fail2ban and use it to secure my server. I am going to provide you with general guidance about the tool and the security practices.
fail2ban is a log analyser that continuously scans the system logs for known attempts to break in, and that will put firewall rules to prevent the offending IP to establish connections at network level.
The main purpose of
fail2ban is to protect SSH and mail servers from brute force authentication attacks. The tool comes with a set of known regular expressions to detect failed login attepts. This is its main job.
Three points here:
- Fail2ban works on a pattern recognition, so it cannot detect anything that is now known earlier
- As soon as you can write log rules, fail2ban can use and ban people
- Fail2ban cannot detect suspicious activity, only deterministic
When you talk about suspicious activity, that is something
fail2ban is not made for. This is why you won't find jails. I suspect that you are not using the correct tool for your purpose.
Also, I would like to add a point about that. You mentioned "break into webserver". I assume you mean break into SSH, not a web application.
In my experience, I have two advices for you.
- Enhance SSH security to the strongest, detect root escalation attempts
Fail2ban might protect from bruteforced
Here is what you get in /var/log/messages if you fail to authenticate as root from sudo
sudo: pam_unix(sudo:auth): authentication failure; logname=user uid=1000 euid=0 tty=/dev/pts/0 ruser=user rhost= user=root
Unfortunately, it doesn't carry the IP address of the SSH client. Anyways, I see the log has a
rhost= field, so we could investigate how it gets populated.
Anyway, access to SSH in my opinion should be granted only to an extremely restricted audience, and file system shall be tightened to the best to prevent global files from being read by unauthorized audience. Public key authentication prevents people from choosing their own
- Detect attempts to hack your web server, not your application
Fail2ban can analyse log patterns. I have found this article as an example of Apache log analysis. In general, once you have patterns, you can add them to
fail2ban as attempts to attack. DDoS is an example, but rather difficult to detect from failure logs.
Popular applications (e.g. Wordpress) might have had known SQLi or XSS vulnerabilities. Robot farms attempt daily to hack into such installations by polling random addresses, even thosw who don't run the target applications.
Attempts to hack (via known vulnerability) a popular application have patterns. I could find some in my own logs, e.g. Unicode characters in the URL indicate suspicious things, but the core is that as soon as somebody knows an attack pattern they can add it to fail2ban rules.
All these practices, anyway, do not replace advanced or tailored security practices in the web world, such as
- Proactive monitoring
- Subscribing to security newsletters for popular application
- Using web application security tools for custom applications
The third point means: if you run your own web application, written by yourself or your consultant, you must make sure you or they follow best practices, e.g. OWASP, in securing the resources.
As a final example, think what happens if you own application accepts
https://host/orderApp/orders?orderId=4587935793 by only checking that the user is logged in with correct role but without checking the ownership of the order. (source: I have seen exactly that in financial applications)
fail2ban was made to prevent brute force attacks. It is the right tool to protect only from known threats once you master the rules. Ask on serverfault.com about how to properly write new rules and jails
fail2ban is definitely not the tool for such use case. You need to examine logs and the system to detect the effects of a break in your application (say, a remote code execution vulnerability).
Once you happen to find it, fail2ban can only help you stop repeating that attack at a fast rate, but it doesn't prevent the first strike (since there must be a log of the perpetrated attack for fail2ban to notice).
Really, if you find a vulnerability in your application the only thing you can do is to fix it!!!