Fail2ban: fighting bruteforcing

Every public SSH server receives hundreds of connection attempts per day. The auth.log fills up with Failed password for root from x.x.x.x lines. Fail2ban reads those logs, counts the failures and bans the IP via iptables. It is a guard dog that reads logs instead of sniffing.

The principle

Fail2ban works in three steps: it tails a log file (auth.log, mail.log, apache.log), it matches lines against configurable regular expressions and it runs an action when the threshold is reached (typically, an iptables DROP rule for the offending IP for N minutes).

Installation and config

apt-get install fail2ban
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

The jail.local file is the active config (fail2ban never reads jail.conf directly). The SSH jail:

[ssh]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3
bantime  = 600

Three failures in less than 600 seconds = the IP is banned for 600 seconds. The filters are in /etc/fail2ban/filter.d/ and the sshd filter already matches all the OpenSSH log variants (Failed password, Invalid user, etc.).

The jails that are really worth it

Beyond SSH, three jails worth the install:

[apache-noscript]
enabled  = true
filter   = apache-noscript
logpath  = /var/log/apache2/error.log
maxretry = 5

[postfix]
enabled  = true
filter   = postfix
logpath  = /var/log/mail.log
maxretry = 3

[proftpd]
enabled  = true
filter   = proftpd
logpath  = /var/log/proftpd/proftpd.log
maxretry = 3

The apache-noscript jail bans IPs probing /phpmyadmin, /wp-admin, /shell.php (automated scanners). The postfix jail bans IPs attempting relay. The proftpd jail bans FTP brute-forcers.

Verify it works

fail2ban-client status ssh
# Status for the jail: ssh
# |- filter
# |  |- Currently failed: 3
# |  |- Total failed:     184
# |- action
#    |- Currently banned: 2
#    |- Total banned:     12
#    |- IP list:          203.0.113.1 203.0.113.42

And to unban manually (the case where you banned yourself by forgetting the password):

fail2ban-client set ssh unbanip 203.0.113.1

What it does not do

Fail2ban does not replace a firewall, does not replace key authentication and does not replace monitoring. It reduces log noise and prevents automated brute-force. An attacker with different IPs (a botnet) bypasses Fail2ban effortlessly. The real countermeasure remains key authentication.

But on a server receiving 500 SSH attempts per day, Fail2ban reduces the logs to 3 lines per IP instead of 500. And that changes the life of the sysadmin reading auth.log.