Fail2Ban

Fail2ban is an open-source intrusion prevention tool for Unix-like systems. It monitors log files for failed login attempts and other suspicious patterns, and automatically blocks offending hosts by updating firewall rules. The project is written in Python and relies on regular expressions to extract IP addresses from log messages.

Key concepts include jails, filters, and actions. A jail connects a log source (such as sshd or a web service) with a filter that defines the log patterns to watch for and an action that specifies how to ban offenders. Each jail has parameters such as bantime (how long to block), findtime (time window to consider), and maxretry (number of failures allowed before banning). If an IP exceeds maxretry within findtime, it is banned for the duration of bantime.

Fail2ban uses backends for blocking. The most common is iptables or nftables, but it can couple with other mechanisms such as firewalld or hosts.deny. Filters are stored in /etc/fail2ban/filters.d, actions in /etc/fail2ban/action.d, and the configuration in /etc/fail2ban/fail2ban.conf and per-service jails in /etc/fail2ban/jail.conf and /etc/fail2ban/jail.d/*.conf. The fail2ban-client command-line tool allows interaction and status checks.

Typical usage includes protecting services like sshd, Apache authentication, vsftpd, and generic TCP services. Logs are scanned in real time or near-real time, and bans are applied automatically. Ban rules can be refined with ignoreip to exempt trusted addresses and with specific port and protocol settings per jail.

Overall, fail2ban provides a configurable, lightweight layer of protection against brute-force attacks by dynamically blocking abusive hosts while remaining flexible across services and environments.