Install Fail2ban on Centos


While each server environment is unique and has its own set of demands based on what’s being hosted on it and who needs access to it, there are some basic things like Fail2ban which are in the standard toolset for anyone concerned with security.

Fail2ban scans log files (e.g. /var/log/httpd/error_log) and bans IPs that show the malicious signs — too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured. Out of the box Fail2Ban comes with filters for various services (Apache httpd, postfix, courier, ssh, etc).

  1. Add the EPEL Yum software repository.
  2. C6: rpm -Uvh
    C7: rpm -Uvh

    yum install fail2ban

  3. View global configuration, look at defaults and enable sshd jail (next step). Other jails can also be enabled here that apply to you.
  4. nano /etc/fail2ban/jail.conf

  5. Setup an sshd jail to catch failed attempts to subvert the system and login. We basically want to ban them forever, or until we decide to lift it.
  6. nano /etc/fail2ban/jail.local

  7. Setup a WodPress jail to catch failed attempts to subvert the system.
  8. nano /etc/fail2ban/jail.local

  9. Setup a rule/pattern to disable access to /xmlrpc.php and other failed attempts to subvert the system. Take a look at other filters that come pre-configured in /etc/fail2ban/filter.d/
  10. nano /etc/filter.d/wordpress.conf

  11. Start fail2ban service
  12. systemctl start fail2ban.service

  13. Enable the fail2ban service to start on system boot
  14. systemctl enable fail2ban

Troubleshooting & Testing

  • Check the status of the fail2ban service
  • systemctl status fail2ban.service

  • Verify where the sshd jail is listening for failed attempts to gain entry to the system.
  • netstat -tulnp

  • View SELinux system messages
  • journalctl -lfu fail2ban

  • Build an SELinux policy module to deal with blocked access or behaviour you want to allow, where “mypol” is the name you want to call your new policy module.
  • grep fail2ban-server /var/log/audit/audit.log | audit2allow -M mypol
    semodule -i mypol.pp

Last Modified: 30 Dec, 2015 at 18:23:35