fail2ban

by fail2ban

15.1Kstars

1.4Kforks

257watchers

Updated 7 months ago

About

Fail2Ban is a daemon that monitors log files and bans IP addresses exhibiting multiple authentication failures by updating firewall rules.

Daemon to ban hosts that cause multiple authentication errors

Primary Use Case

Fail2Ban is primarily used to protect servers and endpoints from brute-force attacks by automatically banning IPs that generate repeated failed login attempts. System administrators and security professionals deploy it to enhance endpoint security and reduce unauthorized access risks by automating firewall management based on log analysis.

Key Features

Monitors various log files for authentication failures
Automatically bans IP addresses with multiple failed login attempts
Updates system firewall rules to reject malicious IPs temporarily
Supports IPv6 address matching since version 0.10
Pre-configured to work with common services like sshd and Apache
Highly configurable to monitor custom log files and error patterns
Provides CLI tools for management and configuration
Supports integration with systemd and other Linux init systems

Installation

Ensure Python >= 3.5 or PyPy3 is installed
Install python-setuptools or python3-setuptools for source installation
Optionally install pyinotify >= 0.8.3 for Linux kernel >= 2.6.13 support
Optionally install systemd >= 204 and python-systemd bindings
Optionally install dnspython, pyasyncore, and pyasynchat for Python 3.12+
Download and extract the source tarball: tar xvfj fail2ban-master.tar.bz2
Change directory to extracted folder: cd fail2ban-master
Run installation: sudo python setup.py install
Alternatively, clone the repository: git clone https://github.com/fail2ban/fail2ban.git
Change directory to cloned repo: cd fail2ban

Usage

>_ fail2ban-client -h

Displays help information and verifies Fail2Ban installation

>_ fail2ban-client version

Shows the installed Fail2Ban version

>_ service fail2ban start

Starts the Fail2Ban service after installation

Security Frameworks

Defense Evasion

Credential Access

Initial Access

Discovery

Impact

Usage Insights

Integrate Fail2Ban with SIEM tools to automate alerting and incident response workflows.
Customize filters to detect and block emerging brute-force patterns beyond default services.
Deploy Fail2Ban on critical endpoints and servers to reduce attack surface from automated attacks.
Combine Fail2Ban with multi-factor authentication to strengthen defense-in-depth strategies.
Use Fail2Ban logs to feed threat intelligence platforms for broader network defense correlation.