Fail2ban
Metadata
- Identifier:
fail2ban - Maturity: Production
Categories
- Host Intrusion Prevention System
Description
Fail2ban is an intrusion prevention software framework that protects Unix-like servers from brute-force attacks. It scans log files and bans IP addresses conducting too many failed operations (for example, login attempts). This module targets Debian-based operating systems and has already set a SSH jail.
Actions
| Identifier | Description | Expected Parameters Keys and Types |
|---|---|---|
reload_jails | Reload the jail. | |
restart_service | Restarts the Fail2ban service. | |
start_service | Starts the Fail2ban service. | |
stop_service | Stops the Fail2ban service. | |
unban | Unbans an IP address from a jail. | jail_name (STRING), ip (STRING) |
Information
| Identifier | Description | Type | Properties | Default Value |
|---|---|---|---|---|
active_jails | Active jails | LIST_OF_STRINGS | METRIC, READ_ONLY | |
ban_seconds | Ban duration in seconds | INTEGER | CONFIGURATION, MANDATORY, WITH_DEFAULT_VALUE, NON_DEDUCTIBLE, WRITABLE | 3600 |
banned_ips | Banned IPs from all jails | LIST_OF_STRINGS | METRIC, READ_ONLY | |
ignored_ips | IPs to ignore. Can identify machines like the pentest-related one or controlled strictly by your cloud provider. | LIST_OF_STRINGS | CONFIGURATION, OPTIONAL, WITH_DEFAULT_VALUE, NON_DEDUCTIBLE, WRITABLE | 127.0.0.1 |
jails_count | Number of set jails | INTEGER | METRIC, READ_ONLY | |
max_retries | Login attempts limit above which a user is banned | INTEGER | CONFIGURATION, MANDATORY, WITH_DEFAULT_VALUE, NON_DEDUCTIBLE, WRITABLE | 3 |
ssh_port | Port on which the SSH server runs | INTEGER | CONFIGURATION, MANDATORY, WITH_DEFAULT_VALUE, NON_DEDUCTIBLE, WRITABLE | 22 |
Logs
| Identifier | Description | Location | Format |
|---|---|---|---|
logs | Default log location | /var/log/fail2ban.log | TEXT |
Tests
| Identifier | Description | Type |
|---|---|---|
active_service | Checks if the Fail2ban service is active. | OPERATIONAL |
command | Checks if the Fail2ban client is registered as a command. | PRESENCE |
healthcheck | Checks if Fail2ban blocks an IP when identifying multiple logs generated by it. | SECURITY |
ubuntu | Checks if the operating system is Ubuntu. | REQUIREMENT |