Comments on 2019-01-20 fail2ban to watch over my sites

Blimey. I don’t remember the last time anyone did anything gophery I noticed.

Blue Tyson 2019-01-30 10:47 UTC


The #gopher discussion is alive and well on Mastodon... 🙂

– Alex Schroeder 2019-01-30 13:11 UTC


Something to review when I have a bit of time: Web Server Security by @infosechandbook.

– Alex Schroeder 2019-02-01 18:11 UTC


OK, I added a meta rule: If people get banned a few times, I want to ban them for longer periods!

This is filter.d/alex-fail2ban.conf:

# Author: Alex Schroeder <alex@gnu.org>

[Init]
# 2019-07-07 06:45:45,663 fail2ban.actions        [459]: NOTICE  [alex-apache] Ban 187.236.231.123
datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S

[Definition]
failregex = NOTICE .* Ban <HOST>

And my jail in jail.d/alex.conf gets a new section that uses this filter:

[alex-fail2ban]
enabled = true
# all ports
logpath = /var/log/fail2ban.log
# ban repeated offenders for 6h: if you get banned three times in an
# hour, you're banned for 6h
bantime = 6h
findtime = 1h
maxretry = 3

– Alex Schroeder 2019-07-10 10:36 UTC


Oh, and if you’re curious, here’s my fail2ban cheat sheet. Remember, fail2ban has a separate blacklist!

# Get all the jails
fail2ban-client status

# List banned IPs in a jail
fail2ban-client status alex-apache

# Unban an IP
fail2ban-client unban 127.0.0.1

– Alex Schroeder 2019-07-10 10:38 UTC


Munin reports nothing strange

As you can see, Munin is picking up the new rule, but apparently all the bans are due to Apache logs.

I’m quite certain that my SSH bans are zero because I’m running SSH on a non-standard port... 😇 I know, some people disapprove. But I say: everything else being the same, running it on a separate port simply reduces the number of drive-by attacks, in other words if you’re not being targeted specifically but incidentally, then having moved to a non-standard port helps.

– Alex Schroeder 2019-07-10 13:06 UTC


@MrManor recently told me that fail2ban watching its own logs is already in jail.conf: look for [recidive].

This is what it has:

[recidive]
logpath  = /var/log/fail2ban.log
banaction = %(banaction_allports)s
bantime  = 1w
findtime = 1d

There’s also a warning regarding fail2ban.conf, saying I must change dbpurgeage. No problem:

dbpurgeage = 648000

All I need to do is enable it in jail.d/alex.conf by writing:

[recidive]
enabled = true

Now the files filter.d/alex-fail2ban.conf and the section [alex-fail2ban] in my jail.d/alex.conf are both unnecessary.

– Alex Schroeder 2019-07-30 06:25 UTC


Please make sure you contribute only your own work, or work licensed under the GNU Free Documentation License. Note: in order to facilitate peer review and fight vandalism, we will store your IP number for a number of days. See Privacy Policy for more information. See Info for text formatting rules. You can edit this page if you need to fix typos. You can subscribe to updates by email without leaving a comment.

To save this page you must answer this question:

Please say HELLO.