Fail2ban. Centos 7. Installation and configuring

Links

https://losst.ru/nastrojka-fail2ban-centos-7

Installation and configuring

yum install epel-release

yum install fail2ban

Backup original config /etc/fail2ban/jail.conf

mv /etc/fail2ban/jail.conf /etc/fail2ban/jail.conf.ORIG

It will be rewrited on update, so don't use it

Use /etc/fail2ban/jail.local config instead

Copy orig conf to custom conf

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit conf

nano /etc/fail2ban/jail.local

...
# enable fail2ban
enabled = true
...

# "maxretry" is the number of failures before a host get banned.
maxretry = 5
...

# time to ban IP
bantime  = 10m

# A host is banned if it has generated "maxretry" during the last "findtime"
findtime  = 10m
...

# DELETE ALL SERVICES, EXCEPT SERVICES WE WILL USE
# as example - SSHD

[sshd]
# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
#mode   = normal
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
...

Restart fail2ban

systemctl restart fail2ban

Test from client

Try to login to server 5 times with wrong password

ssh root@<server-with-fail2ban>

Test at server

cat /var/log/fail2ban.log

...
2021-03-08 11:51:28,721 fail2ban.filter         [2280]: INFO    [sshd] Found 192.168.17.250 - 2021-03-08 11:51:28
2021-03-08 11:51:31,446 fail2ban.filter         [2280]: INFO    [sshd] Found 192.168.17.250 - 2021-03-08 11:51:31
2021-03-08 11:51:33,862 fail2ban.filter         [2280]: INFO    [sshd] Found 192.168.17.250 - 2021-03-08 11:51:33
2021-03-08 11:52:38,031 fail2ban.filter         [2280]: INFO    [sshd] Found 192.168.17.250 - 2021-03-08 11:52:38
2021-03-08 11:52:40,501 fail2ban.filter         [2280]: INFO    [sshd] Found 192.168.17.250 - 2021-03-08 11:52:40
2021-03-08 11:52:40,880 fail2ban.actions        [2280]: NOTICE  [sshd] Ban 192.168.17.250
...

Look at iptables rule

iptables -L f2b-sshd -v --line-numbers

...
Chain f2b-sshd (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        8  1004 REJECT     all  --  any    any     192.168.17.250       anywhere             reject-with icmp-port-unreachable
...

Client 192.168.17.250 is BANNED!

Manual delete ban rule

iptables -D f2b-sshd 1