CLI - fail2ban

fail2ban

Fail2Ban is an intrusion prevention software framework that protects devices from brute-force attacks. Fail2Ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.

The primary purpose of fail2ban is to jail services. When a service, such as SSHd, is jailed, then fail2ban will continuously look in the log(s) of that service for possible repeated attempts. The moment that a given number (maxretry) of attempts is detected within a particular time window (findtime) then a blocking rule (such as through iptables) is automatically set for a given time period (bantime).

Fail2ban configuration has three terms. The first is "bantime" which indicates the time a host will be blocked. The second is "findtime" which is the length of time between login attempts before a ban is set. The last is "maxretry" which indicates how many attempts can be made to access the server before a ban is imposed. If a client is banned, the client can't connect to a device.

Note that the fail2ban service blocks a client depending on its IP address. For example, Although a client whose IP address is 10.10.10.10 is blocking for the bantime, another client whose IP address is 20.20.20.20 can connect to the same device.

Verifying Current Configuration

If you want to verify the current configuration, enter the show system fail2ban. The result shows

LYSH@MyHostName# show system fail2ban
fail2ban(ssh)                 : active, bantime:10m, findtime:10m, maxretry:5

Note that the above fail2ban configuration is the default. In other words, if you try to connect an imRAD device without knowing its password and you failed more than 5 times, your connection will be blocked for 10 minutes.

Configuring the fail2ban

You can configure the fail2ban in the configuration mode.

LYSH@MyHostName# configure
configure# fail2ban add -h
usage: fail2ban add [-h] [<1->] [<1->] [<1->]
positional arguments:
  <1->        Enter the number of seconds that a host is banned
  <1->        Enter the length of time between login attempts before a ban is set
  <1->        how many attempts can be made to access the server before a ban is imposed

detaul 10, 10, 5 ipo 단위로 차단