fail2ban config


fail2ban
fail2ban.conf
[Definition]

# Logging
# 4 = DEBUG, 3 = INFO, 2 = WARNING, 1 = ERROR, 0 = CRITICAL
loglevel = 3

# Log target:
# SYSLOG = syslog
# STDOUT = stdout
# STDERR = stderr
# FILE = a path
logtarget = /var/log/fail2ban.log

# Socket / PID
socket = /run/fail2ban/fail2ban.sock
pidfile = /run/fail2ban/fail2ban.pid

# Database (persistent state across restarts)
dbfile = /var/lib/fail2ban/fail2ban.sqlite3
dbpurgeage = 86400
dbmaxmatches = 10
jail.conf
[INCLUDES]
before = paths-fedora.conf

[DEFAULT]
# ignorecommand = /path/to/command 
ignorecommand =
bantime  = 10m
findtime  = 10m
maxretry = 5
maxmatches = %(maxretry)s
backend = auto
usedns = warn
logencoding = auto
enabled = false
mode = normal
filter = %(__name__)s[mode=%(mode)s]
protocol = tcp
chain = 
port = 0:65535
fail2ban_agent = Fail2Ban/%(fail2ban_version)s
banaction = iptables-multiport
banaction_allports = iptables-allports
action_ = %(banaction)s[port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
action_abuseipdb = abuseipdb
action = %(action_)s

[sshd]
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

[selinux-ssh]
port     = ssh
logpath  = %(auditd_log)s

# Generic filter for PAM. Has to be used with action which bans all
# ports such as iptables-allports, shorewall
[pam-generic]
# pam-generic filter can be customized to monitor specific subset of 'tty's
banaction = %(banaction_allports)s
logpath  = %(syslog_authpriv)s
backend  = %(syslog_backend)s
jail.local
[DEFAULT]
# Put your static IP here
ignoreip = 144.24.46.145/32
bantime  = 365d
findtime = 60m
mode     = aggressive
maxretry = 3

[sshd]
mode = aggressive
enabled  = true
backend  = systemd
filter   = sshd[mode=aggressive]
logpath  = /var/log/secure
action   = iptables-multiport[name=sshd, port="22", protocol=tcp, chain="%(chain)s"]
iptables chain

You need to create a Iptables chain named: f2b-sshd,
f2b = application, sshd = jail.
If the naming scheme isnt right, it wont work.