Jump to content

Fail2ban: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous edit
Content deleted Content added
VisualWikitext
Jjxtra (talk | contribs)
6 edits
m Denote IPBan also supports Linux and link to the github page
m →Functionality: Correct link
 
(18 intermediate revisions by 15 users not shown)
Line 1: Line 1:
{{short description|Intrusion prevention software framework that protects computer servers from brute-force attacks}}
{{short description|Intrusion prevention software framework}}
{{Infobox software
{{Infobox software
| name = Fail2ban
| title = Fail2Ban
| name = Fail2Ban
| logo = Fail2ban logo.png
| logo = Fail2ban logo.png
| logo size = 200px
| screenshot = Fail2ban screenshot.jpg
| caption =
| logo alt =
| logo caption =
| screenshot =
| screenshot size =
| screenshot alt =
| caption =
| collapsible =
| author = Cyril Jaquier
| author = Cyril Jaquier
| developer =
| developer = Cyril Jaquier, Yaroslav Halchenko, Daniel Black, Steven Hiscocks, Arturo 'Buanzo' Busleiman, and the Fail2Ban community
| released = {{Start date and age|2004}}
| released = {{Start date and age|2004|10|07}}
| discontinued =
| latest release version = {{wikidata|property|reference|P348}}
| latest release date = {{start date and age|{{wikidata|qualifier|P348|P577}}}}
| latest preview version =
| latest preview date =
| programming language = [[Python (programming language)|Python]]
| platform = [[POSIX]]
| size =
| language =
| language count =
| language footnote =
| genre = [[Intrusion prevention]]
| genre = [[Intrusion prevention]]
| license = [[GPL]]v2+
| license = [[GNU GPLv2|GNU GPL]] v2
| language = Python
| alexa =
| standard =
| website = {{official url}} (not updated in several years)
| AsOf =
| latest_release_version = 0.11.2
| latest_release_date = {{Start date and age|2020|11|23}}<ref>{{cite web|url=https://github.com/fail2ban/fail2ban/releases|title=Releases · fail2ban|date=26 May 2021|publisher=|via=[[GitHub]]}}</ref>
| operating_system = [[Unix-like]]
}}
}}


⚫
'''Fail2Ban''' is an [[intrusion prevention system|intrusion prevention]] software framework. Written in the [[Python (programming language)|Python]] programming language, it is designed to prevent [[brute-force attack]]s.<ref name="LJInfo">{{Cite web|url=https://www.linuxjournal.com/content/server-hardening|title=Server Hardening {{!}} Linux Journal|last=Bledsoe|first=Greg|date=2016-01-14|website=[[Linux Journal]]|language=en|archive-url=|archive-date=|access-date=2018-09-22}}</ref> It is able to run on [[POSIX]] systems that have an interface to a packet-control system or firewall installed locally, such as [[iptables]] or [[TCP Wrapper]].<ref name="FSMInfo">{{Cite web|url=http://freesoftwaremagazine.com/articles/how_to_protect_your_linux_computer_from_remote_attacks_with_fail2ban/|title=How to protect your GNU/Linux computer from remote attacks with Fail2ban|last=Jordan|first=Jeff|date=2015-06-16|website=[[Free Software Magazine]]|language=en|archive-url=|archive-date=|access-date=2018-09-22}}</ref>
'''Fail2ban''' is an [[intrusion prevention system|intrusion prevention software]] framework that protects computer servers from [[brute-force attack]]s.<ref>{{cite web
|author=serverwatch.com
|url=http://www.serverwatch.com/tutorials/article.php/3626541
|title=Tip of the Trade: Fail2Ban
⚫
|date=2006-08-15}}</ref><ref name=":0">{{Cite web|url=https://www.linuxjournal.com/content/server-hardening|title=Server Hardening {{!}} Linux Journal|last=Bledsoe|first=Greg|date=2016-01-14|website=[[Linux Journal]]|language=en|archive-url=|archive-date=|access-date=2018-09-22}}</ref> Written in the [[Python (programming language)|Python]] programming language, it is able to run on [[POSIX]] systems that have an interface to a packet-control system or firewall installed locally, for example, [[iptables]] or [[TCP Wrapper]].<ref>{{Cite web|url=http://freesoftwaremagazine.com/articles/how_to_protect_your_linux_computer_from_remote_attacks_with_fail2ban/|title=How to protect your GNU/Linux computer from remote attacks with Fail2ban|last=Jordan|first=Jeff|date=2015-06-16|website=[[Free Software Magazine]]|language=en|archive-url=|archive-date=|access-date=2018-09-22}}</ref>


