[Sample] Jail Configuration

#

# JAILS

# /etc/fail2ban/jail.local

#

[hub­login] enabled  = true

port      = http,https filter      = hub­login

logpath = /var/log/messages banaction = hublogin­failure bantime = 600

findtime = 1

maxretry = 1

[Sample] Filter Configuration

/etc/fail2ban/filter.d/hub­login.conf

# Fail2Ban configuration file

#

[Definition]

# Option:  failregex

# Notes.:  Regexp to catch known spambots and software alike. Please verify

#           that it is your intent to block IPs which were driven by

#           abovementioned bots.

# Values:  TEXT

#

#We choose something that will never happen

# Since the CMS will control IP’s placed in the jails failregex = ^<HOST>thisfilterwillneverbefound

# Option:  ignoreregex

# Notes.:  regex to ignore. If this regex matches, the line is ignored.

# Values:  TEXT

#

ignoreregex =

[Sample] Action Configuration

# Fail2Ban configuration file

# cat /etc/fail2ban/action.d/hublogin­failure.conf [INCLUDES]

before = iptables­common.conf

[Definition]

# Option:   actionstart

# Notes.:   command executed once at the start of Fail2Ban.

# Values:   CMD

#

actionstart = iptables ­N fail2ban­hublogin

iptables ­A INPUT ­j DROP

iptables ­I INPUT ­p tcp ­j fail2ban­hublogin

# Option:   actionstop

# Notes.:   command executed once at the end of Fail2Ban

# Values:   CMD

#

actionstop = iptables ­D fail2ban­hublogin ­p tcp ­j fail2ban­hublogin iptables ­F fail2ban­hublogin

iptables ­X fail2ban­hublogin

# Option:   actioncheck

# Notes.:   command executed once before each actionban command

# Values:   CMD

#

actioncheck = iptables ­n ­L fail2ban­hublogin | grep ­q fail2ban­hublogin

# Option:   actionban

# Notes.:   command executed when banning an IP. Take care that the

#           command is executed with Fail2Ban user rights.

# Tags:     <ip>   IP address

#           <failures>   number of failures

#           <time>   unix timestamp of the ban time

# Values:   CMD

#

actionban = iptables ­I fail2ban­hublogin ­p tcp ­­dport 443 ­s <ip> ­j DROP

iptables ­I fail2ban­hublogin ­p tcp ­­dport

80 ­s <ip> ­j DROP

# Option:   actionunban

# Notes.:   command executed when unbanning an IP. Take care that the

#           command is executed with Fail2Ban user rights.

# Tags:     <ip>   IP address

#           <failures>   number of failures

#           <time>   unix timestamp of the ban time

# Values:   CMD

#

actionunban = iptables ­D fail2ban­hublogin ­p tcp ­­dport 443 ­s <ip> ­j DROP iptables ­D fail2ban­hublogin ­p tcp ­­dport 80 ­s <ip> ­j DROP

[Init]

# Defaut name of the chain

#

name = DEFAULT

# Option:   protocol

# Notes.:   internally used by config reader for interpolations.

# Values:   [ tcp | udp | icmp | all ] Default: tcp

#

protocol = tcp

# Option:   chain

# Notes     specifies the iptables chain to which the fail2ban rules should be

#           added

# Values:   STRING   Default: INPUT chain = INPUT

[Sample] Banned IP address results root@example:/var/www/example# fail2ban­client status hub­login Status for the jail: hub­login

|­ Filter

|  |­ Currently failed: 0

|  |­ Total failed:                 4

|  `­ File list:          /var/log/messages

`­ Actions

|­ Currently banned: 1

|­ Total banned:                 4

`­ Banned IP list:               192.168.226.1

root@example:/var/www/example# iptables ­L Chain INPUT (policy DROP)

target      prot opt source                 destination fail2ban­hublogin     tcp    ­­     anywhere                  anywhere ACCEPT   all           ­­          anywhere      anywhere

ACCEPT      all  ­­  anywhere               anywhere               state RELATED,ESTABLISHED