Benjamin Diedrichsen
1.4 KiB
1.4 KiB
armor-fail2ban
Install and enable fail2ban
Purpose
This cube installs and configures Fail2ban, an intrusion prevention software that protects your server from brute-force attacks and unauthorized access attempts.
What is Fail2ban?
Fail2ban monitors log files (e.g., /var/log/auth.log) for suspicious activity, such as repeated failed login attempts. When it detects malicious behavior patterns, it automatically:
- Bans the offending IP address by updating firewall rules
- Prevents the attacker from making further connection attempts
- Can send email notifications about bans (if configured)
Common use cases include:
- Protecting SSH from brute-force password attacks
- Blocking repeated failed login attempts on web applications
- Preventing DoS attacks from specific IP addresses
What This Cube Does
- Installs the
fail2banpackage via apt - Deploys a custom configuration file (
jail.local) to/etc/fail2ban/jail.local - Configures fail2ban with sensible defaults for common services
Configuration
This cube currently has no configurable parameters. The default configuration is applied from the included jail.local file.
Dependencies
None - this cube can run standalone.
Notes
After deployment, you can:
- Check fail2ban status:
sudo fail2ban-client status - View banned IPs:
sudo fail2ban-client status sshd - Unban an IP:
sudo fail2ban-client set sshd unbanip <IP_ADDRESS>