Jump to content

Fail2ban: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
m Replaced outdated html codes with wikicodes.
Ethauvin (talk | contribs)
141 edits
m Updated to latest 0.11.1 stable release.
Line 12: Line 12:
| language = Python
| language = Python
| website = {{official url}}
| website = {{official url}}
| latest_release_version = 0.10.4
| latest_release_version = 0.11.1
| latest_release_date = {{Start date and age|2018|10|04}}<ref>{{cite web|url=https://github.com/fail2ban/fail2ban/releases|title=Releases · fail2ban|date=10 September 2019|publisher=|via=GitHub}}</ref>
| latest_release_date = {{Start date and age|2020|01|11}}<ref>{{cite web|url=https://github.com/fail2ban/fail2ban/releases|title=Releases · fail2ban|date=10 September 2019|publisher=|via=GitHub}}</ref>
| operating_system = [[Unix-like]]
| operating_system = [[Unix-like]]
}}
}}

Revision as of 22:34, 12 July 2020

Fail2Ban
Original author(s)Cyril Jaquier
Developer(s)Cyril Jaquier, Yaroslav Halchenko, Daniel Black, Steven Hiscocks, Arturo 'Buanzo' Busleiman, and the Fail2Ban community
Initial release2004; 20 years ago (2004)
Stable release
0.11.1 / January 11, 2020; 4 years ago (2020-01-11)[1]
Repository
Operating systemUnix-like
Available inPython
TypeIntrusion prevention
LicenseGPLv2+
Websitegithub.com/fail2ban/fail2ban Edit this at Wikidata

Fail2Ban is an intrusion prevention software framework that protects computer servers from brute-force attacks.[2][3] Written in the Python programming language, it is able to run on POSIX systems that have an interface to a packet-control system or firewall installed locally, for example, iptables or TCP Wrapper.[4]

Functionality

Fail2Ban operates by monitoring log files (e.g. /var/log/auth.log, /var/log/apache/access.log, etc.) for selected entries and running scripts based on them.[5] Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP address that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator. Includes support for both IPv4 and IPv6.[6][7] Optionally longer bans can be custom-configure for "recidivist" abusers that keep coming back.[3] Fail2Ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.

Fail2Ban can perform multiple actions whenever an abusive IP address is detected:[8] update Netfilter/iptables or PF firewall rules, TCP Wrapper's hosts.deny table, to reject an abuser's IP address; email notifications; or any user-defined action that can be carried out by a Python script.

The standard configuration ships with filters for Apache, Lighttpd, sshd, vsftpd, qmail, Postfix and Courier Mail Server.[9][10] Filters are defined by Python regexes, which may be conveniently customized by an administrator familiar with regular expressions.[3] A combination of a filter and an action is known as a "jail" and is what causes a malicious host to be blocked from accessing specified network services.[3] As well as the examples that are distributed with the software, a "jail" may be created for any network-facing process that creates a log file of access.[11]

Fail2Ban is similar to DenyHosts [...] but unlike DenyHosts which focuses on SSH, Fail2Ban can be configured to monitor any service that writes login attempts to a log file, and instead of using /etc/hosts.deny only to block IP addresses/hosts, Fail2Ban can use Netfilter/iptables and TCP Wrappers /etc/hosts.deny.

— Falko Timme[12]

Shortcomings

  • Fail2Ban fails to protect against a distributed brute-force attack.
  • There is no interaction with application-specific APIs/AGIs.

See also

  • DenyHosts, a log-based intrusion-prevention security tool
  • Stockade, a rate-limiting approach to spam mitigation.
  • OSSEC, an open-source host-based intrusion-detection system.

References

  1. ^ "Releases · fail2ban". 10 September 2019 – via GitHub.
  2. ^ serverwatch.com (2006-08-15). "Tip of the Trade: Fail2Ban".
  3. ^ a b c d Bledsoe, Greg (2016-01-14). "Server Hardening | Linux Journal". Linux Journal. Retrieved 2018-09-22.
  4. ^ Jordan, Jeff (2015-06-16). "How to protect your GNU/Linux computer from remote attacks with Fail2ban". Free Software Magazine. Retrieved 2018-09-22.
  5. ^ Van Impe, Koen (2015-12-09). "Defending Against Apache Web Server DDoS Attacks". IBM's Security Intelligence. Retrieved 2018-09-22.
  6. ^ G. Brester, Sergey (2017-08-09). "0.10.0 (2017/08/09) - long-awaited 0.10th version". GitHub. Retrieved 2018-09-22.
  7. ^ Aleksandersen, Daniel (2016-05-31). "IPv6 support finally arrive in Fail2Ban 0.10". Ctrl blog. Retrieved 2018-09-22.
  8. ^ ducea.com (2006-07-03). "Using Fail2Ban to Block Brute Force Attacks".
  9. ^ fail2ban.org. "Features - Fail2Ban".{{cite web}}: CS1 maint: numeric names: authors list (link)
  10. ^ Wallen, Jack (2016-12-23). "How to protect secure shell on CentOS 7 with Fail2ban". TechRepublic. Retrieved 2018-09-22.
  11. ^ Casey, Brad (2016-02-17). "Three server security tools you might not know". TechTarget. Retrieved 2018-09-22.
  12. ^ Timme, Falko (2007-10-08). "Preventing Brute Force Attacks With Fail2Ban On OpenSUSE 10.3". Retrieved 2007-11-14.
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Fail2ban&oldid=967378404"