==Functionality==
==Functionality==
[[File:Fail2ban screenshot.jpg|thumb|left|A screenshot of Fail2Ban, demonstrating its ability to ban IP addresses]]
Fail2ban operates by monitoring [[Computer data logging|log files]] (e.g. {{mono|/var/log/auth.log}}, {{mono|/var/log/apache/access.log}}, etc.) for selected entries and running scripts based on them.<ref>{{Cite news|url=https://securityintelligence.com/defending-against-apache-web-server-ddos-attacks/|title=Defending Against Apache Web Server DDoS Attacks|last=Van Impe|first=Koen|date=2015-12-09|work=[[IBM]]'s Security Intelligence|access-date=2018-09-22|language=en-US}}</ref> Most commonly this is used to block selected [[IP address]]es that may belong to [[Host (network)|hosts]] that are trying to breach the system's security. It can ban any host IP address that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator. Includes support for both IPv4 and IPv6.<ref>{{Cite web|url=https://github.com/fail2ban/fail2ban/releases/tag/0.10.0|title=0.10.0 (2017/08/09) - long-awaited 0.10th version|last=G. Brester|first=Sergey|date=2017-08-09|website=[[GitHub]]|language=en|archive-url=|archive-date=|access-date=2018-09-22}}</ref><ref>{{Cite news|url=https://www.ctrl.blog/entry/fail2ban-ipv6|title=IPv6 support finally arrive in Fail2Ban 0.10|last=Aleksandersen|first=Daniel|date=2016-05-31|work=Ctrl blog|access-date=2018-09-22|language=en}}</ref> Optionally longer bans can be custom-configure for "recidivist" abusers that keep coming back.<ref name=":0" /> Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being [[Denial-of-service attack|flooded]] by malicious connections, as well as reducing the likelihood of a successful [[dictionary attack]].
Fail2ban operates by monitoring [[Computer data logging|log files]] (e.g. {{mono|/var/log/auth.log}}, {{mono|/var/log/apache/access.log}}, etc.) for selected entries and running scripts based on them.<ref name="IBMSIInfo">{{Cite news|url=https://securityintelligence.com/defending-against-apache-web-server-ddos-attacks/|title=Defending Against Apache Web Server DDoS Attacks|last=Van Impe|first=Koen|date=2015-12-09|work=[[IBM]]'s Security Intelligence|access-date=2018-09-22|language=en-US}}</ref> Most commonly this is used to block selected [[IP address]]es that may belong to [[Host (network)|hosts]] that are trying to breach the system's security. It can ban any host IP address that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator. It includes support for both IPv4 and IPv6.<ref>{{Cite web|url=https://github.com/fail2ban/fail2ban/releases/tag/0.10.0|title=0.10.0 (2017/08/09) - long-awaited 0.10th version|last=G. Brester|first=Sergey|date=2017-08-09|website=[[GitHub]]|language=en|archive-url=|archive-date=|access-date=2018-09-22}}</ref><ref>{{Cite news|url=https://www.ctrl.blog/entry/fail2ban-ipv6|title=IPv6 support finally arrive in Fail2Ban 0.10|last=Aleksandersen|first=Daniel|date=2016-05-31|work=Ctrl blog|access-date=2018-09-22|language=en}}</ref> Optionally longer bans can be custom-configured for "recidivist" abusers that keep coming back.<ref name="LJInfo" /> Fail2Ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being [[Denial-of-service attack|flooded]] by malicious connections, as well as reducing the likelihood of a successful [[dictionary attack]].


Fail2ban can perform multiple actions whenever an abusive IP address is detected:<ref>{{cite web
Fail2Ban can perform multiple actions whenever an abusive IP address is detected:<ref>{{cite web
|author=ducea.com
|author=ducea.com
|url=http://www.ducea.com/2006/07/03/using-fail2ban-to-block-brute-force-attacks/
|url=http://www.ducea.com/2006/07/03/using-fail2ban-to-block-brute-force-attacks/
|title=Using Fail2Ban to Block Brute Force Attacks
|title=Using Fail2Ban to Block Brute Force Attacks
|date=2006-07-03}}</ref> update [[Netfilter/iptables]] or [[PF (firewall)|PF]] firewall rules, [[TCP Wrapper]]'s {{mono|hosts.deny}} table, to reject an abuser's IP address; email notifications; or any user-defined action that can be carried out by a Python script.
|date=2006-07-03}}</ref> update [[Netfilter]]/[[iptables]] or [[PF (firewall)|PF]] firewall rules, [[TCP Wrapper]]'s {{mono|hosts.deny}} table, to reject an abuser's IP address; email notifications; or any user-defined action that can be carried out by a [[Python (programming language)|Python]] script.


The standard configuration ships with filters for [[Apache HTTP Server|Apache]], [[Lighttpd]], [[Secure Shell|sshd]], [[vsftpd]], [[qmail]], [[Postfix (software)|Postfix]] and [[Courier Mail Server]].<ref>{{cite web
The standard configuration ships with popular filters, including [[Apache HTTP Server|Apache]], [[Lighttpd]], [[Secure Shell|sshd]], [[vsftpd]], [[qmail]], [[Postfix (software)|Postfix]] and [[Courier Mail Server]].<ref>{{cite web
|url=https://github.com/fail2ban/fail2ban/tree/master/config/filter.d
|author=fail2ban.org
|url=http://www.fail2ban.org/wiki/index.php/Features
|title=fail2ban/config/filter.d
|title=Features - Fail2Ban}}</ref><ref>{{Cite news|url=https://www.techrepublic.com/article/how-to-protect-secure-shell-on-centos-7-with-fail2ban/|title=How to protect secure shell on CentOS 7 with Fail2ban|last=Wallen|first=Jack|date=2016-12-23|work=[[TechRepublic]]|access-date=2018-09-22|language=en}}</ref> Filters are defined by Python [[regular expressions|regexes]], which may be conveniently customized by an administrator familiar with regular expressions.<ref name=":0" /> A combination of a filter and an action is known as a "jail" and is what causes a malicious host to be blocked from accessing specified network services.<ref name=":0" /> As well as the examples that are distributed with the software, a "jail" may be created for any network-facing process that creates a log file of access.<ref>{{Cite news|url=https://searchdatacenter.techtarget.com/tip/Three-server-security-tools-you-might-not-know|title=Three server security tools you might not know|last=Casey|first=Brad|date=2016-02-17|work=[[TechTarget]]|access-date=2018-09-22|language=en-US}}</ref>
|website=[[GitHub]]}}</ref><ref>{{Cite news|url=https://www.techrepublic.com/article/how-to-protect-secure-shell-on-centos-7-with-fail2ban/|title=How to protect secure shell on CentOS 7 with Fail2ban|last=Wallen|first=Jack|date=2016-12-23|work=[[TechRepublic]]|access-date=2018-09-22|language=en}}</ref> Filters are defined by Python [[regular expressions|regexes]], which may be conveniently customized by an administrator familiar with regular expressions.<ref name="LJInfo" /> A combination of a filter and an action is known as a "jail" and is what causes a malicious host to be blocked from accessing specified network services.<ref name="LJInfo" /> As well as the examples that are distributed with the software, a "jail" may be created for any network-facing process that creates a log file of access.<ref>{{Cite news |last=Casey |first=Brad |date=2016-02-17 |title=Three server security tools you might not know |language=en-US |work=[[TechTarget]] |url=https://searchdatacenter.techtarget.com/tip/Three-server-security-tools-you-might-not-know |access-date=2018-09-22 |archive-url=https://web.archive.org/web/20160217072739/https://searchdatacenter.techtarget.com/tip/Three-server-security-tools-you-might-not-know |archive-date=2016-02-17}}</ref>


{{Quote|text=Fail2ban is similar to [[DenyHosts]] [...] but unlike DenyHosts which focuses on SSH, fail2ban can be configured to monitor any service that writes login attempts to a log file, and instead of using {{mono|/etc/hosts.deny}} only to block IP addresses/hosts, fail2ban can use Netfilter/iptables and TCP Wrappers {{mono|/etc/hosts.deny}}. |author=Falko Timme<ref>{{cite web |first=Falko |last=Timme |title=Preventing Brute Force Attacks With Fail2Ban On OpenSUSE 10.3 |date=2007-10-08 |url=http://www.howtoforge.com/fail2ban_opensuse10.3 |accessdate = 2007-11-14}}</ref>}}
{{Quote|text=Fail2ban is similar to [[DenyHosts]] [...] but unlike DenyHosts which focuses on SSH, fail2ban can be configured to monitor any service that writes login attempts to a log file, and instead of using {{mono|/etc/hosts.deny}} only to block IP addresses/hosts, fail2ban can use Netfilter/iptables and TCP Wrappers {{mono|/etc/hosts.deny}}. |author=Falko Timme<ref>{{cite web |first=Falko |last=Timme |title=Preventing Brute Force Attacks With Fail2Ban On OpenSUSE 10.3 |date=2007-10-08 |url=http://www.howtoforge.com/fail2ban_opensuse10.3 |accessdate = 2007-11-14}}</ref>}}


== Integrations ==
== Integrations ==
Fail2ban can be integrated with many [[API|APIs]], including blocklist.de and AbuseIPDB.<ref>{{cite web |title=Integrating AbuseIPDB with Fail2Ban |url=https://www.abuseipdb.com/fail2ban.html |website=AbuseIPDB |publisher=AbuseIPDB |access-date=31 August 2021}}</ref><ref>{{cite web |url=https://www.blocklist.de/en/index.html |website=Blocklist.de |access-date=31 August 2021}}</ref>
Fail2Ban can be integrated with many [[API|APIs]], including blocklist.de and AbuseIPDB.<ref>{{cite web |title=Integrating AbuseIPDB with Fail2Ban |url=https://www.abuseipdb.com/fail2ban.html |website=AbuseIPDB |access-date=31 August 2021}}</ref><ref>{{cite web |url=https://www.blocklist.de/en/index.html |website=Blocklist.de |access-date=31 August 2021|title=www.blocklist.de -- Fail2Ban-Reporting Service (we sent Reports from Attacks on Postfix, SSH, Apache-Attacks, Spambots, irc-Bots, Reg-Bots, DDos and more) from Fail2Ban via X-ARF }}</ref>


== Shortcomings ==
== Shortcomings ==
* Fail2ban fails to protect against a distributed brute-force attack. However, tools exist to distribute ban/unban events among servers using zmq.
* Fail2Ban fails to protect against a distributed brute-force attack. However, tools exist to distribute ban/unban events among servers using zmq.
* There is no interaction with application-specific [[Application programming interface|API]]s/AGIs.
* There is no interaction with application-specific [[Application programming interface|API]]s.


==See also==
==See also==
{{Portal|Free and open-source software}}
{{Portal|Free and open-source software}}
* [[[https://github.com/DigitalRuby/IPBan IPBan]]], a log-based intrusion-prevention security tool for Windows and Linux
* [[DenyHosts]], a log-based intrusion-prevention security tool
* [[DenyHosts]], a log-based intrusion-prevention security tool
* [[Stockade (software)|Stockade]], a rate-limiting approach to spam mitigation.
* [[Stockade (software)|Stockade]], a rate-limiting approach to spam mitigation.

Latest revision as of 16:41, 18 December 2024

Fail2Ban
Original author(s)Cyril Jaquier
Initial releaseOctober 7, 2004; 20 years ago (2004-10-07)
Stable release
1.1.0[1] / 25 April 2024; 7 months ago (25 April 2024)
Repository
Written inPython
PlatformPOSIX
TypeIntrusion prevention
LicenseGNU GPL v2
Websitewww.fail2ban.org Edit this on Wikidata

Fail2Ban is an intrusion prevention software framework. Written in the Python programming language, it is designed to prevent brute-force attacks.[2] It is able to run on POSIX systems that have an interface to a packet-control system or firewall installed locally, such as iptables or TCP Wrapper.[3]

Functionality

[edit]
A screenshot of Fail2Ban, demonstrating its ability to ban IP addresses

Fail2ban operates by monitoring log files (e.g. /var/log/auth.log, /var/log/apache/access.log, etc.) for selected entries and running scripts based on them.[4] Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP address that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator. It includes support for both IPv4 and IPv6.[5][6] Optionally longer bans can be custom-configured for "recidivist" abusers that keep coming back.[2] Fail2Ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.

Fail2Ban can perform multiple actions whenever an abusive IP address is detected:[7] update Netfilter/iptables or PF firewall rules, TCP Wrapper's hosts.deny table, to reject an abuser's IP address; email notifications; or any user-defined action that can be carried out by a Python script.

The standard configuration ships with popular filters, including Apache, Lighttpd, sshd, vsftpd, qmail, Postfix and Courier Mail Server.[8][9] Filters are defined by Python regexes, which may be conveniently customized by an administrator familiar with regular expressions.[2] A combination of a filter and an action is known as a "jail" and is what causes a malicious host to be blocked from accessing specified network services.[2] As well as the examples that are distributed with the software, a "jail" may be created for any network-facing process that creates a log file of access.[10]

Fail2ban is similar to DenyHosts [...] but unlike DenyHosts which focuses on SSH, fail2ban can be configured to monitor any service that writes login attempts to a log file, and instead of using /etc/hosts.deny only to block IP addresses/hosts, fail2ban can use Netfilter/iptables and TCP Wrappers /etc/hosts.deny.

— Falko Timme[11]

Integrations

[edit]

Fail2Ban can be integrated with many APIs, including blocklist.de and AbuseIPDB.[12][13]

Shortcomings

[edit]
  • Fail2Ban fails to protect against a distributed brute-force attack. However, tools exist to distribute ban/unban events among servers using zmq.
  • There is no interaction with application-specific APIs.

See also

[edit]
  • DenyHosts, a log-based intrusion-prevention security tool
  • Stockade, a rate-limiting approach to spam mitigation.
  • OSSEC, an open-source host-based intrusion-detection system.

References

[edit]
  1. ^ "Release 1.1.0". 25 April 2024. Retrieved 23 May 2024.
  2. ^ a b c d Bledsoe, Greg (2016-01-14). "Server Hardening | Linux Journal". Linux Journal. Retrieved 2018-09-22.
  3. ^ Jordan, Jeff (2015-06-16). "How to protect your GNU/Linux computer from remote attacks with Fail2ban". Free Software Magazine. Retrieved 2018-09-22.
  4. ^ Van Impe, Koen (2015-12-09). "Defending Against Apache Web Server DDoS Attacks". IBM's Security Intelligence. Retrieved 2018-09-22.
  5. ^ G. Brester, Sergey (2017-08-09). "0.10.0 (2017/08/09) - long-awaited 0.10th version". GitHub. Retrieved 2018-09-22.
  6. ^ Aleksandersen, Daniel (2016-05-31). "IPv6 support finally arrive in Fail2Ban 0.10". Ctrl blog. Retrieved 2018-09-22.
  7. ^ ducea.com (2006-07-03). "Using Fail2Ban to Block Brute Force Attacks".
  8. ^ "fail2ban/config/filter.d". GitHub.
  9. ^ Wallen, Jack (2016-12-23). "How to protect secure shell on CentOS 7 with Fail2ban". TechRepublic. Retrieved 2018-09-22.
  10. ^ Casey, Brad (2016-02-17). "Three server security tools you might not know". TechTarget. Archived from the original on 2016-02-17. Retrieved 2018-09-22.
  11. ^ Timme, Falko (2007-10-08). "Preventing Brute Force Attacks With Fail2Ban On OpenSUSE 10.3". Retrieved 2007-11-14.
  12. ^ "Integrating AbuseIPDB with Fail2Ban". AbuseIPDB. Retrieved 31 August 2021.
  13. ^ "www.blocklist.de -- Fail2Ban-Reporting Service (we sent Reports from Attacks on Postfix, SSH, Apache-Attacks, Spambots, irc-Bots, Reg-Bots, DDos and more) from Fail2Ban via X-ARF". Blocklist.de. Retrieved 31 August 2021.
[edit]
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Fail2ban&oldid=1263784995"