2

Basic question.

How can I install an upgraded version of Fail2Ban on my Ubuntu 12.04.5 LTS (Precise Pangolin) so I can have a recidive filter set. Ubuntu 12.04.5 LTS installs Fail2Ban 0.8.6 and I need Fail2Ban 0.8.7 to use the recidive filter.

More details.

I manage a bunch of Ubuntu 12.04.5 LTS (Precise Pangolin) servers and have installed Fail2Ban specifically to block repeated SSH brute force attempts. These attacks are targeted at root and the root user is disabled on all of these systems, but I just want to add another layer of protection to my mix as well as cut down on the added “noise” of having to sift through failed login attempts in my SSH auth.log.

Anyway, the version of Fail2Ban—version 0.8.6—that is installed for Ubuntu 12.04.5 LTS from the default repositories works great for the most part. But it seems to be missing support for blocking repeat offenders. And these servers are definitely getting a lot of persistent brute force attempts. So I want to make sure that these clowns are blocked for a longer time.

I checked this blog post titled, “Permanently Ban Repeat Offenders With fail2ban (UPDATED)” and it recommends using the recidive filter. The rest of that post shows how to set up a customized equivalent of recidive but I don’t have any desire to use a custom solution if a built in solution such as recidive exists.

But when I attempt to set the recidive filter in Fail2Ban 0.8.6 and restart the service, it fails saying the filter recidive doesn’t exist.

When I check the Fail2Ban changelog on GitHub I can see that recidive support was added around version 0.8.7:

Tom Hendrikx
 * [f94a121..] 'recidive' filter/jail to monitor fail2ban.conf to ban
   repeated offenders. Close gh-19

Well, isn’t that special. I’m using 0.8.6 and version 0.8.7 has support for this.

So how can I easily install anything newer than Fail2Ban 0.8.6 on Ubuntu 12.04.5 LTS? I tried to install version 0.9.3 by cloning the GitHub repository, switching to the Debian branch (since Ubuntu is Debian-based) and it seemed to work. But the startup service didn’t work and it also seems like that 0.9.3 won’t work with the version of IPTables I have installed in Ubuntu 12.04.5 LTS unless I tweak some config files or possibly upgrade IPTables itself.

Maybe there’s a way to tweak it all to work for Ubuntu 12.04.5 LTS but I don’t have the time or will to deal with that since all I want is recidive support and don’t care about anything else. What can I do?

2 Answers 2

1

After getting frustrated attempting to install Fail2Ban 0.9.3 from source, I searched for a custom PPA and found none. But then stumbled across the the official Ubuntu package page for Fail2Ban and it gave me an idea. The official Ubuntu 14.10 (Utopic Unicorn) package for Fail2Ban is at version 0.8.13. Why not install that?

So I got rid of the Ubuntu 12.04.5 install of Fail2Ban like this:

sudo aptitude purge fail2ban

Then I installed some Fail2Ban dependencies manually like this:

sudo aptitude install gamin libgamin0 python-central python-gamin python-support

With that done, I grabbed the raw, source Ubuntu .deb archive for Fail2Ban 0.8.13 like this:

curl -O -L http://old-releases.ubuntu.com/ubuntu/pool/universe/f/fail2ban/fail2ban_0.8.13-1_all.deb

And then I installed it with dpkg like this:

sudo dpkg -i fail2ban_0.8.13-1_all.deb

When that was done, I checked the version of the stuff installed like this:

fail2ban-client --version

And it worked!

Fail2Ban v0.8.13

Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors
Copyright of modifications held by their respective authors.
Licensed under the GNU General Public License v2 (GPL).

Written by Cyril Jaquier <[email protected]>.
Many contributions by Yaroslav O. Halchenko <[email protected]>.

With Fail2Ban 0.8.13, I can now add a recidive filter to /etc/fail2ban/jail.local and everything works as expected.

NOTE: Please note, that while this all seems to work—and since this is a self-answered question—if anyone out there believes or suspects that this kind of setup of installing an Ubuntu 14.10 package into Ubuntu 12.04.5 is a problem waiting to happen, please let me know. Since Fail2Ban is all Python-based and it seems to work as expected now, I suspect this package was lightweight enough not to run into any problems. But let me know if my assumption is incorrect.

0

I had a similar issue. Am on Ubu 14.04.05 64-bit with the repo version Fail2ban v0.8.11.

Wanted v0.8.14, which is listed as "very-stable" on the main Fail2ban website.

Turns out you can just download the later version and run its setup.py to overwrite v0.8.11. There is no need to remove (uninstall) v0.8.11 nor do you need to install other dependencies. However, there's one gotcha which I will describe below.

Anyway here's my solution:

Install Fail2ban from repo, if you have not already done so

apt-get update && apt-get upgrade -y
apt-get install build-essential -y
apt-get install fail2ban

Check the Fail2ban version, then stop it

fail2ban-client --version
fail2ban-client stop

Download v0.8.14 from Github, untar

wget https://github.com/fail2ban/fail2ban/archive/0.8.14.tar.gz
tar -xzf 0.8.14.*

IMPORTANT, DO NOT SKIP THIS: Copy the current fail2ban.conf and jail.conf from /etc/fail2ban to somewhere safe. Create a new folder if needed. Don't worry about jail.local.

cp /etc/fail2ban/fail2ban.conf SOME_OTHER_FOLDER
cp /etc/fail2ban/jail.conf SOME_OTHER_FOLDER

Run the setup.py for v0.8.14

cd fail2ban-0.8.14
python setup.py install

Move the two .conf files you copied earlier back into /etc/fail2ban, overwriting the ones created by the v0.8.14 setup.

mv SOME_OTHER_FOLDER/fail2ban.conf /etc/fail2ban 
mv SOME_OTHER_FOLDER/jail.conf /etc/fail2ban 

Start fail2ban, check version

fail2ban-client start
fail2ban-client --version

As we did not do a "remove" of Fail2ban, there is no need to mess with the init or startup scripts; Fail2ban will still launch on reboot.

The backing up of .conf files is important because the v0.8.14 setup.py may generate invalid .conf files which will cause Fail2ban not to run. (It will likely quit with a "Have not found any log file" error)

1
  • Sorry, but this is a self-answered question I posted specific to Ubuntu 12.04.5; your solution is for Ubuntu 14.0405. That said, your answer has decent details so I would suggest you should similarly post a self-answered question that maybe even refers to this one. Sep 20, 2017 at 0:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .