1

My auth.log is littered with connection attempts from nasty zombies. It is really annoying. And the server doesn't even permit password logins. What I would like to do is set up fail2ban to only permit connection attempts from a specified whitelist. How would I go about this? I am guessing that this might in fact not be a job for fail2ban, if so, how would I set this up anyway, on an ubuntu server?

Improve this question

2 Answers 2

Reset to default
2

fail2ban just updates your firewall rules ("Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured.").

It would be better to just configure your firewall manually to only allow connections to applications like SSH from certain IP addresses instead of the rule it's set to currently.

You mention Ubuntu so try reading about ufw - Uncomplicated Firewall (where the quickstart guide point #6, shows exactly the scenario you are looking to solve) other distibutions of Linux likely rely on iptables and there are other questions to achieve it with iptables.

Improve this answer
1

Have you tried setting your jail to maxretry = 0?

It will ban the user from the first login attempt (good or bad) so basically will only allow whitelisted users.

Improve this answer
1
  • I wrote this ages ago - not sure if your advice will help but sounds useful to know. Thanks for the input
    – Jonathan
    Nov 13, 2018 at 0:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .