Oct 4th, 2011
Fail2ban 0.8
Fail2ban 0.8
Brute-force break-in attempts are quite frequent against an SSH server and other password protected internet-services (such as ftp,pop,…). Automated scripts try multiple combinations of username/password (brute-force, dictionary attack) and sometimes changing the port to something other than the default can’t be done. Furthermore, scouring your log files yourself is not only time consuming, but can be difficult too.
Fail2ban attempts to alleviate these issues by providing an automated way of not only identifying possible break-in attempts, but acting upon them quickly and easily in a user-definable manner.
Log files contain interesting information, especially about failed logins. This information can be used to ban an offensive host. This is exactly what Fail2ban does. It scans log files and detects patterns which correspond to possible breakin attempts and then performs actions. Most of the time, it consists of adding a new rule in a firewall chain and sending an e-mail notification to the system administrator.
Here is a list of the most important features available in Fail2ban:
client/server
multithreaded
Gamin support
autodetection of the date/time format
wildcard support in logpath option
support for a lot of services (sshd, apache, qmail, proftpd, sasl, asterisk, etc)
support for several actions (iptables, tcp-wrapper, shorewall, mail notifications, etc)
