This howto is going to assume you have a working Debian or Debian based system currently running. It is also intended to be copied and pasted directly into your telnet\/ssh window.<\/p>\n\n\n\n
The package I am going to be using is called fail2ban. Fail2ban scans log files and bans IP addresses that produce too many failed login attempts. It then updates firewall rules to reject the attackers IP address.<\/p>\n\n\n\n
Step 1<\/strong>: Installing the fail2ban package<\/p>\n\n\n\n Type or copy and paste the following into your server.<\/p>\n\n\n\n apt-get install fail2ban<\/p><\/blockquote>\n\n\n\n Once this is done, you are now setup and now you have to setup the configuration files.<\/p>\n\n\n\n Step 2<\/strong>:<\/p>\n\n\n\n Edit \/etc\/fail2ban\/fail2ban.conf<\/p>\n\n\n\n nano -w \/etc\/fail2ban\/fail2ban.conf<\/p><\/blockquote>\n\n\n\n Your fail2ban.conf should look something like this (the commented lines have been removed)<\/p>\n\n\n\n [Definition] Step 3<\/strong>:<\/p>\n\n\n\n Edit \/etc\/fail2ban\/jail.conf<\/p>\n\n\n\n nano -w \/etc\/fail2ban\/jail.conf<\/p><\/blockquote>\n\n\n\n Your jail.conf should look something like this (again comments have been removed)<\/p>\n\n\n\n [DEFAULT] backend = polling [ssh]<\/p>\n\n\n\n enabled = true [apache]<\/p>\n\n\n\n enabled = false [apache-noscript]<\/p>\n\n\n\n enabled = false [vsftpd]<\/p>\n\n\n\n enabled = false [proftpd]<\/p>\n\n\n\n enabled = false [wuftpd]<\/p>\n\n\n\n enabled = false [postfix]<\/p>\n\n\n\n enabled = false [couriersmtp]<\/p>\n\n\n\n enabled = true [courierimap]<\/p>\n\n\n\n enabled = true [courierpop3]<\/p>\n\n\n\n enabled = true [sasl]<\/p>\n\n\n\n enabled = true Please change the email section if you are going to directly copy and paste this config. Right now, when someone attempts a bruteforce attack, fail2ban will firewall the ip address, and send an email to that email address with the whois information, and the log information from the attack.<\/p>\n\n\n\n You can now start\/restart fail2ban, I recommend using a restart just in case fail2ban is already running.<\/p>\n\n\n\n \/etc\/init.d\/fail2ban restart<\/p><\/blockquote>\n\n\n\n Please don’t use this as your only security measure. This is just one step you can take to protecting your servers.<\/p>\n","protected":false},"excerpt":{"rendered":" This howto is going to assume you have a working Debian or Debian based system currently running. It is also intended to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10,12],"tags":[20,22,25,30,43,47,48],"class_list":["post-660","post","type-post","status-publish","format-standard","hentry","category-linux","category-security","tag-bruteforce","tag-debian","tag-fail2ban","tag-linux","tag-security","tag-ssh","tag-telnet"],"_links":{"self":[{"href":"https:\/\/www.jasonmartin.info\/index.php\/wp-json\/wp\/v2\/posts\/660","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jasonmartin.info\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jasonmartin.info\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jasonmartin.info\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jasonmartin.info\/index.php\/wp-json\/wp\/v2\/comments?post=660"}],"version-history":[{"count":0,"href":"https:\/\/www.jasonmartin.info\/index.php\/wp-json\/wp\/v2\/posts\/660\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.jasonmartin.info\/index.php\/wp-json\/wp\/v2\/media?parent=660"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jasonmartin.info\/index.php\/wp-json\/wp\/v2\/categories?post=660"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jasonmartin.info\/index.php\/wp-json\/wp\/v2\/tags?post=660"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
loglevel = 3
logtarget = \/var\/log\/fail2ban.log
socket = \/tmp\/fail2ban.sock<\/p><\/blockquote>\n\n\n\n
ignoreip = 127.0.0.1
bantime = 18000
maxretry = 3<\/p>
destemail = youremail@domain.com
action = iptables[name=%(__name__)s, port=%(port)s]
mail-whois-lines[name=%(__name__)s, dest=%(destemail)s, logpath=%(logpath)s]<\/p><\/blockquote>\n\n\n
port = ssh
filter = sshd
logpath = \/var\/log\/auth.log
maxretry = 6<\/p>\n\n\n
port = http
filter = apache-auth
logpath = \/var\/log\/apache*\/*access.log
maxretry = 6<\/p>\n\n\n
port = http
filter = apache-noscript
logpath = \/var\/log\/apache*\/*error.log
maxretry = 6<\/p>\n\n\n
port = ftp
filter = vsftpd
logpath = \/var\/log\/auth.log
maxretry = 6<\/p>\n\n\n
port = ftp
filter = proftpd
logpath = \/var\/log\/proftpd\/proftpd.log
maxretry = 6<\/p>\n\n\n
port = ftp
filter = wuftpd
logpath = \/var\/log\/auth.log
maxretry = 6<\/p>\n\n\n
port = smtp
filter = postfix
logpath = \/var\/log\/mail.log<\/p>\n\n\n
port = smtp
filter = couriersmtp
logpath = \/var\/log\/mail.log<\/p>\n\n\n
port = imap2
filter = courierlogin
failregex = imapd: LOGIN FAILED.*ip=[.*:]
logpath = \/var\/log\/mail.log
maxretry = 5<\/p>\n\n\n
port = pop3
filter = courierlogin
failregex = courierpop3login: LOGIN FAILED.*ip=[.*:]
logpath = \/var\/log\/mail.log
maxretry = 5<\/p>\n\n\n
port = smtp
filter = sasl
failregex = warning: [-._w]+[]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed
logpath = \/var\/log\/mail.log<\/p>\n\n\n\n