fail2ban for the web server

That is all you type

“Set up fail2ban on web03: for SSH and for the portal's login page under /login. Our office 203.0.113.0/24 must never be banned. Show me afterwards what is running.”

Who: The admin, between two meetings
Server: web03, web server of the customer portal
Your part: One sentence
Level: rwx Changes alone, see the three levels

Problem

The logs of web03 are full of login attempts: at SSH and at the portal's login page, thousands a day, most of them from a few addresses. fail2ban is the answer, but a filter for nginx has to be written and checked, and whoever is too strict bans customers who mistype three times, or worse: the own office. So it has been lying around for months.

Wanted: bans for SSH and the login page, never for the office, and a look afterwards at what it does.

Solution

One sentence, and Heinzel Pro first counts what knocks, writes filter and jails, starts the service and shows the first bans. At "Changes alone" none of it waits for you.

Step 1: You describe the task, with the exception

The sentence above names the two doors and the one address that must never close. You pick web03 and set the level to "Changes alone": a service that bans is routine, and the office is in the sentence.

A new session in Heinzel Pro: the typed sentence about fail2ban with the office as the exception, below it the chosen server web03 and the level "Changes alone"

Step 2: Heinzel Pro counts what knocks

Three reading commands: the failed SSH logins of the last 24 hours and their senders, the failed attempts at /login, and whether fail2ban is installed yet. The finding: 1,842 at SSH, 3,127 at the login page, and among them 41 from the office, from somebody who mistypes. Exactly that person must not be banned.

The session: three reading commands with their output, the count of login attempts at SSH and /login with the most frequent addresses, below them Heinzel Pro's answer with the finding and the intent

Step 3: The plan is there before it starts

Four steps: install, write and check the filter and two jails, start the service, show what runs. With them the thresholds, five failed attempts in ten minutes, a ban of one hour, and why they are chosen so. At this level nobody approves the plan; it is there all the same, and you read afterwards what Heinzel Pro set out to do.

The plan in the session: four steps with command, server and classification, below them what could go wrong and how to undo it, with the note that the session changes alone

Step 4: Heinzel Pro shows the first bans

Two jails run. In the first minute three SSH addresses and two at the login page are banned, one of them in both; the office is among the exceptions, the colleague with the 41 failed attempts is left alone. The journal of web03 holds the filter and the command that lifts a ban by hand.

The session afterwards: the last command with the output of fail2ban-client, both jails, the banned addresses and the exceptions, the journal entry for web03 and Heinzel Pro's closing message