fail2ban config
[Definition]
# Logging
# 4 = DEBUG, 3 = INFO, 2 = WARNING, 1 = ERROR, 0 = CRITICAL
loglevel = 3
# Log target:
# SYSLOG = syslog
# STDOUT = stdout
# STDERR = stderr
# FILE = a path
logtarget = /var/log/fail2ban.log
# Socket / PID
socket = /run/fail2ban/fail2ban.sock
pidfile = /run/fail2ban/fail2ban.pid
# Database (persistent state across restarts)
dbfile = /var/lib/fail2ban/fail2ban.sqlite3
dbpurgeage = 86400
dbmaxmatches = 10
[INCLUDES]
before = paths-fedora.conf
[DEFAULT]
# ignorecommand = /path/to/command
ignorecommand =
bantime = 10m
findtime = 10m
maxretry = 5
maxmatches = %(maxretry)s
backend = auto
usedns = warn
logencoding = auto
enabled = false
mode = normal
filter = %(__name__)s[mode=%(mode)s]
protocol = tcp
chain =
port = 0:65535
fail2ban_agent = Fail2Ban/%(fail2ban_version)s
banaction = iptables-multiport
banaction_allports = iptables-allports
action_ = %(banaction)s[port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
action_abuseipdb = abuseipdb
action = %(action_)s
[sshd]
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
[selinux-ssh]
port = ssh
logpath = %(auditd_log)s
# Generic filter for PAM. Has to be used with action which bans all
# ports such as iptables-allports, shorewall
[pam-generic]
# pam-generic filter can be customized to monitor specific subset of 'tty's
banaction = %(banaction_allports)s
logpath = %(syslog_authpriv)s
backend = %(syslog_backend)s
[DEFAULT]
# Put your static IP here
ignoreip = 144.24.46.145/32
bantime = 365d
findtime = 60m
mode = aggressive
maxretry = 3
[sshd]
mode = aggressive
enabled = true
backend = systemd
filter = sshd[mode=aggressive]
logpath = /var/log/secure
action = iptables-multiport[name=sshd, port="22", protocol=tcp, chain="%(chain)s"]
You need to create a Iptables chain named: f2b-sshd,
f2b = application, sshd = jail.
If the naming scheme isnt right, it wont work.