Lesson 2 of 3 in The Ones Who Come Back · 2 min left in this chapter

Ban Them

fail2ban is a program that reads the log you just learned to read, and acts on it: too many failures from one address in a short window, and that address is blocked at the firewall. You write the rule once, and the door closes itself from then on.

2 min read

Not yet reviewed

Wrenlearner

So I sit and watch the log and block addresses by hand?

Rookmentor

You would last a day. fail2ban does the watching. You tell it the rule — how many failures, in how long, banned for how long — and it reads the log and enforces it every second, forever.

A jail is a rule about a log

fail2ban's unit is a jail: a filter that recognises a failure in a log, and an action that runs when one address trips it too often. The SSH jail watches the auth log for Failed password, and when one address fails enough times inside the window, it adds a firewall rule dropping that address entirely.

1[sshd]
2enabled  = true
3maxretry = 5           # five failures...
4findtime = 10m         # ...within ten minutes...
5bantime  = 1h          # ...and you are blocked for an hour

Line 3The three numbers are the whole policy. Loose enough that a real person fat-fingering their key a few times is fine; tight enough that a machine trying thousands of times is gone almost immediately.
Line 5An hour is enough to make brute force pointless: at five tries per ban, guessing anything is now measured in centuries. The attacker moves on to an easier box, which is the entire goal.

The most-missed setting is not on this list: enable a jail for every service that faces the internet, not just SSH. A mail server, a web login, a database admin panel — each writes failures to a log, and each deserves a jail. Attackers do not only knock on port 22, and a jail that only watches SSH leaves every other door un-watched.

Your turn

Here is a fail2ban jail file with SSH set up but disabled. Turn the sshd jail on: append a line so the file contains enabled = true.

you@practice

Practice shell — nothing here is real. Type 'help' to begin.

Command input, prompt you@lab:~$

fail2ban bans an address for an hour. The attacker is using tens of thousands of addresses. Does the ban even matter, if they just switch?