Monday, 26. April 2010 18:22
fail2ban is a service that continually scans your log files and bans IP addresses based on patterns you specify, such as logon failures. It then updates the firewall to block that IP address entirely. It works with anything that spits out a log file (SSH, apache, zimbra… etc..). Great for protecting against denial of service (DOS), as well as login failures for phpmyadmin, joomla, wordpress, webadmin (oft targeted web services)
It can also be expanded upon rather easily to enhance it’s use. For example, you could centrally log addresses across multiple machines and when an IP hits the limit for failed logins (gathered from ALL your servers), have all servers block that IP address. Or, send an SNMP trap to your edge firewalls (we’re a cisco shop) to stop it from getting to your networks in the first place.
Another use would be to ban IP’s that have a high 404 count – such as script kiddies seeing if you have vulnerable software. I recommend you get an idea first of what “normal” is and to make sure you don’t accidentally ban legitimate users.
However, this is just a tool, and simply implementing this does NOT mean you can sleep soundly at night. Keep things up to date, have backups, keep an eye on your services as well as whats going on in your logs. Need some help with one of these? Just let us know
More info:
http://www.fail2ban.org – fail2ban website
http://www.debian-administration.org/articles/623 – how-to article on preventing DNS DDOS with fail2ban
Other resources:
http://www.tripwire.org – tripwire logs changes to files of specified directories (passwd file changed but you haven’t touched it? ruh-roh…)
http://www.nessus.org – security scanner, helps identify potential securities holes (packages tend to be more leaky than OS’s these days)