fail2ban - 설정 - jail.conf

첫 등록일    : 2009-09-15
최종 수정일 : 2009-09-15

---

** /etc/fail2ban/jail.conf
    ....
    ....
    ....
    ....
[DEFAULT]
ignoreip = 127.0.0.1

bantime  = 3600

findtime  = 600

maxretry = 3

backend = auto


[ssh-iptables]
enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]
           sendmail-whois[name=SSH, dest=admin@domain.com, sender=fail2ban@domain.com]
logpath  = /var/log/secure
maxretry = 5


[proftpd-iptables]
enabled  = false
filter   = proftpd
action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
           sendmail-whois[name=ProFTPD, dest=admin@domain.com]
logpath  = /var/log/proftpd/proftpd.log
maxretry = 6


[sasl-iptables]
enabled  = false
filter   = sasl
backend  = polling
action   = iptables[name=sasl, port=smtp, protocol=tcp]
           sendmail-whois[name=sasl, dest=admin@domain.com]
logpath  = /var/log/mail.log


[ssh-tcpwrapper]
enabled     = false
filter      = sshd
action      = hostsdeny
              sendmail-whois[name=SSH, dest=admin@domain.com]
ignoreregex = for myuser from
logpath     = /var/log/sshd.log


[apache-tcpwrapper]
enabled  = false
filter   = apache-auth
action   = hostsdeny
logpath  = /var/log/apache*/*error.log
           /home/www/myhomepage/error.log
maxretry = 6


[postfix-tcpwrapper]
enabled  = false
filter   = postfix
action   = hostsdeny[file=/not/a/standard/path/hosts.deny]
           sendmail[name=Postfix, dest=admin@domain.com]
logpath  = /var/log/postfix.log
bantime  = 300


[vsftpd-notification]
enabled  = false
filter   = vsftpd
action   = sendmail-whois[name=VSFTPD, dest=admin@domain.com]
logpath  = /var/log/vsftpd.log
maxretry = 3
bantime  = 600


[vsftpd-iptables]
enabled  = true
filter   = vsftpd
action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
           sendmail-whois[name=VSFTPD, dest=admin@domain.com]
logpath  = /var/log/vsftpd.log
maxretry = 5
bantime  = 3600


[apache-badbots]
enabled  = false
filter   = apache-badbots
action   = iptables-multiport[name=BadBots, port="http,https"]
           sendmail-buffered[name=BadBots, lines=5, dest=admin@domain.com]
logpath  = /var/www/*/logs/access_log
bantime  = 172800
maxretry = 1


[apache-shorewall]
enabled  = false
filter   = apache-noscript
action   = shorewall
           sendmail[name=Postfix, dest=admin@domain.com]
logpath  = /var/log/apache2/error_log


[ssh-ipfw]
enabled  = false
filter   = sshd
action   = ipfw[localhost=192.168.0.1]
           sendmail-whois[name="SSH,IPFW", dest=admin@domain.com]
logpath  = /var/log/auth.log
ignoreip = 168.192.0.1


[named-refused-udp]
enabled  = false
filter   = named-refused
action   = iptables-multiport[name=Named, port="domain,953", protocol=udp]
           sendmail-whois[name=Named, dest=admin@domain.com]
logpath  = /var/log/named/security.log
ignoreip = 168.192.0.1


[named-refused-tcp]
enabled  = false
filter   = named-refused
action   = iptables-multiport[name=Named, port="domain,953", protocol=tcp]
           sendmail-whois[name=Named, dest=admin@domain.com]
logpath  = /var/log/named/security.log
ignoreip = 168.192.0.1

---

** 메모
 - 이메일 주소 일괄 변경
  . 초기값 : you@mail.com, fail2ban@mail.com
  . 변경
    %s/you@mail.com/admin@domain.com
    %s/fail2ban@mail.com/fail2ban@doamin.com

 - 관련사이트
    http://www.fail2ban.org/wiki/index.php/Main_Page