Fail2ban

From Wikipedia, the free encyclopedia

Fail2Ban
Developer: Cyril Jaquier
Latest release: 0.7.3 / September 28, 2006
OS: GNU/Linux
Use: Intrusion Prevention
License: GPL v.2
Website: http://fail2ban.sourceforge.net

Fail2Ban scans log files (e.g. /var/log/pwdfail, /var/log/auth.log, etc) and bans IP that makes too many password failures or perfoms other non-wanted action (e.g. scans for the presence of vulnerable software on the website). It can perform multiple actions whenever an abusing IP was detected: update firewall rules (or alternatively hosts.deny) to reject abuser's IP address, email notifications, or any user defined action. Standard configuration ships filters for Apache, sshd, vsftpd, qmail, postfix, courier. Rules are given by Python regular expressions, thus can easily be crafted by the user.

Contents

[edit] Operation

[edit] Upstream Wiki Page Links

ChangeLog (List of changes)
Requirements (Needed requirements for Template:Fail2ban)
Features (List of current and planned features)
Screenshots (Screenshots)
Downloads (Template:Fail2ban for your distribution)
Links (Links related to Template:Fail2ban)

Documentation

README (Official README file)
Manual (Official Template:Fail2ban documentation)
FAQ (Frequently Asked Questions)
HOWTOs (HOWTOs contributed by users)
Reference Manual (Source code documentation)

Developers

Contributors (persons who contributed to the project)

[edit] See also

[edit] External links