarget, socket. Everything here is fairly self-explanatory.

The second file is /etc/fail2ban/jail.conf, and this is really the main file responsible for protecting our services.
The official documentation states that each *.conf file can be changed to *.local, of course while keeping the original (settings from *.conf files are read first, then the configuration from .local files is read/overridden). In the case of fail2ban.conf this makes little sense, but for jail.conf it's strongly recommended. The configuration directory also contains the directories: /etc/fail2ban/filter.d/ and /etc/fail2ban/action.d/. The first contains regular expressions that fail2ban uses to catch suspicious behavior. The second directory stores the configuration defining the action to take against detected attacks.

Configuring Fail2Ban

The first step will be to create a jail.local file based on jail.conf: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

The content of the file is divided into the following sections :

DEFAULT - global program settings, which can be overridden in the other sections
ACTIONS - global definitions of actions to be taken against an "attacking" IP address.
JAILS - individual configuration for particular network services

Description of a few more important options :

ignoreip - a list of IP addresses that will never be blocked
filter - refers to the configuration file containing the regular expression used to detect unwanted activity
bantime - ban duration given in seconds
maxretry - the allowed number of events (e.g. failed logins) after which a ban follows
banaction - global configuration of the action for blocking a host after maxretry is exceeded, default action iptables-multiport
logpath - setting the appropriate path to the service's logs
port - the port on which the monitored application listens

After installation (at least on Debian) ssh protection is already activated. If we want to enable, for example, protection for the postfix smtp server, just find the [postfix] section within the JAILS section and change the enabled option to true.

All options configured in the DEFAULT and ACTIONS sections can be individually overridden in the settings of particular network services.
An example configuration that blocks attacks on ssh (openssh-server), smtp(s),sasl (postfix), imap(s) (dovecot), http(s) (nginx, the w00tw00t scanner). The jail.local file:

# Fail2Ban configuration file.
# The DEFAULT allows a global definition of the options. They can be override
# in each jail afterwards.
[DEFAULT]

ignoreip = 127.0.0.1 ip.ip.ip.ip
bantime  = 1800
maxretry = 3
backend = auto
destemail = user@ulos.pl

#
# ACTIONS
#
banaction = iptables-allports
mta = sendmail
# Default protocol
protocol = tcp

## host ban
#action = %(action_)s
## host ban + email notification
action = %(action_mw)s
## host ban + email notification + logs attached to the email
action = %(action_mwl)s
#
# JAILS
#
# Optionally you may override any other parameter (e.g. banaction,
# action, port, logpath, etc) in that section within jail.local


[ssh]

enabled = true
port    = ssh
filter  = sshd
logpath  = /var/log/auth.log
#action = sendmail-whois[name=ssh, dest=dominik.switkowski@gmail.com,sender=root@lsnet.pl]
bantime = 24400
maxretry = 2

#
# Http servers
#

[nginx-w00tw00t]
enabled  = true
port      = http,https
filter   = nginx-w00tw00t
action   = iptables-allports[nginx-w00tw00t]
logpath = /var/log/nginx/*.access.log
maxretry = 1
bantime  = 96400

#
# Mail servers
#

[postfix]
enabled  = true
port     = smtp,ssmtp,submission
filter   = postfix
logpath  = /var/log/mail.log
bantime  = 1880
maxretry = 2

[sasl]
enabled  = true
port     = smtp,ssmtp,imap2,imap3,imaps
filter   = sasl
logpath  = /var/log/mail.log
bantime  = 1880
maxretry = 1

[dovecot-pop3imap]
enabled = true
filter = dovecot-pop3imap
action = iptables-allports[name=dovecot-pop3imap]
port = imap2,imap3,imaps
logpath = /var/log/mail.log
maxretry = 3
bantime = 9200

I don't recommend copying the above example one to one - some options should be adjusted to your server's configuration. In the ACTIONS section, the banaction option has the value iptables-allports, which means blocking all services. The second option is iptables-multiport, in which case the ban imposed on the attacker only covers the attacked service. To put it visually, if someone attacks our http, fail2ban blocks their access to our web server, but they still have full access to ssh, smtp... In the JAILS section, in the configurations for particular services, pay attention to the port variable. In the configuration for the ssh service, the port is set to... ssh. This looks funny at the very least, but it results from the way fail2ban resolves network service names to port numbers, using the /etc/services file for this. You can just as well provide the port as a number.

It's worth mentioning the possibility of receiving an email about the blocking of hosts attacking us. For me this is an unnecessary feature, so I won't describe it in detail. If, however, we decide to use the above notifications, we need to have an smtp server installed.

Extending fail2ban with support for additional network services and applications is possible and quite simple at the same time. There are many ready-made solutions online, and we can also try creating our own filters, provided we know regular expressions. A good example is blocking the w00tw00t scanner.

And finally, a way to remove a ban imposed by fail2ban: unblocking an IP address.

Linux Administration