Fail2ban
Ban addresses that keep guessing passwords — jails, ban rules, the never-ban list, and banning or unbanning by hand.
The firewall decides which ports are open. Fail2ban decides who gets to keep knocking. It watches log files for failed sign-ins and bans any address that gets it wrong too many times.
OSS Panel drives the real fail2ban service, so what you set here is what
fail2ban-client status reports.
If it isn't installed yet
On a server without fail2ban the page shows Fail2ban is not installed and a single Install fail2ban button. The install takes about a minute and switches nothing on — you choose what to watch afterwards. The page updates itself when it finishes.
Jails
A jail watches one service. Each one is a switch:
| State | Meaning |
|---|---|
| Not watching | The jail is off. Nothing is being checked. |
| Watching — all quiet | On, and nobody is currently failing. |
| N addresses failing right now | On, and that many are part-way to a ban. |
| N addresses banned | On, with bans in force. |
SSH (sshd) is the one that matters on nearly every server. Repeat
offenders (recidive) bans addresses that keep coming back after earlier bans
expire.
A jail can lock you out of your own server
Fail2ban does not know which address is yours. Switching on a jail that watches a service you administer over can ban you. The panel warns before enabling such a jail and offers to add your address to the never-ban list in the same step — take it.
Ban rules
The Ban rules tab holds the three numbers that apply to every jail, and the never-ban list.
The sentence at the top is the whole policy in one line — "Right now: 5 wrong tries in 10 minutes gets an address banned for 1 hour." The fields below it:
- Wrong tries allowed — a whole number from 2 to 100. One wrong try is usually a typo, which is why the floor is 2.
- Counted within (seconds) — 30 to 86400. Older tries are forgotten, so slow guessing never adds up to a ban.
- Banned for — how long before that address may try again, up to Forever.
Never ban these is the safety net. Addresses on it are never banned no matter how many times they get it wrong; localhost is always on the list. If the address you are connected from is missing, the panel says so and offers Add my address.
Saving reloads fail2ban, which takes a few seconds.
Removing your own address is confirmed
Taking the address you are currently connected from off the never-ban list asks you to confirm, because from that moment a jail can ban it and cut off your access.
Ban an address by hand
Click Ban an address on the Protection tab.
Enter one address. Ranges are rejected here — the field is a single IP. The panel refuses to ban your own address, and refuses to ban the server's own address, which would lock everyone out of the panel.
Pick the jail whose rules the ban is recorded under, then click Ban. The ban lasts for the current ban time from the Ban rules tab.
Unbanning
Unban on a row lifts one ban; Unban all clears the table. Both confirm first, and both are honest about what happens next — the address can reach the server again straight away, and fail2ban will ban it again if it trips the same rules.
See the log above the table opens the fail2ban log in System logs, which is where you go to find out why something was banned.
Limits and caveats
- Fail2ban reacts; it does not prevent. It bans after the wrong tries have already happened. Keys instead of passwords, and a firewall rule scoped to your own address, prevent.
- Bans are per jail. An address banned in
sshdcan still reach your website unless a web jail is watching too. - If the service is stopped, nothing is watched. The page says so and links to Services to start it again.
- The per-application Fail2ban screen is a different thing — it watches one site's access log. See Application Fail2ban.