Fail2ban primer

In todays world security is a must. Especially with worms, botnets, and the alike. One thing every new system administrator should adopt. So today I want to introduce you to fail2ban http://www.fail2ban.org . This piece of software is a diamond in the rough and is a great tool. Not only should this be used on servers but also on any home computers that allow any kind of remote access to them.

This is a system to parse log files for failed login attempts and take action against those trying to brute force passwords. You can adjust settings to meet your needs. This system can email you, adjust firewall rules, detect brute force behavior or even be used to identify phishing attempts against your server and block the blackhat phishing for certain software to exploit.

The requirements for this software is a system with Python, root access and *nix based system(yes apple fans theres room for you too!). The optional requirements are Shorewall, Netfilter/Iptables, TCP Wrapper, and a mailer script.

Current features this program untilitizes are.

Client/Server architecture.
Multi-threaded.
Highly configurable.
FAM/Gamin support.
Parses log files and looks for given patterns.
Executes commands when a pattern has been detected for the same IP address for more than X times. X can be changed.
After a given amount of time, executes another command in order to unban the IP address.
Uses Netfilter/Iptables by default but can also use TCP Wrapper (/etc/hosts.deny) and many other actions.
Handles log files rotation.
Can handle more than one service (sshd, apache, vsftpd, etc).
Resolves DNS hostname to IP address.

Installation is pretty strait forward. I use Ubuntu and it is great. The installation was a breeze. First I hurried on over to http://www.fail2ban.org/wiki/index.php/Downloads and picked the Ubuntu distro link. Then that brought me to http://packages.ubuntu.com/search?keywords=fail2ban . I then picked my version of Ubuntu. I use Natty Narwhal. So I went down the lest and picked Natty. After this I was brought to the Natty fail2ban page. I then proceeded to read the package name then opened up a terminal. After opening the terminal I typed the following command. "sudo apt-get install fail2ban" Apt proceeded to install fail2ban for me. Isn't apt just amazing?!?

So where we stand now is fail2ban is installed. You can find the config files in /etc/fail2ban . One of the most important and most used IMHO is jail.conf, this file holds all reference's to the filters involved in performing the bans and log file parsing. Inside filter.d directory this is where all your filters are. The actions.d directory holds all the config files for the different actions fail2ban utilizes during it's processing; mailing, iptables, dshield alerts, shorewall, ipfw etc.

To start fail2ban it places a init script in /etc/init.d/fail2ban . Be sure to add this to your rc files to allow this to start at boot.

update-rc.d fail2ban defaults

I hope this was a good start at getting you familiar with fail2ban . This is a excellent piece of software that has served a important role in the community. Be sure to check out the user contributed filters on the community page and make some of your own! Thanks and bye!