3

I updated my server to 16.04 and it only installs fail2ban 0.9.0. There is no option to enable jails and when I add it manually it fails to load. Any help much appreciated.

5

Yeah, Fail2ban configuration files has changed a lot since V.0.9.X.

After V.0.9.X you should NOT change the original config file, that is located in

/etc/fail2ban/jail.conf

this is from Fail2ban jail.conf

# WARNING: heavily refactored in 0.9.0 release.  Please review and
#          customize settings for your setup.
#
# Changes:  in most of the cases you should not modify this
#           file, but provide customizations in jail.local file,
#           or separate .conf files under jail.d/ directory, e.g.:
#
# HOW TO ACTIVATE JAILS:
#
# YOU SHOULD NOT MODIFY THIS FILE.
#
# It will probably be overwritten or improved in a distribution update.
#
# Provide customizations in a jail.local file or a jail.d/customisation.local.
# For example to change the default bantime for all jails and to enable the
# ssh-iptables jail the following (uncommented) would appear in the .local file.

Ubuntu 16.04 installs Fail2ban V.0.9.3-1 To config it, do the following:

apt update
apt install fail2ban

after Fail2ban has been successfully installed:

cd /etc/fail2ban/

we now create some local jail, to override the default configurations

sudo nano /etc/fail2ban/jail.local

no copy and paste the following

[DEFAULT]
# Ban hosts for two days:
bantime = 172800

# Override /etc/fail2ban/jail.d/00-firewalld.conf:
banaction = iptables-multiport

[sshd]
enabled = true

now write to the file (ctrl + o) and close it (ctrl + x)

restart fail2ban service

sudo systemctl restart fail2ban

check fail2ban status

sudo fail2ban-client status

you should get a output like this:

Status
|- Number of jail:  1
`- Jail list:   sshd

now you check individuals jails e.g.

sudo fail2ban-client status sshd

with the above commands you can see which IP addresses has been blocked Fail2ban service!

you can control with systemctl is fail2ban is running or not

sudo systemctl status fail2ban

this is it.

PS: you can add other parameters like mail sending, find time, max-retry and ... if you would like!

Sources:

How To Protect SSH With Fail2Ban on CentOS 7

Fail2ban with FirewallD

Using Fail2ban to Secure Your Server

PS2: There is a newer version of Fail2ban available -> v0.9.4

If you would like, you can compile it yourself (read the Fail2ban github page) - though compiling IS NOT recommended From Fail2ban Github Page

It is possible that Fail2ban is already packaged for your distribution. In this case, you should use it instead.

OR

you can use the .dep package for the next version of Ubuntu (which is Yekkety) Package: fail2ban (0.9.4-1) [universe]

3
  • ban host for two days :) awesome!
    – vgoklani
    Aug 16 '16 at 15:58
  • But how do i add the jail for apache. Every time i add enabled = true. Fail2ban fails to start. I use basic authentication with apache so this is a necessity. Currently i just reverted to 0.8 and put the update for fail2ban on hold with apt. I don't understand why they removed the ability to copy the .conf to a jail.local and manipulate the settings there. All the settings were already in the file. Maybe i am missing something. I have researched and couldn't find it on my own
    – ILOVEKODI
    Aug 24 '16 at 8:26
  • @ILOVEKODI sorry man for answering late. Just Copy the apache section or whatever the webserver section is, to the jail.local and add enabled = true / like we did it with the SSH. Hope this help. :) [notes.sagredo.eu/node/170] you may check out this website.
    – bossModus
    Sep 3 '16 at 8:59
2

In addition to bossModus's info, note that there is no apache jail in the newer versions of fail2ban. I believe it was renamed to apache-auth.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.