Fail2ban is an intrusion prevention system (IPS), it analyses the logs of programmes such as SSH, Web or mail servers and configures the firewall to block IP addresses exhibiting inappropriate behaviour. Its strength lies in its flexibility.
In this article, I introduce Fail2ban and its benefits, but I do not explain how to install it. If you wish to install it on OpenBSD, I have written an article detailing how to do so.

How does it work?

In Fail2ban, there are three interesting components:

  1. Actions. An action allows you to choose what to do when undesirable behaviour is detected. For example, there is an action for iptables, the firewall used on Linux, and another for pf, the OpenBSD firewall. You simply choose the action that suits your system.
  2. Filters. A filter is a detection mechanism based on regular expressions. If an IP address is detected by a filter in the logs, it can be blocked.
  3. The jail.local configuration file. In this file, you specify which filters to enable, and for each filter, how many times it must detect something before the IP address associated with the logs is blocked, and for how long.

A few examples

On OpenBSD, the pf command is used to manage the firewall.

Block login attempts to OpenSSH

Let’s imagine I have an OpenSSH server exposed to the internet so I can connect remotely. Looking at the logs, I quickly realise that there are numerous unsuccessful connection attempts coming from all over the world.
If I’ve set things up correctly, password-based login is disabled, as is logging in as root (the administrator). Furthermore, OpenSSH now includes security features that limit the number of attempts to prevent brute-force attacks (repeated attempts until the password is found).

Despite all this, it clutters up the logs, and since the IP addresses behind these connection attempts are unwelcome, I prefer to block them. With Fail2ban, it’s very simple:

# jail.local configuration file
[sshd]
bantime = 1d
bantime.increment = true
enabled = true
filter = sshd_openbsd
findtime = 1h
logpath = /var/log/authlog
maxretry = 10

The configuration snippet above enables the filter that analyses OpenSSH logs on OpenBSD. If 10 connection attempts are received within 1 hour from the same IP address, that IP address is blocked for 1 day.
Once unblocked, if it makes a further 10 attempts within one hour, it will be blocked for 2 days. The next time, for 4 days, and so on.

Limiting misuse of the contact form

There’s a contact form on this website. Like everyone else, I hate CAPTCHAs, so I’ve decided not to subject my visitors to them. That said, it’s important to protect myself against bots and clever clogs who might try to spam me, so I’ve set up my own Fail2ban filter.

# jail.local configuration file
[httpd-abosec-send-contact]
bantime = 10d
bantime.increment = true
enabled = true
filter = httpd_forwarded_abosec_contact
findtime = 1h
logpath = /var/www/logs/access.log
maxretry = 10

If the form is submitted 10 times in one hour, the IP address is blocked for 10 days and will no longer be able to access the website at all. If the same IP address attempts to submit the form again once the block has been lifted, it will be blocked for 20 days, and so on. This does not in any way prevent a legitimate visitor who wishes to contact me from doing so, however, it does prevent me from being inundated with emails.

Do you want to secure your servers but don’t have the time to set it all up? Find out more about my OpenBSD security and managed hosting services .