Passioni › Informatica › Linux

Intrusion Prevention con Fail2Ban

1. Installazione

apt install -y fail2ban
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

2. Configurazione SSH

[DEFAULT]
bantime  = 3600
findtime = 600
maxretry = 5
banaction = ufw

[sshd]
enabled = true
port    = ssh
logpath = /var/log/auth.log
maxretry = 3

3. Jail per Apache

[apache-auth]
enabled  = true
port     = http,https
logpath  = /var/log/apache2/*error.log
maxretry = 5

[apache-badbots]
enabled  = true
logpath  = /var/log/apache2/*access.log
maxretry = 2

4. Monitoraggio

fail2ban-client status
fail2ban-client status sshd
fail2ban-client set sshd unbanip 203.0.113.50

5. Ban permanente per recidivi

[recidive]
enabled  = true
logpath  = /var/log/fail2ban.log
bantime  = 604800
maxretry = 3

Risultato: Protezione automatica contro brute-force su SSH, web server e servizi.