Secure linux server with fail2ban

I have written shortly about fail2ban earlier, but since fail2ban is so awesome application, I wanted to tell a little more about the application. It works like DenyHosts, which I am planning to test later.

Fail2ban is basically a tool that observers all login attempts to your server thru various services, like SSH, HTTPD, FTP, Telnet (oh god, no telnet, please!). If it finds failed login attempt many times in a row from the same IP / host, it blocks that IP / host with an iptables firewall rule. Handy piece of software, I say!

We're going to configure fail2ban to monitor SSH server, because I'm not using any other open service in my linux server. If you're using proftpd or some else server that requires authentication, it is quite easy to implement the changes to those servers, too!

1) Install fail2ban

Easiest way to install fail2ban is to use yum. As I have said before, it is easy to use yum and you win a lots of time when using it. If you know exactly what you're doing, go ahead and compile your own applications!

yum install fail2ban

Start fail2ban and create system startup links:

/etc/init.d/fail2ban start
chkconfig --levels 235 fail2ban on


2) Configuring fail2ban

Fail2ban configuration files can be found in the /etc/fail2ban directory. The default configuration is in jail.conf file. Take a look and you see it is not hard to understand! You can see [default] section at the beginning of the configuration file. You can override the settings below.

Here's explanations for the settings:

* ignoreip: This is a space-separated list of IP addresses that cannot be blocked by fail2ban. For example, if the computer from which you're connecting to the server has a static IP address, you might want to list it here.

* bantime: Time in seconds that a host is blocked if it was caught by fail2ban (600 seconds = 10 minutes).

* maxretry: Max. number of failed login attempts before a host is blocked by fail2ban.

* filter: Refers to the appropriate filter file in /etc/fail2ban/filter.d.

* action: Refers to the appropriate action file in /etc/fail2ban/action.d.

* logpath: The log file that fail2ban checks for failed login attempts.

Make sure to replace the email address you@mail.com with your own email address so that you get notified when someone gets blocked by fail2ban.

After you have edited your configuration to the way you want it, restart your fail2ban and you're good to go!

Fail2ban logs to /var/log/fail2ban.log, so you can check that file to find out if/what hosts got blocked. If a host got blocked by fail2ban, it looks like this:

2008-08-08 17:49:09,466 fail2ban.actions: WARNING [sshd] Ban 1.2.3.4
2008-08-08 18:08:33,213 fail2ban.actions: WARNING [sshd] Ban 1.2.3.4

You can also check your firewall to see if any hosts are currently blocked. Simply run

iptables -L

For services that use TCPWrappers to block hosts, take a look at /etc/hosts.deny.

Installing x11vnc on Fedora Core

This is a very short guide how to install x11vnc to your Fedora Core.

x11vnc allows one to view remotely and interact with real X displays (i.e. a display corresponding to a physical monitor, keyboard, and mouse) with any VNC viewer. In this way it plays the role for Unix/X11 that WinVNC plays for Windows.

x11vnc is by far the easiest available vnc server for Linux. Just download, configure/make, and off you go! And it works like a charm over ssh tunnel!

Here's how I installed x11vnc on my FC8:

1) Download .tar.gz from http://www.karlrunge.com/x11vnc/

2) Make sure you have X Software Development packets installed on your FC. To be sure, just open your sytem >> add/remove software, scroll down to development, and make sure you have X on your "x11 development".

3) After downloading http://www.karlrunge.com/x11vnc/x11vnc-0.9.4.tar.gz, just tar zxvf x11vnc-0.9.4.tar.gz, ./configure, make and make install

4) Now you have your x11vnc server ready to be tested... It's propably installed at /usr/bin/x11vnc, and you can test drive it by just typing the command "x11vnc".

Installing Truecrypt 5 on Fedora Core X86_64

This is a *VERY* short guide how to install Truecrypt 5.0 on Fedora Core x86_64. I installed TC on FC8, but this guide *should* work on any FC platform.

1) Download .deb -package (originally made for Ubuntu):
http://rapidshare.com/files/89758961/truecrypt_5.0-0ubuntu1_amd64.deb.html

2) Extract file with archive manager >> you get two different .tar.gz -files

3) Extract data.tar.gz to the root of your system.

4) start truecrypt from location /usr/sbin/truecrypt

If you are using i386 -version of Fedora Core, you can download Ubuntu packet from TC's homepage and use it to install Truecrypt on your FC.