www.LinuxHowtos.org howtos, tips&tricks and tutorials for linux

from small one page howto to huge articles all in one place

Other .linuxhowtos.org sites:gentoo.linuxhowtos.org

Last additions:

using iotop to find disk usage hogs

words:

887

views:

209586

userrating:

May 25th. 2007:

Words

486

Views

258592

why adblockers are bad

Workaround and fixes for the current Core Dump Handling vulnerability affected kernels

words:

161

views:

149883

userrating:

April, 26th. 2006:

Words

Views

107374

New subdomain: toolsntoys.linuxhowtos.org

You are here: manpages

FAIL2BAN

Section: Misc. Reference Manual Pages (1)
Updated: March 2013
Index Return to Main Contents

NAME

fail2ban - a set of server and client programs to limit brute force authentication attempts.

DESCRIPTION

Fail2Ban consists of a client, server and configuration files to limit brute force authentication attempts.

The server program fail2ba-server is responsible for monitoring log files and issuing ban/unban commands. It gets configured through a simple protocol by fail2ba-client, which can also read configuration files and issue corresponding configuration commands to the server.

For details on the configuration of fail2ban see the jail.conf(5) manual page. A jail (as specified in jail.conf) couples filters and actions definitions for any given list of files to get monitored.

For details on the comman-line options of fail2ba-server see the fail2ba-server(1) manual page.

For details on the comman-line options and commands for configuring the server via fail2ba-client see the fail2ba-client(1) manual page.

For testing regular expressions specified in a filter using the fail2ba-regex program may be of use and its manual page is fail2ba-regex(1).

LIMITATION

Fail2Ban is able to reduce the rate of incorrect authentications attempts however it cannot eliminate the risk that weak authentication presents. Configure services to use only two factor or public/private authentication mechanisms if you really want to protect services.

A local user is able to inject messages into syslog and using a Fail2Ban jail that reads from syslog, they can effectively trigger a DoS attack against any IP. Know this risk and configure Fail2Ban/grant shell access accordingly.