Fail2ban

Infobox_Software
name = Fail2Ban
caption = Fail2Ban
developer = Cyril Jaquier
latest_release_version = 0.8.2
latest_release_date = March 6, 2008
operating_system = Linux
genre = Intrusion prevention
license = GPL v2
website = http://www.fail2ban.org/

Fail2Ban is an intrusion prevention framework written in the Python programming language. It is able to run on POSIX systems that have an interface to a packet-control system or firewall installed locally (for example, iptables or TCP Wrapper) [ [http://www.fail2ban.org/wiki/index.php/Requirements Requirements - Fail2ban ] ]

Functionality

Fail2Ban's main function is to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It determines the hosts to be blocked by monitoring log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc) and bans any host IP that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator. [ [http://www.fail2ban.org/wiki/index.php/Features Features - Fail2ban ] ] Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured [ [http://www.fail2ban.org/wiki/index.php/MANUAL_0_8 MANUAL 0 8 - Fail2ban ] ] . However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.

Fail2ban can perform multiple actions whenever an abusive IP is detected: update Netfilter/iptables firewall rules, or alternatively TCP Wrappers' hosts.deny table, to reject an abuser's IP address; email notifications; or any user-defined action that can be carried out by a Python script. [ [http://www.ducea.com/2006/07/03/using-fail2ban-to-block-brute-force-attacks/ Using fail2ban to Block Brute Force Attacks | MDLog:/sysadmin ] ]

The standard configuration ships with filters for Apache, sshd, vsftpd, qmail, Postfix and Courier Mail Server. Filters are defined by Python regexes, which may be conveniently customized by an administrator familiar with regular expressions. A combination of a filter and an action is known as a "jail" [ [http://debaday.debian.net/2007/04/29/fail2ban-an-enemy-of-script-kiddies#jail Debian Package of the Day » Blog Archive » Fail2ban: an enemy of script-kiddies ] ] , and is what causes a malicious host to be blocked from accessing specified network services. [Some users do not see an alternative solution at present: SLAC Computer Security of Stanford simply states in their recommendations, "Use fail2ban to block ssh and Apache dictionary attacks" cite web | publisher=SLAC Computer Security | title= Cyber Security Awareness Month Day 19 - Linux Tips | date=2007-10-19 | url=http://www2.slac.stanford.edu/computing/security/education/cyber-awareness-10-19-07.htm | accessdate = 2008-01-15 | language = en ] As well as the examples that are distributed with the software, a "jail" may be created for any network-facing process that creates a log file of access attempts.

ee also

*DenyHosts. "Fail2ban is similar to DenyHosts ... but unlike DenyHosts which focuses on SSH, fail2ban can be configured to monitor any service that writes login attempts to a log file, and instead of using /etc/hosts.deny only to block IP addresses/hosts, fail2ban can use Netfilter/iptables and TCP Wrappers /etc/hosts.deny." [cite web | first=Falko | last=Timme | title=Preventing Brute Force Attacks With Fail2ban On OpenSUSE 10.3 | date=2007-10-08 | url =http://www.howtoforge.com/fail2ban_opensuse10.3 | accessdate = 2007-11-14 | language = ]
*BlockHosts
*OSSEC, an Open Source Host-based intrusion detection system.

External links

* [http://fail2ban.sourceforge.net/ Fail2ban website]
* [http://qa.debian.org/developer.php?popcon=fail2ban Debian popularity contest results for fail2ban]

Articles Highlighting Fail2ban

* [http://www.pc-professionell.de/tests/security/article20070824018.aspx PC Professionell: "Fail2ban - Sicherheit für Linux-Server"]
* [http://www.gazeta-it.pl/index.php/2007121681/Obrona-przed-namietnymi-nieletnimi.-Czyli-konfiguracja-fail2ban.html Gazeta IT: "Obrona przed namiętnymi nieletnimi"]
* [http://www.serverwatch.com/tutorials/article.php/3626541 "Tip of the trade: fail2ban"]
* [http://www.howtoforge.com/fail2ban_debian_etch howtoforge: "Preventing Brute Force Attacks With Fail2ban On Debian Etch"]
* [http://www.howtoforge.com/fail2ban_opensuse10.3 howtoforge: "Preventing Brute Force Attacks With Fail2ban On OpenSUSE 10.3"]
* [http://www.the-art-of-web.com/system/fail2ban/ Art Of The Web: "Fail2ban HOWTO"]
* [http://www.debian-administration.org/articles/87 Debian Administration: "Keeping SSH access secure]
* [http://debaday.debian.net/2007/04/29/fail2ban-an-enemy-of-script-kiddies/ Debian Package a Day: "Fail2ban: an enemy of script-kiddies"]
* [http://www.la-samhna.de/library/brutessh.html Defending against brute force ssh attacks]
* [http://www.linux-magazin.com/heft_abo/ausgaben/2007/10/unbestechlicher_tuersteher Linux Magazin: "Unbestechlicher Türsteher"]

Related Software

* [http://kodos.sourceforge.net Kodos] - a Regular Expression debugger

References