This note runs through [fail2ban](https://www.fail2ban.org), a free open-source tool to monitor running programs and deamons on a VPs.
```
 
```toc
style: number
```
 
---
 
### Installing Fail2Ban
[[#^Top|TOP]]
 
Type the following over command line and hit enter to begin installing Fail2Ban:
```ad-command
~~~bash
sudo apt-get install fail2ban
~~~
```
 
That will install the software for you however, by default Fail2Ban is only configured to ban failed SSH login attempts. For it to work more effectively, we need to enable some additional rules that will check the webserver or mtc logs for patterning indicating malicious activity.
 
---
 
### Modifying the general settings in Fail2Ban
[[#^Top|TOP]]
 
First, we need to modify the configuration file that Fail2Ban uses to determine which application logs should be monitored, and what actions should be taken when offending entries are identified.
For this you can use the supplied `/etc/fail2ban/jail.conf` file.
We must first however, copy this file over to prevent changes being overwritten if a package updated changes the default file.
To copy the default configuration file to a new file, named `/etc/fail2ban/jail.local`, use the following command:
Now we can open the newly copied file in order to set up the Apache log monitoring:
```ad-command
~~~bash
sudo nano /etc/fail2ban/jail.local
~~~
```
 
#### Adjusting the default settings
[[#^Top|TOP]]
The first thing to look at within the configuration file are the defaults, which are found under the `[DEFAULT]` section within the file. These items set the general policy, and all of them can be individually overridden in specific jails.
Here there are a few options you may want to configure, depending on your requirements.
A common option to change is the ***`ignoreip`*** setting. This allows you to specify an IP address that Fail2Ban should ignore, and not ban under any circumstances. It can be helpful to add your own IP address or network to this list to avoid locking yourself out! To add an IP address, just append it to the line separated by a space, and make sure that the line is uncommented.
Another item you may want to change is the ***`bantime`*** setting. This setting determines how long an offending IP address will be banned from the system for. Ideally, you want to set this to a long enough time to be effective at dissuading malicious parties, but also short enough to allow legitimate users to correct their mistakes and access the system.
The final two items to look at are the ***findtime*** and ***`maxretry`*** settings. The ***`findtime`*** item specifies an amount of time, and the ***`maxretry`*** item indicates the number of login attempts that will be tolerated within that time period. If a client attempting to access the system makes more than ***`maxtry`*** attempts within the amount of time set by ***`findtime`***, Fail2Ban will ban them.
 
---
 
### Configuring with a MTA
[[#^Top|TOP]]
 
#### Postfix
In order to monitor [[Configuring Postfix|Postfix]]'s SMTP connections through Fail2Ban, a few steps need to be taken.
failregex = lost connection after AUTH from (.*)\[<HOST>\]
ignoreregex =
~~~
```
 
4. Restart fail2ban
```ad-command
~~~bash
sudo systemctl restart fail2ban
~~~
```
 
---
 
### Configuring with a webserver
[[#^Top|TOP]]
 
#### Apache
This section focusses on enabling the Apache-specific jails that will monitor the logs of our web server for specific behaviour patterns, which it can then act upon.
Each jail within the configuration file is marked by a header, containing the jail name in square brackets.
**NOTE**: make sure to substitute your own static IP address for “192.0.2.0” in the ***`ignoreip`*** field..
 
3. Save and close the file, then restart Fail2Ban for the changes to take effect:
```ad-command
~~~bash
sudo systemctl restart fail2ban
~~~
```
 
Now you can use the following command to check the firewall rules added by Fail2Ban:
```ad-command
~~~bash
sudo iptables -L
~~~
```
 
You should see something like the following:
```ad-code
~~~bash
Chain fail2ban-apache (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain fail2ban-apache-badbots (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain fail2ban-apache-noscript (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain fail2ban-apache-overflows (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
~~~
```
 
#### NGINX
[[#^Top|TOP]]
This section focusses on enabling the NGINX-specific jails that will monitor the logs of our web server for specific behaviour patterns, which it can then act upon.
Each jail within the configuration file is marked by a header, containing the jail name in square brackets.
1. Edit the conf file
```ad-command
~~~bash
sudo nano /etc/fail2ban/jail.conf
~~~
```
 
2. Now, copy and paste which jails you prefer to use, remember to see the next section for the actual filter.
4. Save and close the file, then restart Fail2Ban for the changes to take effect:
```ad-command
~~~bash
sudo systemctl restart fail2ban
~~~
```
 
#### Caddy
[[#^Top|TOP]]
This section focusses on enabling the [[Configuring Caddy|caddy]]-specific jails that will monitor the logs of our web server for specific behaviour patterns, which it can then act upon.
Each jail within the configuration file is marked by a header, containing the jail name in square brackets.
