8

We are using fail2ban on our web-facing servers to block IP addresses that repeatedly fail to authenticate properly. Our normal bantime hereby is one hour; IPs that have already been banned multiple times are blocked for a day using the recidive jail included in the fail2ban example config.

This block duration of one day was chosen in order not to affect dynamic IPs too much, especially considering the recursive jail does not block specific ports, but all incoming connections. However, we would like to ban very persistent attackers for a longer period of time. Currently, this is achieved by a custom super-recidive filter and jail. This jail blocks for a whole week every host which has been banned by recidive twice (this IP is obviously not dynamically assigned).

Ideally however, I would like to ban for a week every IP which has been banned by recidive in the past (say, one week) and which after being unbanned is banned again by whatever jail. I know something like this must be possible with a complex failregex including backreferences - but is there a more elegant way to do this?

0

I suggest looking in to a more robust Web Application Firewall, like NGINX. You can pass repeat offenders to your NGINX blacklist where there could be a different set of rules for how long an offender is blocked.

EXAMPLE: https://www.nginx.com/blog/dynamic-ip-blacklisting-with-nginx-plus-and-fail2ban/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.