Bird's Nest Kotori's Tech Blog

Fail2Ban on RHEL 5/6

I've decided to put together this little howto on installing and configuring Fail2Ban on RedHat Enterprise Linux v5.x and v6.x.

The first step is to make to decide whether you want to install via repository or by source. I recommend installing by repository as you will receive packages that are guaranteed to work with the OS, and will receive updates along with your regular packages.

Installing Via Repo

If you have not already done so you will want to install the epel repository, choose a repository according to your OS. I prefer to use the EPEL repository: http://dl.fedoraproject.org/pub/epel/6/x86_64/repoview/fail2ban.html

RHEL 5

32 BIT SYSTEMS:
sudo rpm -Uvh "http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-5-4.noarch.rpm"
64 BIT SYSTEMS:
sudo rpm -Uvh "http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-5-4.noarch.rpm"

RHEL 6

32 BIT SYSTEMS:
sudo rpm -Uvh "http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-5.noarch.rpm"
64 BIT SYSTEMS:
sudo rpm -Uvh "http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-5.noarch.rpm"

Now that we have the repository installed, we can install Fail2Ban.

sudo yum install fail2ban

First copy your jail.conf to jail.local. This protects your changes from getting wiped during package upgrades. Fail2Ban is setup to read jail.local after jail.conf automatically. From here on, when I say configuration file, I am referring to the jail.local file.

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Next you can add any administrative IP addresses to Fail2Ban's white-list, space separated.

sudo vi /etc/fail2ban/jail.local

[DEFAULT]
 
ignoreip = 127.0.0.1 192.168.1.0/24 192.168.2.5 192.168.5.3

Now you will want to configure Fail2Ban to your liking, mainly white-lists and active jails.
I like to ban my attackers for a good long time, you can alter the default ban time of 10 minutes. This is done by modifying the bantime variable, this can also be overridden on a per-jail basis.

bantime  = 86400 # this is a much longer ban, 24 hours

SSH jail is active by default, so only small tweaks are needed. Simply make sure enabled is true, and logpath is pointing to /var/log/secure.

[ssh-iptables]
 
enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]
           sendmail-whois[name=SSH, dest=root@localhost, sender=fail2ban@localhost]
logpath  = /var/log/secure
maxretry = 3

I find enabling an email jail is also a good idea as SMTP services are a common target.

[postfix]
 
enabled  = true
filter   = postfix
action   = iptables[name=Postfix, port=smtp, protocol=tcp]
           sendmail-whois[name=Postfix, dest=root@localhost, sender=fail2ban@localhost]
logpath  = /var/log/maillog
maxretry = 5

Now we can make sure Fail2Ban starts when our server reboots, do this by using chkconfig to enable.

chkconfig fail2ban on
sudo /etc/init.d/fail2ban start

Installing Via GitHub

This is my preferred method of installing Fail2Ban, as it gets the absolute latest copy, there are a couple of additional packages that you will need to install first.

Ensure Python is upto date. >=python-2.3

python -V
Python 2.6.5

Now if we don't already have the git package, go ahead and install that now

sudo yum -y install git

Now create a dev directory that will house the Fail2Ban git repo.

cd ~
mkdir fail2ban-dev
cd fail2ban-dev
git clone https://github.com/fail2ban/fail2ban.git

Now we can install Fail2Ban using root privileges.

cd fail2ban
sudo python setup.py install

Now we should have our Fail2Ban installation in /usr/share/fail2ban, the configuration in /etc/fail2ban/, and the binaries in /usr/bin.

We should now install the startup script for RHEL:

sudo cp ~/fail2ban-dev/fail2ban/files/redhat-initd /etc/init.d/fail2ban
sudo chmod 755 /etc/init.d/fail2ban

First copy your jail.conf to jail.local. This protects your changes from getting wiped during package upgrades. Fail2Ban is setup to read jail.local after jail.conf automatically.

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

The configuration is going to be quite similar to above, simply ensure your logpath is correct and enabled is true.

To update our github installation, run git pull from the repo directory, keep in mind that the setup.py script will overwrite /etc/fail2ban/jail.conf , so if you didn't create a jail.local, as I previously showed, I would now.

cd ~/fail2ban-dev/fail2ban
git pull -u
sudo python setup.py install