View source for Linux fail2ban Setup

=Introduction=
fail2ban is a tool to monitor http requests and activate ip firewall based on a config
=How I use it=
On my domain I monitor for 403 http codes if this is found then the IP is blocked for a configurable amount to time. We need to 
-Install fail2ban (just use apt)
-Make a filter
-Make/Append jail.local
-Restart
-Monitoring
=Make a filter=
To make a filter you pointer you create a file in /etc/fail2ban/filters.d. In this case we look for 403 errors and extract the remote host
<syntaxhighlight lang="conf">
[Definition]
failregex = ^.*"remote_ip":\s*"<HOST>".*"status":\s*403
datepattern = "ts": {UNIX_TIMESTAMP}
ignoreregex =
</syntaxhighlight>
=Make/Append jail.local=
If it exists append to /etc/fail2ban/jail.local
<syntaxhighlight lang="conf">
[caddy-json]
enabled  = true
filter   = caddy-json
port     = http,https
logpath  = /var/log/caddy/caddy_blah.access.log
maxretry = 5
findtime = 600
bantime  = 3600
</syntaxhighlight>
=Restart=
<syntaxhighlight lang="bash">
sudo systemctl restart fail2ban
</syntaxhighlight>
The robot mucked mine up the first time through but you can check with
<syntaxhighlight lang="bash">
sudo fail2ban-regex /var/log/caddy/access.json /etc/fail2ban/filter.d/caddy-json.conf
</syntaxhighlight>
Once all working you can list bans with
<syntaxhighlight lang="bash">
fail2ban-client status caddy-json
</syntaxhighlight>
This shows
<syntaxhighlight>
Status for the jail: caddy-json
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     26
|  `- File list:        /var/log/caddy/caddy_blah.access.log
`- Actions
   |- Currently banned: 0
   |- Total banned:     1
   `- Banned IP list:
</syntaxhighlight>
To remove a ban you can do the following (replace the IP you fool)
<syntaxhighlight lang="bash">
 sudo fail2ban-client set caddy-json unbanip 10.10.10.10
</syntaxhighlight>
=Monitoring=
Like most things you can send metrics to prometheous. Make a script to extract the metric /usr/local/bin/fail2ban_metrics.sh 
<syntaxhighlight lang="bash">
#!/bin/bash
echo "# HELP fail2ban_banned_total Number of banned IPs per jail"
echo "# TYPE fail2ban_banned_total gauge"

# Get list of jails
#jails=$(fail2ban-client status | grep 'Jail list:' | sed 's/.*Jail list:\s*//g' | tr ',' ' ')
jails=$(fail2ban-client status | awk -F': *' '/Jail list:/ {print $2}' | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')

# Loop through each jail and get banned count
#for jail in $jails; do
#    banned=$(fail2ban-client status "$jail" | grep 'Currently banned' | awk '{print $NF}')
#    echo "fail2ban_banned_total{jail=\"$jail\"} $banned"
#done
for jail in $jails; do
  banned=$(fail2ban-client status "$jail" 2>/dev/null | grep 'Currently banned' | awk '{print $NF}')
  if [[ "$banned" =~ ^[0-9]+$ ]]; then
    echo "fail2ban_banned_total{jail=\"$jail\"} $banned"
  else
    echo "fail2ban_banned_total{jail=\"$jail\"} 0"
  fi
done
</syntaxhighlight>
Stick it in the cron tab and check with prometheus that it is being processed.
<syntaxhighlight lang="bash">
curl  -u admin:notsaying-k --cacert /etc/prometheus/yourcert.crt  "https://localhost:9090/api/v1/query?query=fail2ban_banned_total" |jq
</syntaxhighlight>