{"id":297,"date":"2017-06-24T12:16:12","date_gmt":"2017-06-24T10:16:12","guid":{"rendered":"http:\/\/communaute-omr.fr\/?p=297"},"modified":"2026-06-06T15:31:43","modified_gmt":"2026-06-06T13:31:43","slug":"installation-et-configuration-de-fail2ban","status":"publish","type":"post","link":"https:\/\/communaute-omr.fr\/?p=297","title":{"rendered":"Installation et configuration de fail2ban"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">Pr\u00e9sentation de fail2ban<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">A quoi \u00e7a sert ?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fail2ban sert a analyser des fichiers de logs et cr\u00e9\u00e9 des r\u00e8gles iptables en fonction des actions que nous aurons d\u00e9finies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Par exemple fail2ban va analyser le fichier \/var\/log\/auth.log pour rechercher les connexions ayant \u00e9chou\u00e9es sur notre serveur.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Les actions sont d\u00e9finies dans un fichier prison (jail.conf)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;<\/p>\n\n\n\n<!--more-->\n\n\n\n<h1 class=\"wp-block-heading\">Installation fail2ban<\/h1>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">apt-get install fail2ban<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<h1 class=\"wp-block-heading\">D\u00e9marrage du service fail2ban<\/h1>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">service fail2ban start<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<h1 class=\"wp-block-heading\">&nbsp;Configuration de fail2ban<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Fonctionnement<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fail2ban founi un grand nombre de d&rsquo;action qui sont encadr\u00e9es par des balises.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La d\u00e9finition d&rsquo;une balise d&rsquo;encadrement est relativement simple \ud83d\ude42<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>[Nom de l&rsquo;action]<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Les champs important d&rsquo;un action :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>enabled : d\u00e9termine si l&rsquo;action doit \u00eatre activ\u00e9e par le service\n<ul class=\"wp-block-list\">\n<li>true ou false<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>port : d\u00e9termine le port d&rsquo;\u00e9coute de la r\u00e8gle<\/li>\n\n\n\n<li>filter : correspond au filtre (regex) d\u00e9fini dans le r\u00e9pertoire\u00a0<strong>\/etc\/fail2ban\/filter.d\/<\/strong><\/li>\n\n\n\n<li>logpath : chemin complet du fichier de log \u00e0 analys\u00e9<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Les variables par d\u00e9faut d\u00e9fines dans le fichier jail.conf peuvent \u00eatre surcharger directement depuis une action. Cela peut \u00eatre interressant si par exemple on ne veut pas utiliser le maxretry par d\u00e9faut.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Mise en place des actions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Cr\u00e9ation du fichier jail.local<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Afin de surcharger la configuration par d\u00e9faut de jail2ban nous allons cr\u00e9er le fichier jail.local.<\/p>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">touch \/etc\/fail2ban\/jail.local<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Une fois notre fichier local cr\u00e9\u00e9 nous pouvons personnaliser notre configuration<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Configuration<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Comportement par d\u00e9faut<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">En modifiant le fichier&nbsp;\/etc\/fail2ban\/jail.conf nous allons d\u00e9finir le comportement par d\u00e9faut de fail2ban<\/p>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">[DEFAULT]<br\/><br\/># &quot;ignoreip&quot; can be an IP address, a CIDR mask or a DNS host. Fail2ban will not<br\/># ban a host which matches an address in this list. Several addresses can be<br\/># defined using space separator.<br\/>ignoreip = 127.0.0.1\/8<br\/><br\/># External command that will take an tagged arguments to ignore, e.g. &lt;ip&gt;,<br\/># and return true if the IP is to be ignored. False otherwise.