Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email, or ejecting CD-ROM tray) could also be configured. Out of the box Fail2Ban comes with filters for various services (apache, curier, ssh, etc). For more info refer to the official web site
How to install Fail2ban. Enable Epel repository first:
rpm -Uvh remi-release-6*.rpm epel-release-6*.rpm
Enable the remi repository.
Open the file /etc/yum.repos.d/remi.repo and set enable=1 in remi section of the file.
name=Les RPM de remi pour Enterprise Linux $releasever - $basearch
Now install Fail2ban:
yum install fail2ban
Set Fail2ban to start at boot
chkconfig fail2ban on
Copy config file to keep the original backup.
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Now we have a working config file /etc/fail2ban/jail.local, configure it according to your needs.
service fail2ban start
Now you have working Fail2ban server. To display banned hosts, enter:
To unlock IP, enter
iptables -D fail2ban-ssh 1
Was this answer helpful?
How to configure OpenVPN client on Windows: First download and install the client. Then...
Selinux annoying you? Get it out! How to disable selinux Open its config file nano...
If you concerned about network speed of your vps you can test it by downloading some test...
In this article we will install some software that is useful on a webserver based on...
#!/bin/bash echo "packing files in progress..." tar -cf /home/backup/root_lib-$(date...