User:Hannes Röst/fail2ban

Fail2Ban is a software that uses iptables to ban IP addresses that behave badly.

FAQ

How to block mediawiki break-in attempts

Use this plugin and the code here:

• http://www.mediawiki.org/wiki/Extension:Fail2banlog

How to create a custom filter

see below question "How can I ban all IPs that are banned often" for an example

How can I ban all IPs that are banned often

• http://www.the-art-of-web.com/system/fail2ban-log/

The idea here is to use the fail2ban log itself to ban IPs that have been banned often. The article above is somewhat outdated and we can make the following changes

# /etc/fail2ban/jail.conf
 
# 3 times banned in six hours => 24h ban
[Fail2BanFilter]
enabled = true
filter = fail2banfilter
action  = iptables-allports[name=f2bfilter, protocol=tcp]
logpath = /var/log/fail2ban.log
maxretry = 3
findtime = 21600
bantime  = 86400

To enable this, we need to create a file called fail2banfilter.conf (make sure that this matches what you write above in the filter parameter).

# /etc/fail2ban/filter.d/fail2banfilter.conf
[Definition]
failregex = WARNING .* Ban <HOST>

Resources

• http://www.fail2ban.org/wiki/index.php/Main_Page