Fail2Ban – SSH, WordPress[ee] and Cloudflare

Fail2ban is an open-source intrusion prevention software framework that aims to protect computer servers from brute-force attacks. It works by continuously monitoring various log files for patterns indicating failed login attempts or other suspicious activity. When it detects such patterns, it can take action by dynamically updating firewall rules to block the source of the suspicious activity, thereby preventing further unauthorized access attempts. Fail2ban is highly configurable and widely used to enhance the security of servers, particularly those exposed to the internet.

Why is it important ?

Fail2ban is important for several reasons:

1. Enhanced Security: By automatically blocking IP addresses that exhibit suspicious behavior, Fail2ban helps to protect servers from unauthorized access attempts, brute-force attacks, and other malicious activities.
2. Reduced Risk of Compromise: By quickly responding to potential security threats, Fail2ban reduces the window of opportunity for attackers to compromise server systems.
3. Cost-Effective Security Measure: Fail2ban is open-source software, meaning it’s freely available and can be easily integrated into existing server setups without significant financial investment.
4. Customizable: Fail2ban is highly configurable, allowing system administrators to tailor it to their specific security needs and adjust settings based on the unique requirements of their servers.
5. Automated Response: Fail2ban automates the process of detecting and responding to security incidents, reducing the burden on system administrators and ensuring a timely response to potential threats.

Overall, Fail2ban plays a crucial role in strengthening the security posture of servers and mitigating the risk of unauthorized access and system compromise.

What can it do ?

Fail2ban primarily serves as an intrusion prevention system, and it can perform several key functions:

1. Monitoring Log Files: Fail2ban continuously monitors log files generated by various services such as SSH, FTP, Apache, Nginx, and others.
2. Detection of Suspicious Activity: It analyzes log entries in real-time to detect patterns indicative of potentially malicious behavior, such as multiple failed login attempts, authentication errors, or other anomalies.
3. Dynamic Firewall Rules: Upon detecting suspicious activity, Fail2ban dynamically updates firewall rules (e.g., iptables on Linux systems) to block the IP address associated with the detected activity. This prevents further access attempts from the same source.
4. Temporary Bans: Fail2ban typically imposes temporary bans on offending IP addresses, preventing access for a configurable period. This approach helps to mitigate the risk of legitimate users being permanently locked out due to mistaken identity or transient issues.
5. Alerting: Fail2ban can also be configured to send notifications or alerts to system administrators when suspicious activity is detected, allowing for timely investigation and response.
6. Whitelisting and Custom Rules: It supports the configuration of whitelists to exempt trusted IP addresses from being blocked and allows for the creation of custom rules to target specific types of suspicious activity.

Overall, Fail2ban provides a comprehensive set of features to enhance the security of servers by proactively identifying and mitigating potential threats in real-time.

What to do with this !?

While this is a really nice tool, which we can use for us to get our job done it can be hard to understand at first or to configure what we need.

https://github.com/iamimmanuelraj/fail2ban

This repository takes the opensource fail2ban tool and configures it to work with EasyEngine to block wordpress login attempts and ban them in DNS level [Cloudfalre only] and also ban any unnecessary and bad ssh login bruteforce.

This tool is only helpful when using you have a proper ssh key based authentication and a strong password for wordpress logins

Currently the setup.sh script does some basic configuration needed for all the setup.

It is configured to report the abused ip address also to abuseipdb.com

What does this do

• Uses fail2ban
• Bans bad ssh login actors
• Bans bad wordpress login actors [EasyEngine setup only]
• Stops wordpress bad login actors in DNS level [Works with cloudflare only]
• Reports the ip that abuses you to abuseipdb.com