Use of fail2ban

Routers
2

To set up fail2ban on GL-AXT1800, you can follow these steps:

  1. Open the configuration file for fail2ban: /etc/fail2ban/jail.conf. You can use this file as a reference to configure fail2ban on your GL-AXT1800.

  2. One important configuration setting is for the [dropbear] section. In this section, you can specify the following options:

    • enabled: set this to true to enable the fail2ban rule for dropbear.
    • port: specify the port where dropbear is running.
    • filter: specify the filter to use for dropbear.
    • logpath: specify the path to the log file where dropbear logs are written.
    • maxretry: specify the maximum number of retries before fail2ban blocks the IP address.
    • bantime: specify the duration of the ban in seconds.

    Here is an example configuration:

    [dropbear]
enabled  = true
port     = ssh
filter   = dropbear
logpath  = /var/log/messages
maxretry = 3
bantime  = 3600

  3. To allow fail2ban to observe the log file, you need to prepare the log file first. Run this command:

    logread -f > /var/log/messages &

    This command will start the logread process and redirect its output to /var/log/messages. The & at the end of the command will run the command in the background, so you can continue using the terminal.

    Without this command, fail2ban server will crash because it won’t have access to the log file.

2 Likes