Fail2ban

From Wikipedia, the free encyclopedia - View original article

Fail2ban
Fail2ban logo.png
Fail2ban screenshot.jpg
Original author(s)Cyril Jaquier
Developer(s)Cyril Jaquier, Arturo 'Buanzo' Busleiman
Initial release2004; 9 years ago (2004)
Stable release0.8.10 / June 12, 2013; 5 months ago (2013-06-12)
Operating systemUnix-like
TypeIntrusion prevention
LicenseGPLv2+
Websitewww.fail2ban.org
 
Jump to: navigation, search
Fail2ban
Fail2ban logo.png
Fail2ban screenshot.jpg
Original author(s)Cyril Jaquier
Developer(s)Cyril Jaquier, Arturo 'Buanzo' Busleiman
Initial release2004; 9 years ago (2004)
Stable release0.8.10 / June 12, 2013; 5 months ago (2013-06-12)
Operating systemUnix-like
TypeIntrusion prevention
LicenseGPLv2+
Websitewww.fail2ban.org

Fail2ban is an intrusion prevention framework written in the Python programming language. It is able to run on POSIX systems that have an interface to a packet-control system or firewall installed locally (for example, iptables or TCP Wrapper).[1]

Functionality[edit]

Fail2ban operates by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator.[2] Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured.[3] However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.

Fail2ban can perform multiple actions whenever an abusive IP is detected: update Netfilter/iptables or PF firewall rules, TCP Wrapper's hosts.deny table, to reject an abuser's IP address; email notifications; or any user-defined action that can be carried out by a Python script.[4]

The standard configuration ships with filters for Apache, Lighttpd, sshd, vsftpd, qmail, Postfix and Courier Mail Server. Filters are defined by Python regexes, which may be conveniently customized by an administrator familiar with regular expressions. A combination of a filter and an action is known as a "jail",[5] and is what causes a malicious host to be blocked from accessing specified network services.[6] As well as the examples that are distributed with the software, a "jail" may be created for any network-facing process that creates a log file of access

Shortcomings[edit]

See also[edit]

References[edit]

  1. ^ Requirements - Fail2ban
  2. ^ Features - Fail2ban
  3. ^ MANUAL 0 8 - Fail2ban
  4. ^ Using fail2ban to Block Brute Force Attacks | MDLog:/sysadmin
  5. ^ Debian Package of the Day » Blog Archive » Fail2ban: an enemy of script-kiddies
  6. ^ Some users do not see an alternative solution at present: SLAC Computer Security of Stanford simply states in their recommendations, "Use fail2ban to block ssh and Apache dictionary attacks" "Cyber Security Awareness Month Day 19 - Linux Tips". SLAC Computer Security. 2007-10-19. Retrieved 2008-01-15. [dead link]
  7. ^ Timme, Falko (2007-10-08). "Preventing Brute Force Attacks With Fail2ban On OpenSUSE 10.3". Retrieved 2007-11-14. 

External links[edit]

Articles highlighting Fail2ban[edit]