Fail2ban

bans IPs that cause multiple authentication errors

Monitors log files (e.g. /var/log/auth.log, /var/log/apache/access.log) and temporarily or persistently bans failure-prone addresses by updating existing firewall rules. The software was completely rewritten at version 0.7.0 and now allows easy specification of different actions to be taken such as to ban an IP using iptables or hostsdeny rules, or simply to send a notification email. Currently, by default, supports ssh/apache/vsftpd but configuration can be easily extended for monitoring any other ASCII file. All filters and actions are given in the config files, thus fail2ban can be adopted to be used with a variety of files and firewalls.

Homepage: Fail2ban

Pure-Ftpd/Shorewall

syslog

 Jan 27 09:32:58 hostname pure-ftpd: (?@81.169.128.26) [WARNING] Sorry, cleartext sessions are not accepted on this server. Please reconnect using SSL/TLS security mechanisms.

/etc/fail2ban/filter.d/pureftpd.conf

# Fail2Ban configuration file
#
# Author: JT
#
# $Revision: 2 $
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching.
# Values: TEXT
#
#Jan 27 09:32:58 hostname pure-ftpd: (?@81.169.128.26) [WARNING] Sorry, cleartext sessions are not accepted on this server. Please reconnect using SSL/TLS security mechanisms.
#
failregex = pure-ftpd: \(.*@<HOST>\) \[WARNING\] Sorry, cleartext sessions are not accepted.*

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

/etc/fail2ban/actions.d/shorewall.conf

# Fail2Ban configuration file
#
# Author: Cyril Jaquier ??? JT
#
# $Revision: 2 $
#

[Definition]

# Option:  fwstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart = echo -en "Hi,\n
              The jail <name> has been started successfuly.\n
              Regards,\n
              Fail2Ban"|mail -s "[Fail2Ban] <name>: started" <dest>

# Option:  fwend
# # Notes.:  command executed once at the end of Fail2Ban
# # Values:  CMD
# #
actionstop = echo -en "Hi,\n
             The jail <name> has been stopped.\n
             Regards,\n
             Fail2Ban"|mail -s "[Fail2Ban] <name>: stopped" <dest>

# Option:  fwcheck
# Notes.:  command executed once before each fwban command
# Values:  CMD
#
actioncheck =

# Option:  fwban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    <ip>  IP address
#          <failures>  number of failures
#          <time>  unix timestamp of the ban time
# Values:  CMD
#
actionban = shorewall drop <ip>
#actionban = shorewall reject <ip>

# Option:  fwunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    <ip>  IP address
#          <failures>  number of failures
#          <time>  unix timestamp of the ban time
# Values:  CMD
#
actionunban = shorewall allow <ip>

/etc/fail2ban/jail.conf

#
# To avoid merges during upgrades DO NOT MODIFY THIS FILE
# and rather provide your changes in /etc/fail2ban/jail.local
#

...

# Default action to take: ban & send an e-mail with whois report
# and relevant log lines to the destemail.
# action = iptables[name=%(__name__)s, port=%(port)s]
#          mail-whois-lines[name=%(__name__)s, dest=%(destemail)s, logpath=%(logpath)s]
action = shorewall[name=%(__name__)s, port=%(port)s]
          mail-whois-lines[name=%(__name__)s, dest=%(destemail)s, logpath=%(logpath)s]
...

[ssh]
enabled = true
port    = 22
filter  = sshd
logpath  = /var/log/auth.log
maxretry = 6

[pureftpd]
enabled  = true
port     = 21
filter   = pureftpd
logpath  = /var/log/syslog
maxretry = 6
...