<br\/>#<br\/># ignorecommand = \/path\/to\/command &lt;ip&gt;<br\/>ignorecommand =<br\/><br\/># &quot;bantime&quot; is the number of seconds that a host is banned.<br\/>bantime  = 604800<br\/><br\/># A host is banned if it has generated &quot;maxretry&quot; during the last &quot;findtime&quot;<br\/># seconds.<br\/>findtime = 300<br\/>maxretry = 3<br\/><br\/># &quot;backend&quot; specifies the backend used to get files modification.<br\/># Available options are &quot;pyinotify&quot;, &quot;gamin&quot;, &quot;polling&quot; and &quot;auto&quot;.<br\/># This option can be overridden in each jail as well.<br\/>#<br\/># pyinotify: requires pyinotify (a file alteration monitor) to be installed.<br\/>#            If pyinotify is not installed, Fail2ban will use auto.<br\/># gamin:     requires Gamin (a file alteration monitor) to be installed.<br\/>#            If Gamin is not installed, Fail2ban will use auto.<br\/># polling:   uses a polling algorithm which does not require external libraries.<br\/># auto:      will try to use the following backends, in order:<br\/>#            pyinotify, gamin, polling.<br\/>backend = auto<br\/><br\/># &quot;usedns&quot; specifies if jails should trust hostnames in logs,<br\/>#   warn when reverse DNS lookups are performed, or ignore all hostnames in logs<br\/>#<br\/># yes:   if a hostname is encountered, a reverse DNS lookup will be performed.<br\/># warn:  if a hostname is encountered, a reverse DNS lookup will be performed,<br\/>#        but it will be logged as a warning.<br\/># no:    if a hostname is encountered, will not be used for banning,<br\/>#        but it will be logged as info.<br\/>usedns = warn<br\/><br\/>#<br\/># Destination email address used solely for the interpolations in<br\/># jail.{conf,local} configuration files.<br\/>destemail = L&#039;admin@communaute-omr.fr<br\/><br\/>#<br\/># Name of the sender for mta actions<br\/>sendername = Fail2Ban<br\/><br\/># Email address of the sender<br\/>sender = UnUser@communaute-omr.fr<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Dans ce d\u00e9but de fichier les lignes importantes sont :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ignoreip = 127.0.0.1\/8\n<ul class=\"wp-block-list\">\n<li>Par d\u00e9faut fail2ban ignore l&rsquo;ip local. vous pouvez rajouter d&rsquo;autres ip ou plage d&rsquo;ip en utilisant la virgule comme s\u00e9parateur<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>bantime = 600\n<ul class=\"wp-block-list\">\n<li>D\u00e9fini le temps de bannissement des vilaines ip qui nous attaquent. Perso je mets 604800 Sec soit 7 jours.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>findtime = 600\n<ul class=\"wp-block-list\">\n<li>D\u00e9termine la dur\u00e9e maximum entre la premi\u00e8re tentative et le nombre maximum de tetative de connexion<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>maxretry = 3\n<ul class=\"wp-block-list\">\n<li>Corrrespond au nombre maximum de tentatives de connexion<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>destemail = root@localhost\n<ul class=\"wp-block-list\">\n<li>Correspond au champs \u00ab\u00a0to :\u00a0\u00bb des mails de notifications<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>sendername = Fail2Ban\n<ul class=\"wp-block-list\">\n<li>L&rsquo;alias du champ \u00ab\u00a0from :\u00a0\u00bb dans le message.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>sender = fail2ban@localhost\n<ul class=\"wp-block-list\">\n<li>Adresse mail du champs \u00ab\u00a0from :\u00a0\u00bb du message<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Il n&rsquo;y a rien de plus a faire pour ce fichier. Nous pouvons maintenant personnaliser le fichier jail.local<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Le fichier jail.local<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Pr\u00e9sentation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">C&rsquo;est le fichier qui nous permettra de personnaliser les actions d\u00e9finies dans le fichier jail.conf.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Il est aussi possible de personnaliser les champs du chapitre pr\u00e9c\u00e9dent dans ce fichier.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">En effet, toutes variables ou action d\u00e9finies dans le fichier jail.local seront prioritaires sur celles d\u00e9finie dans le fichier jail.conf.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Personnalisation des actions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>Rappel : pour qu&rsquo;une action soit active, il faut positionner la vairable enabled \u00e0 \u00ab\u00a0true\u00a0\u00bb.<\/strong><\/em><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">banir les tentatives de connexion ssh echou\u00e9es<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">ci-dessous la regle ssh :<\/p>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">[ssh]<br\/><br\/>enabled  = true<br\/>port     = 22<br\/>filter   = sshd<br\/>action   = iptables[name=SSH, port=ssh, protocol=tcp]<br\/>logpath  = \/var\/log\/auth.log<br\/>maxretry = 3<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Ici le maxretry est positionn\u00e9 \u00e0 3. Si c&rsquo;est la valeur par d\u00e9faut dans le fichier jail.conf ce champs est facultatif.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">bannir les attaques ddos<\/h3>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">[ssh-ddos]<br\/><br\/>enabled  = true<br\/>port     = ssh<br\/>filter   = sshd-ddos<br\/>logpath  = \/var\/log\/auth.log<br\/>maxretry = 3<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">bannir les attaques sur nginx<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">http-get-dos<\/h4>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">[http-get-dos]<br\/><br\/>enabled = true<br\/>port = http,https<br\/>filter = http-get-dos<br\/>logpath = \/var\/log\/nginx\/access.log<br\/>maxretry = 360<br\/>findtime = 120<br\/>action = iptables[name=HTTP, port=http, protocol=tcp]<br\/>mail-whois-lines[name=%(__name__)s, dest=%(destemail)s, logpath=%(logpath)s]<br\/>bantime = 600<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Tentatives de connexion \u00e0 un site web<\/h3>\n\n\n<div class=\"wp-block-wab-pastacode\">\n\t<div class=\"code-embed-wrapper\"> <pre class=\"language-bash code-embed-pre line-numbers\"  data-start=\"1\" data-line-offset=\"0\"><code class=\"language-bash code-embed-code\">[nginx-auth]<br\/>enabled = true<br\/>filter = nginx-auth<br\/>action = iptables-multiport[name=NoAuthFailures, port=&quot;http,https&quot;]<br\/>logpath = \/var\/log\/nginx*\/*error*.log<br\/>maxretry = 6<br\/><br\/>[nginx-login]<br\/>enabled = true<br\/>filter = nginx-login<br\/>action = iptables-multiport[name=NoLoginFailures, port=&quot;http,https&quot;]<br\/>logpath = \/var\/log\/nginx*\/*access*.log<br\/>maxretry = 6<\/code><\/pre> <div class=\"code-embed-infos\"> <\/div> <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Pr\u00e9sentation de fail2ban A quoi \u00e7a sert ? Fail2ban sert a analyser des fichiers de logs et cr\u00e9\u00e9 des r\u00e8gles iptables en fonction des actions que nous aurons d\u00e9finies. Par exemple fail2ban va analyser le fichier \/var\/log\/auth.log pour rechercher les connexions ayant \u00e9chou\u00e9es sur notre serveur. Les actions sont d\u00e9finies dans un fichier prison (jail.conf) &hellip; <a href=\"https:\/\/communaute-omr.fr\/?p=297\" class=\"more-link\">Continuer la lecture<span class=\"screen-reader-text\"> de &laquo;&nbsp;Installation et configuration de fail2ban&nbsp;&raquo;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-297","post","type-post","status-publish","format-standard","hentry","category-non-classe"],"_links":{"self":[{"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=\/wp\/v2\/posts\/297","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=297"}],"version-history":[{"count":4,"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=\/wp\/v2\/posts\/297\/revisions"}],"predecessor-version":[{"id":494,"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=\/wp\/v2\/posts\/297\/revisions\/494"}],"wp:attachment":[{"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=297"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=297"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/communaute-omr.fr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=297"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}