JAIL.CONF(5) Fail2Ban JAIL.CONF(5) (NAME) jail.conf - fail2ban (SYNOPSIS) fail2ban.conf fail2ban.d/*.conf fail2ban.local fail2ban.d/*.local jail.conf jail.d/*.conf jail.local jail.d/*.local action.d/*.conf action.d/*.local action.d/*.py filter.d/*.conf filter.d/*.local (DESCRIPTION) Fail2ban : fail2ban.conf Fail2Ban ( ) filter.d/*.conf action.d/*.conf (ban) (unban) IP jail.conf (Jails) . (CONFIGURATION FILES FORMAT) *.conf Fail2Ban . *.conf . *.local . [ssh-iptables-ipset] jail.conf jail.local : jail.local [ssh-iptables-ipset] enabled = true .local .conf (parse) . jail.d/ fail2ban.d/ .local jail.conf fail2ban.conf .d/ .conf . jail : jail.conf jail.d/*.conf ( ) jail.local jail.d/*.local ( ). .local .conf .d . . : fail2ban.d/01_custom_log.conf - jail.d/01_enable.conf - jail.d/02_custom_port.conf - () . [ ] << = >> . (indent) . ( ) . [INCLUDES] : before . after . << >> (string interpolation) %(name)s . Fail2ban ( ). %(section/parameter)s . [DEFAULT] %(default/parameter)s . Fail2ban %(known/parameter)s ( parameter). (regexp) .local ( failregex/ignoreregex ) : baduseragents = IE|wget|%(my-settings/baduseragents)s failregex = %(known/failregex)s useragent=%(baduseragents)s %(known/parameter)s (init) / ( parameter). jail.conf/jail.local filter.d/*.local : # filter.d/test.conf: [Init] test.method = GET baduseragents = IE|wget [Definition] failregex = ^%(__prefix_line)"estegexpseragent=(?:) # jail.local: [test] # use filter "test", overwrite method to "POST" and extend known bad agents with "badagent": filter = test[test.method=POST, baduseragents="badagent|"] (): '#' '; ' ( ) . FAIL2BAN (fail2ban.conf) (FAIL2BAN CONFIGURATION FILES) [Definition] : loglevel : CRITICAL ERROR WARNING NOTICE INFO DEBUG TRACEDEBUG HEAVYDEBUG (50-5). : INFO ( 20) logtarget : SYSLOG STDERR STDOUT. : fail2ban.conf/fail2ban.local STDOUT . : fail2ban systemd systemd logtarget STDOUT . . logtarget logrotate ( /etc/logrotate.d/fail2ban ). socket . : /var/run/fail2ban/fail2ban.sock fail2ban . Fail2ban . pidfile PID. : /var/run/fail2ban/fail2ban.pid (PID) fail2ban . allowipv6 IPv6 - auto yes ( on true 1) no ( off false 0). : auto fail2ban IPv6 . dbfile . : /var/lib/fail2ban/fail2ban.sqlite3 fail2ban . fail2ban . None . dbmaxmatches . : 10 . . dbpurgeage . : 86400 ( ) . [Thread] : stacksize fail2ban. : 0 ( ) ( KiB) 0 32 . (jail.conf) (JAIL CONFIGURATION FILES) . [DEFAULT] . ( FILTER FILES ). filter -- /etc/fail2ban/filter.d/ .conf/.local. . logpath () . -- * [0-9] -- . 'tail' 'head' . syslog "*last message repeated 5 times*" . rsyslog RepeatedMsgReduction Off . skip_if_nologs logpath skip_if_nologs true fail2ban (: false) fail2ban "Have not found any log file" auto systemd ( auto Backends ). systemd_if_nologs logpath auto systemd ( Backends ) systemd_if_nologs = false ( true). logencoding . "auto" . logtimezone . fail2ban . . : Z UTC[+-]hhmm ( GMT UTC ). . : logtimezone = UTC logtimezone = UTC+0200 logtimezone = GMT-0100 banaction ( iptables-multiport) [DEFAULT] . action [DEFAULT] jail.local ( ) . banaction_allports banaction "allports" "pam- generic" "recidive" ( iptables- allports). action () /etc/fail2ban/action.d/ .conf/.local. [Init] . : [name=value,name2=value,name3="values,values"] ( "," ). ( ) . blocktype IPv6 blocktype?family=inet6. : # blocktype DROP : banaction_allports = iptables-ipset[type=allports, blocktype=DROP] # blocktype IPv4 IPv6: banaction = iptables-ipset[type=multiport, blocktype="REJECT --reject-with icmp-host-unreachable", blocktype?family=inet6="REJECT --reject-with icmp6-host-unreachable"] ignoreself ( true) IP . ignoreip IP . CIDR DNS (FQDN) ( IP ). ignoreself ( true ) DNS IP . ( "file:") (lazy) . ignorecommand IP ( ) . ignoreself ignoreip . ignoreself ignoreip . ( 0) IP . ACTION FILES ignorecommand . ignorecache ( ) ( ignoreip ignoreself ignorecommand) : ignorecache = key="@", max-count=100, max-time=5m ignorecommand = if [ "" = "technical" ] && [ "" = "my-host.example.com" ]; then exit 0; fi; exit 1 ignorecommand ( ) ( ) ( ) "user@host" . ignorecache . bantime ( ). findtime ( ) . maxretry findtime IP . backend () logpath. "auto" "pyinotify" "polling" logpath "systemd" ( Backends ). . "pyinotify" "pyinotify" . usedns DNS (HOST) . "warn" IP . DNS IP DNS ( ) DNS fail2ban IP ( IP ) . IP . "yes" "no" DNS ( IP ). prefregex (Python regular expression) ( prefregex FILTER FILES ). failregex (Python regular expression) failregex ( failregex FILTER FILES ). fail2ban ( REPORTING BUGS ). ignoreregex Fail2Ban . failregex . maxmatches . maxretry ( ) . . (Backends) . auto backend pyinotify polling logpath systemd : o logpath o systemd_if_nologs = false o journalmatch ( ) backend systemd skip_if_nologs . pyinotify pyinotify ( ) . inotify polling . polling (polling) . systemd systemd systemd . logpath journalmatch . systemd journalpath journalfiles journalflags 1 (LOCAL_ONLY) journalflags=4 4 (SYSTEM_ONLY) namespace. journalflags journalpath journalfiles namespace . python-systemd . : backend = systemd[journalpath=/run/log/journal/machine-1] backend = systemd[journalfiles="/path/to/system.journal, /path/to/user.journal"] backend = systemd[journalflags=4, rotated=on] << >> ( ) fail2ban (rotated) rotated ( false) journalfiles journalflags ( journalpath ) . systemd () ( findtime ). fail2ban-regex systemd-journal ... . fail2ban-regex systemd-journal[rotated=on] ... . (Actions) . ".py" . actname : [ssh-iptables-ipset] enabled = true action = smtp.py[dest=chris@example.com, actname=smtp-chris] smtp.py[dest=sally@example.com, actname=smtp-sally] (TIME ABBREVIATION FORMAT) fail2ban ( findtime bantime) ( 600 10m ). : years?, yea?, yy? months?, mon? weeks?, wee?, ww? days?, da, dd? hours?, hou?, hh? minutes?, min?, mm? seconds?, sec?, ss? () day days . ( ) : 1y 6mo 1d12h30m. m mm mo mon . fail2ban-client : fail2ban-client --str2sec 1d12h (action.d/*.conf) (ACTION CONFIGURATION FILES) IP . jail.conf [actionname].local /etc/fail2ban/action.d . Definition Init . [Init] . jail.conf/jail.local . [Definition] : actionstart () . actionstop () . actioncheck () . . actionban () IP maxretry findtime . actionunban () IP bantime . [Init] . jail.conf/jail.local . [Init] : timeout (kill) . [Definition] (shell) . 0 . actioncheck 0 fail2ban ( actionstop actionstart ). <> . [Init] . fail2ban-client "set action " .
(\n) . . () . : actionban = iptables -I fail2ban- --source -j DROP echo ip=, match=, time=