Fail2Ban
Fail2Ban is a third-party program that runs in the background and monitors logs. When specific loglines (such as the authentication challenge line shown previously) are seen a certain number of times, Fail2Ban takes an action. It can be programmed to e-mail you with an alert or automatically use IPTables to block an offending IP address after too many attempts occur within a certain period of time.
This book is not intended to be a complete guide for using Fail2Ban. However some sample scripts are given later in the chapter.
To configure Fail2Ban you will need to create several files which instruct Fail2Ban what to look for in your logs and what to do when it finds a match.
Fail2Ban default configuration has a folder where you can ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access