How to install and configure fail2ban

[Milka]

I noticed an entry "How to install and configure fail2ban" in the documentation section (http://vestacp.com/docs/) but there was no documentation (yet) on this subject. Maybe some readers are not familiar with this at all, so I decided to share a simple installation instruction for fail2ban on CentOS to enable you to get some basic protection.

(I'm assuming you know how to use basic commands like insert and :wq to use vi, but google that first if you don't)

1. Connect to your server as root via SSH

Code: Select all

ssh [email protected]

2. Because fail2ban is not available by default, we'll need to download the EPEL repository:

Code: Select all

rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

3. Install fail2ban

Code: Select all

yum install fail2ban

4. The default fail2ban config file can be found at /etc/fail2ban/jail.conf. We're creating a copy, and fail2ban will use your configuration changes from that new file.

Code: Select all

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

5. Now open your new fail2ban configuration file:

Code: Select all

vi /etc/fail2ban/jail.local

Attention: You'll want to enter your personal/office ip address at the ignoreip line, to prevent locking yourself out.
You might also want to change the ban time (how long to block an IP - in seconds), maxretry (number of incorrect login attempts before blocking the IP) and the findtime (if someone attempts and fails the maxretry number of times in the specified findtime they get blocked)

6. Edit the desired sections. For instance:

Code: Select all

[ssh-iptables]
enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]
           sendmail-whois[name=SSH, [email protected], [email protected]]
logpath  = /var/log/secure
maxretry = 5

7. Restart fail2ban.

Code: Select all

service fail2ban restart

8. Now, you probably want to start this on reboot; so enter:

Code: Select all

chkconfig fail2ban on

9. See your rules list:

Code: Select all

iptables -L -n

Note: there's more to do in order to protect your server, but this is a nice place to start... Anyone feel free to add to this post.

[skid]

This is a great howto, thanks. I'm going to publish on the documentation page.

[Milka]

Cool! Will fail2ban be integrated into the VestaCP install?

[skid]

Not decided yet. It depends on the firewall project which is not started as for now.