OK: so I have fail2ban installed on a Debian 8.7 machine: I have a iptables that looks like this:
-P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-ssh-daily -N fail2ban-ssh-permaban -N fail2ban-ssh-yearban -N fail2ban-sshd -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-sshd -A fail2ban-sshd -j RETURN
-N fail2ban-sshd -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-sshd -A fail2ban-sshd -j RETURN
where it defaults to
fail2ban.sshd - I want the rules to be named:
-N fail2ban-ssh-daily( for default fail2ban-sshd bans)
-N fail2ban-ssh-permaban(for permanent bans)
-N fail2ban-ssh-yearban(for yearly bans)
I want the default config to stop adding
fail2ban.sshd, and I want to use fail2ban to set up jails that will allow me to:
- Set up a Daily Ban Chain - Daily Bans are deleted after 24 hours (I also want the ips logged, but the /etc/fail2ban/ip.blocklist.name is NOT logging any bans - It won't even make the file, and when I touch it, it stays at zero - I want 3 logs - Daily, yearly and permaban - so that when the proper threshold is reached, the ip is banned, placing it in the right chain (Daily, permaban, yearban) and then it would make an ip.blocklist.ssh-daily, ip.blocklist.ssh-yearban and ip.blocklist.ssh-permaban) But I can't get rid of the fail2ban.sshd chain - I would like to see the Daily Bans in 'fail2ban-ssh-daily' How do I do that, and keep the chains I specify?) I also want to be sure that the iptables rules are correct as well.
- Set up a Yearly Ban Chain: Yearly Bans are for those that would try to continually try to get into my server and they keep trying every day. These users would be placed in fail2ban-ssh-yearban and then their IP logged and loaded into the ip.blocklist.yearban. These users would be banned for 1 year after like 100 attempts against my server.
- Set Up a PERMABAN Chain: PERMA Bans are those who keep trying attacks against my server, or for those IPs that are on a list of the worst: China, India, etc. These IPs would be placed in fail2ban-ssh-PERMABAN, have their IPs logged, placed in hosts.deny, and then reported to badips.com or whatever the site name is. I think I have it set for 500 attampts against my server for this one.
The Problem is: I only see vanilla responses to questions relating to fail2ban: I have to setup the action.d/iptables-multiport file, and any filters that are needed, but I want to configure an iptables-ssh-daily, iptables-ssh-yearban, and iptables-ssh-permaban config files for each instance, but I have tried and failed miserably.
I also get a lot of junk in the /var/log/fail2ban.log, errors telling me that it didn't ban an address for some reason I cannot figure out - it breaks fail2ban unless I just start it up and don't change anything - otherwise it won't add ips to the blocklists, whether or NOT they exist, and it just doesn't filter properly - It will Mail me that an IP has been banned, but then in the failtoban log, I get 6-7 of the same IP being banned, and it is not logged or banned.
Does anyone know how to do what I am wanting to do? I want to keep track of these attempts, but the system does NOT want to work right unless I leave it stock.
How do I change fail2ban so that I get the following chain names and have the system add bans to the proper chains Daily, Yearly and Permaban?
They were all crossed out in red and fail2ban.sshd is still there. The edits in GREEN were not helpful and did not answer the questions I asked:
- I want rules that will use: -N fail2ban-ssh-daily ( for default fail2ban-sshd bans) -N fail2ban-ssh-permaban (for permanent bans) -N fail2ban-ssh-yearban (for yearly bans) (It added -N Fail2ban.sshd and that's the only place IPs go)
- I want to configure the iptables files for EACH bantype, and have a ip.blocklist for the chain in question ip.blocklist.daily, ip.blocklist.yearly and ipblocklist.permaban
I need a little help with the iptables so that the ban goes to the right chain. I will put the jail.local file below for my jails I want to use:
[ssh-daily] enabled = false filter = sshd action = iptables-ssh-daily[name=ssh-daily] sendmail-whois[name=SSH-Daily, dest=root@localhost, sender=root@localhost] logpath = %(sshd_log)s maxretry = 10 findtime = 600 bantime = 86400 [ssh-yearban] enabled = false filter = sshd action = iptables-ssh-yearban[name=ssh-yearban] sendmail-whois[name=SSH-Yearban, dest=root@localhost, sender=root@localhost] logpath = %(sshd_log)s maxretry = 35 findtime = 3153600 bantime = 3153600 [ssh-permaban] enabled = true filter = sshd action = iptables-ssh-permaban[name=ssh-permaban] sendmail-whois[name=SSH-PermaBan dest=root@localhost, sender=root@localhost] logpath = %(sshd_log)s maxretry = 100 findtime = -3153600 bantime = -3153600
The jails should work, but I need to make sure that for each stanza, it is adding IPs to the Daily, Yearly and Permaban chains and blocklists. It just errors out all over the place and I have a bunch of junk in
/var/log/fail2ban.log - I want to customize the setup, but I cannot get it to behave.
Now, Can someone please tell me what I would have to do to edit the iptables with the right rules, and help me to make sure that the action line works?