Installation de Fail2ban

Fail2ban est un IPS (Intrusion Prevention Software) open source.

Il permet de sécuriser les serveurs Linux contre les tentatives de connexions malveillantes et les attaques DDOS.

Fail2ban réduit les tentatives de connexion malveillantes en bloquant les adresses IP sources.

Installation & configuration du firewall UFW

sudo apt install ufw -y

Autorisation du SSH dans UFW

sudo ufw allow ssh

Activation du service UFW

sudo ufw enable

Installation & configuration de Fail2ban

sudo apt install fail2ban -y

Activation du service Fail2ban

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Configuration du service Fail2ban

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Ajout des IP LAN qui ne seront pas surveillées par Fail2ban

ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 192.168.10.20

Paramétrage du bannissement des IP

bantime  = 30d
findtime  = 10m
maxretry = 5

banaction = ufw
banaction_allports = ufw

Paramétrage de la récidive

[recidive]
enabled = true
logpath  = /var/log/fail2ban.log
banaction = %(banaction_allports)s
bantime  = 90d
findtime = 1d

Paramétrage du service SSHD

[sshd]
enabled  = true
port     = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

Paramétrage du service Apache2

[apache-badbots]

enabled  = true
port     = http,https
filter   = apache-badbots
logpath  = /var/log/apache*/*error.log
maxretry = 2

[apache-overflows]

enabled  = true
port     = http,https
filter   = apache-overflows
logpath  = /var/log/apache*/*error.log
maxretry = 2

[apache-nohome]

enabled  = true
port     = http,https
filter   = apache-nohome
logpath  = /var/log/apache*/*error.log
maxretry = 2

Redémarrage du service Fail2ban pour prendre en compte les paramètres

sudo systemctl restart fail2ban

ou

sudo systemctl reload fail2ban

Vérification du service Fail2ban

sudo fail2ban-client status sshd

sudo tail -f /var/log/fail2ban.log

Statut de UFW

sudo ufw status verbose

Liens

• https://www.howtoforge.com/how-to-install-fail2ban-on-ubuntu-22-04/#configuring-failban

• https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-22-04
• https://scalastic.io/ufw-fail2ban-nginx/
• https://fr.linux-console.net/?p=5262
• https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04
• https://k-lfa.info/securiser-fail2ban/