[OPGELOST]fail2ban

[henkoegema]

Bij het configureren van fail2ban lees ik op https://www.digitalocean.com/community/articles/how-to-protect-ssh-with-fail2ban-on-centos-6 het volgende:


The default fail2ban configuration file is location at /etc/fail2ban/jail.conf. The configuration work should not be done in that file, however, and we should instead make a local copy of it.

Code: [Selecteer]

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
After the file is copied, you can make all of your changes within the new jail.local file. Many of possible services that may need protection are in the file already. Each is located in its own section, configured and turned off.

Vraag: Betekent dit dat jail.local een hogere prioriteit heeft dan jail.conf  om instelling in te lezen ?

[Johan van Dijk]

Dit werkt in Ubuntu hetzelfde:

# This file was composed for Debian systems from the original one
#  provided now under /usr/share/doc/fail2ban/examples/jail.conf
#  for additional examples.
#
# To avoid merges during upgrades DO NOT MODIFY THIS FILE
# and rather provide your changes in /etc/fail2ban/jail.local

En van http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Configuration

Every .conf file can be overridden with a file named .local. The .conf file is read first, then .local, with later settings overriding earlier ones. Thus, a .local file doesn't have to include everything in the corresponding .conf file, only those settings that you wish to override.

Ik heb hier ook gewoon een kopie gemaakt en in het nieuwe bestand wat dingetjes veranderd.

Mocht je de UFW firewall in Ubuntu gebruiken, dan heb je hier een voorbeeld die ik op mijn computer gebruik:

jail.local:

Code: [Selecteer]

[ssh]

enabled  = true
banaction = ufw-ssh
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 6
action.d/ufw-ssh.conf:

Code: [Selecteer]

[Definition]
actionstart =
actionstop =
actioncheck =
actionban = ufw insert 1 deny from <ip> to any app OpenSSH
actionunban = ufw delete deny from <ip> to any app OpenSSH

[henkoegema]

Dank je Johan.  Dat bevestigt inderdaad wat ik al vermoedde.