fail2ban/fail2ban — Issue #19: Filter for fail2ban to long-ban repeat offenders
Author: cepheid666
Created: 2011-12-30 07:41:53+00:00
State: open

I saw this posted in the fail2ban community wiki, and I thought this would be a very good addition to the fail2ban standard filters. Many hackers/spammers like to hit the same server repeatedly; these are almost always completely malicious, and in many cases it would be a good idea to ban these guys long-term, to reduce load on the server since they are known to be repeat offenders.

Thus, one can have fail2ban monitor its own logfile, to see if it is banning a repeat offender and, if so, to implement a long-term ban. The implementation below has its drawbacks, namely in that it works only with iptables, or if you use a different blocking mechanism for this jail versus others (e.g. shorewall for most and iptables for this one).

The filter file (fail2ban.conf) is as follows:

```
# Fail2Ban configuration file
#
# Author: Tom Hendrikx, minor modifications by Amir Caspi
# See http://whyscream.net/wiki/index.php/Fail2ban_monitoring_Fail2ban
#
# $Revision: 1 $
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P[\w\-.^_]+)
# Values: TEXT
#
failregex = fail2ban.actions:\s+WARNING\s+\[(.*)\]\s+Ban\s+

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex = fail2ban.actions:\s+WARNING\s+\[(fail2ban)\]\s+Ban\s+
```

And my particular configuration in jail.conf is:

```
[fail2ban]

enabled = true
filter = fail2ban
action = iptables-allports[name=FAIL2BAN]
sendmail-whois-lines[name=FAIL2BAN, dest=root, sender=fail2ban@mail.com, logpath=/var/log/fail2ban.log]
logpath = /var/log/fail2ban.log
maxretry = 3
# Find-time: 1 day
findtime = 86400
# Ban-time: 1 week
bantime = 604800
```

While it has its limitations, I think this would be a good thing to include in the default set of filters, to allow users an easy access to a method to long-term block repeat offenders.