fail2ban: Automatically blocking repeated sign-in attempts

In short: A program that watches log files and automatically blocks addresses with many failed sign-ins in the firewall for a time.

In more detail: Every server on the internet is constantly attacked by bots that try out passwords (“brute force”). fail2ban reads logs (SSH, web server, mail …), recognises patterns such as “five wrong passwords from the same address within 10 minutes” and enters the address into the firewall for a while.

In Depth

Building blocks

Filter: regular expressions that detect suspicious lines in a log.
Jail: combination of log file, filter and rules (maxretry, findtime, bantime).
Action: action on a match, usually a firewall rule (nftables, iptables, ufw) and optionally a notification.

Example configuration

In /etc/fail2ban/jail.local (never edit the default file, it is overwritten on updates):

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5
ignoreip = 127.0.0.1/8 192.168.1.0/24

[sshd]
enabled = true

Then sudo systemctl restart fail2ban. With sudo fail2ban-client status sshd you see the currently blocked addresses, fail2ban-client set sshd unbanip 1.2.3.4 lifts a block.

Benefits and limits

fail2ban reduces noise and slows simple attacks. But it does not replace good basics: keys instead of passwords for SSH, strong passwords, current software, a changed or blocked port only as an addition. Distributed attacks with many changing addresses escape the block. Blocks should be time-limited so that you do not lock yourself out.

Pitfalls

Add your own address to ignoreip, otherwise you lock yourself out on typos. Behind a reverse proxy the filter must read the real client address from the header, otherwise the proxy gets blocked. Modern alternatives and additions are CrowdSec (shared block lists) and rate limiting directly at the web server.

Emzett Wiki

Explorer