1

Well as simple as the question sounds but on the internet isn't anything which would help me here. Anyone know a good resource on the subject? Or maybe someone would like to describe the process here? I have a feeling this is much easier than what I'm going through due to the lack of information.

I as a beginner, along many others I guess, would be interested in specific steps I should take in order to install and configure + specific JAILS I should have, and also I wonder why not activating all the jails, can this somehow damage my server?

Thank you very much to those who will take the time to help me here!

Improve this question
1

2 Answers 2

Reset to default
1

This seems like a good guide (it's in my browser history so I assume I've used it in the past).

Fail2ban is actually quite straightforward. It's mostly making sure you whitelist your LAN network (so you don't lock yourself out), enabling which ever of the built-in jails you want and tweaking the ban time and retry count. It's fairly trivial to write your own jails but the built-in ones will cover you for 90% of use cases.

Whitelist the address of any machine you are likely to be connecting to it from. So if you are on the same network, and your server is 192.168.1.1 and your PC is 192.168.1.2, whitelist the entire 192.168.1.0 subnet with the 192.168.1.0/24 notation. If you are logging into it remotely and you have a static IP address at home/work, whitelist that IP address. If you are on a dynamic connection, you might want to whitelist your entire ISP's subnet, but not recommended.

Improve this answer
6
  • LAN's network IP is this one: 127.0.0.1 ? Also, should I whitelist server's IP address?
    – Knowledge Knight
    Feb 28, 2017 at 12:33
  • @KnowledgeKnight No, that's the loopback address. Where are you getting that from? It's impossible that that is your LAN network IP. It's most likely to be something like 192.168.0.0.
    – Darren
    Feb 28, 2017 at 13:05
  • Is LAN network IP the same as web server's IP? Like the one I use to sign in to the root, for example (say ssh [email protected])? If not how do I find out what my server's LAN IP?
    – Knowledge Knight
    Feb 28, 2017 at 14:41
  • I was coming at this under the assumption that your server is local, is it remote (like cloud hosted or something)? Basically, whit list the address of any machine you are likely to be connecting to it from. So if you are on the same network, and your server is 192.168.1.1 and your PC is 192.168.1.2, whitelist the entire 192.168.1.0 subnet with the 192.168.1.0/24 notation. If you are logging into it remotely and you have a static IP address at home/work, whitelist that IP address. If you are on a dynamic connection, you might want to whitelist your entire ISP's subnet, but not recommended.
    – Darren
    Feb 28, 2017 at 14:46
  • Yes, it's cloud hosted and it has it's own static IP address, as well as I have a completely different IP address. Should I whitelist both of them? Although I don't see the logic of whitelisting it's own IP. Like it isn't going out and in again by itself to have to pass through the firewall. I might be wrong, I'm just getting started on this. Thank you so far Darren!
    – Knowledge Knight
    Feb 28, 2017 at 15:02
0

The process really is straightforward, but do note than jails looking for non-existent log sources (e.g. files) can cause fail2ban to not start.

I don't know the details on ubuntu, but for centos, I would do:

  • pick my firewall (which would end up being firewalld, because that is the CentOS7 default)
  • install fail2ban and the correct firewall bindings
  • start fail2ban, and ensure it works (by default, it will have the SSH jail active).
  • think about what you need next

One thing you might consider is simply extending the block put in place by the SSH jail, to completely block any offending source (i.e. don't just have it block port 22, but all traffic).

If you do find you need other jails and/or filters, I would:

  • use /etc/fail2ban/jail.d to store my jail configs, in order to ensure I can remove anything causing issues without needing to go through a large config file
  • make sure you test new jails, notably by not using them for SSH initially, and ensuring they apply only to the services whose logs the jail is monitoring.

I have a small example in ansible online, see https://github.com/iwaseatenbyagrue/ansible/blob/master/roles/fail2ban/tasks/suricata.yml and https://github.com/iwaseatenbyagrue/ansible/blob/master/roles/fail2ban/templates/ (e.g. https://github.com/iwaseatenbyagrue/ansible/blob/master/roles/fail2ban/templates/jail.suricata.j2)

The overall code isn't necessarily ship shape just yet, so I can't recommend you use it (at least not without being 100% certain you understand it all), but hopefully those snippets are of some use.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .