LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices



Reply
 
Search this Thread
Old 02-17-2009, 12:36 AM   #1
SuperDude123
Member
 
Registered: Nov 2008
Posts: 158

Rep: Reputation: 30
Fail2ban, is it working?


I just installed fail2ban, but how do I know if its running? I checked in top and I didn't see it. I also don't want to try to log in a few times just to lock my self out.

How do I also know if it will load at start up?
 
Old 02-17-2009, 03:30 AM   #2
alan_ri
Senior Member
 
Registered: Dec 2007
Location: Croatia
Distribution: Debian GNU/Linux
Posts: 1,733
Blog Entries: 5

Rep: Reputation: 127Reputation: 127
fail2ban must be started by you.In open SUSE I would do
Code:
/etc/init.d/fail2ban start
to start it and
Code:
chkconfig --add fail2ban
to make f2b load on startup.F2b configuration files are stored in the /etc/fail2ban directory,so there you can configure it the way you want.
Quote:
Some of the configuration options are:
  • ignoreip: This is a space-separated list of IP addresses that cannot be blocked by fail2ban. For example, if the computer from which you're connecting to the server has a static IP address, you might want to list it here.
  • bantime: Time in seconds that a host is blocked if it was caught by fail2ban (600 seconds = 10 minutes).
  • maxretry: Max. number of failed login attempts before a host is blocked by fail2ban.
  • filter: Refers to the appropriate filter file in /etc/fail2ban/filter.d.
  • action: Refers to the appropriate action file in /etc/fail2ban/action.d.
  • logpath: The log file that fail2ban checks for failed login attempts.
If you're using Gnome,there is somewhere under System>Administration a "services" or similar option where you can add an app to be loaded on startup.There is something similar in the KDE.

Last edited by alan_ri; 02-17-2009 at 03:33 AM.
 
Old 02-17-2009, 01:34 PM   #3
SuperDude123
Member
 
Registered: Nov 2008
Posts: 158

Original Poster
Rep: Reputation: 30
How do I start it in Debian, and I need the commands since I'm doing this over SSH.
 
Old 02-17-2009, 01:41 PM   #4
repo
LQ 5k Club
 
Registered: May 2001
Location: Belgium
Distribution: Linux Mint
Posts: 8,516

Rep: Reputation: 896Reputation: 896Reputation: 896Reputation: 896Reputation: 896Reputation: 896Reputation: 896
in debian, when you installes it, it should also be started.

Code:
/etc/init.d/fail2ban restart
To see if it runs
Code:
ps ax | grep fail2ban
 
Old 02-17-2009, 01:47 PM   #5
SuperDude123
Member
 
Registered: Nov 2008
Posts: 158

Original Poster
Rep: Reputation: 30
When I do

ps ax | grep fail2ban

I get

2802 ? Sl 0:01 python2.4 /usr/bin/fail2ban-server -b -s /tmp/fail2ban.sock
3083 pts/0 S+ 0:00 grep fail2ban


Does this mean that it's running? How do I check if it will start when the system boots?
 
Old 02-17-2009, 01:54 PM   #6
repo
LQ 5k Club
 
Registered: May 2001
Location: Belgium
Distribution: Linux Mint
Posts: 8,516

Rep: Reputation: 896Reputation: 896Reputation: 896Reputation: 896Reputation: 896Reputation: 896Reputation: 896
Quote:
Does this mean that it's running? How do I check if it will start when the system boots?
yes it is running.
Since it is in /etc/init.d, it will start after every reboot.
 
Old 02-17-2009, 01:59 PM   #7
farslayer
Guru
 
Registered: Oct 2005
Location: Willoughby, Ohio
Distribution: linuxdebian
Posts: 7,232
Blog Entries: 5

Rep: Reputation: 189Reputation: 189
In Debian you can run sysv-rc-conf and see if fail2ban is checked in runlevel 2
 
Old 02-17-2009, 10:09 PM   #8
CaptainInsane
Member
 
Registered: Nov 2003
Location: Peoria
Distribution: Fedora 8
Posts: 92

Rep: Reputation: 15
You can check to see if it is running with:

fail2ban-client status

You can also do a iptables -L command to see if the rules have been added to iptables
if you are using that.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Need help with fail2ban regex jakev383 Linux - Security 6 12-07-2008 10:35 AM
Fail2ban and Firestarter baldur2630 Linux - Software 2 09-29-2008 06:46 AM
Fail2Ban Question nomb Debian 0 05-21-2007 08:28 AM
fail2ban and proftpd 1.3 reeseslover531 Linux - Security 4 02-14-2007 08:10 AM
Weird problem with fail2ban miza Linux - Software 0 10-28-2006 10:57 AM


All times are GMT -5. The time now is 09:43 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration