fail2ban config

6 years ago Ralf un-tested

Create a fail2ban Configfile and restart the fail2ban-service. You should run the script as root.

bash

cd /etc/fail2ban

printf '%s\n' \
		'[INCLUDES]' \
		'before = paths-debian.conf' \
		'' \
		'[DEFAULT]' \
		'ignorecommand =' \
		'bantime = 2678400' \
		'findtime = 600' \
		'maxretry = 5' \
		'backend = auto' \
		'usedns = warn' \
		'logencoding = auto' \
		'enabled = false' \
		'filter = %(__name__)s[mode=%(mode)s]' \
		'destemail = root@localhost' \
		'sender = root@<fq-hostname>' \
		'mta = sendmail' \
		'protocol = tcp' \
		'chain = <known/chain>' \
		'port = 0:65535' \
		'fail2ban_agent = Fail2Ban/%(fail2ban_version)s' \
		'banaction = iptables-multiport' \
		'banaction_allports = iptables-allports' \
		'action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]' \
		'action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]' \
		'            %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]' \
		'action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]' \
		'             %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]' \
		'action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]' \
		'             xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]' \
		'action_blocklist_de = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"]' \
		'action_badips = badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"]' \
		'action_badips_report = badips[category="%(__name__)s", agent="%(fail2ban_agent)s"]' \
		'action_abuseipdb = abuseipdb' \
		'action = %(action_)s' \
		'' \
		'[sshd]' \
		'enable = true' \
		'port = ssh' \
		'filter = sshd' \
		'logpath = %(sshd_log)s' \
		'backend = %(sshd_backend)s' \
		'maxentry = 4' \
		'' \
		'[sshd-ddos]' \
		'enable = true' \
		'port = ssh' \
		'logpath = %(sshd_log)s' \
		'backend = %(sshd_backend)s' \
		'' \
		'[nginx-http-auth]' \
		'enabled = true' \
		'filter = nginx-http-auth' \
		'port = http,https' \
		'logpath = %(nginx_error_log)s' \
		'' \
		'[nginx-badbots]' \
		'enabled = true' \
		'port = http,https' \
		'filter = nginx-badbots' \
		'logpath = %(nginx_access_log)s' \
		'maxretry = 2' \
		'' \
		'[nginx-limit-req]' \
		'enabled = true' \
		'port = http,https' \
		'filter = nginx-req-limit' \
		'action = iptables-multiport[name=ReqLimit, port="http,https", protocol=tcp]' \
		'logpath = %(nginx_error_log)s' \
		'findtime = 600' \
		'maxretry = 10' \
		'' \
		'[nginx-botsearch]' \
		'enabled = true' \
		'port = http,https' \
		'logpath = %(nginx_error_log)s' \
		'maxretry = 2' \
		> jail.local
		
service fail2ban reload

Comments

No comments yet.