Lesson 3 of 3 in The Ones Who Come Back
The Ones Who Keep Coming Back
A one-hour ban is forgotten by tomorrow, and the persistent attacker knows it. The recidive jail watches fail2ban's own log — the record of who has already been banned — and bans the repeat offenders for weeks. Almost nobody turns it on, and it is where most of the value is.
2 min read
Not yet reviewed
Your hour ban is cute. I wait it out, or I come back tomorrow from a new address, and again the day after. Persistence is the whole job.
Which is why there is a jail that watches the bans themselves. Get banned again and again, and something notices the pattern *across* the bans — and puts you away for a month.
A jail that watches the jailer
Every time fail2ban bans an address, it writes that to its own log. The recidive jail — from the word for a repeat offender — reads *that* log. Its filter is not "failed a password"; it is "has been banned before". An address that keeps earning short bans trips the recidive jail, and it hands out a ban measured in weeks, not hours.
The sshd jail alone
Fail 5 times -> banned 1 hour.
Come back tomorrow -> banned 1 hour again.
Forever, one hour at a time.With recidive watching
Earn a few short bans...
...and recidive bans you for a week.
The persistent attacker is the one it catches.The base jail handles the noise — the sprayed, one-shot attempts. The recidive jail handles the *threat* — the address that keeps coming back, which is the one actually trying to get into your box specifically. They are different attackers, and it takes both jails to answer both.
This is the detection beat, and it is subtle: the recidive jail does not watch for an attack, it watches for a *pattern of your own responses*. That is what detection usually is — not spotting the single bad event, which you may miss, but noticing the shape that many events make together. "Banned four times this week" is a signal no single failed login could give you.
The recidive jail is off by default and almost nobody enables it. If the sshd jail already bans attackers, why is recidive "where most of the value is"?
Enable the recidive jail so the persistent get long bans. Append a line to this file so it contains [recidive] followed later by the enable. For the grader, make the file contain bantime = 1w.