Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Hello and happy new year,

I am wondering if I can use fail2ban on a virtual host that uses bridge-util. I am using LXC containers for virtualization and have therefore direct access to all the log files from the host environment. It would be great if I could install fail2ban just on the host and secure all the virtual boxes at once.

I am just not sure how well fail2ban works with bridge-util, or if there is anything I have to consider with this approach.

Thanks, and lets hope for a better year (2012)

share|improve this question

1 Answer 1

Happy new year :)

fail2ban can work with custom commands. You need:

cd /etc/fail2ban

cp jail.conf jail.local

In jail.local:

[ssh-host1]
enabled = true
port=ssh
filter=sshd
logpath=/path/to/host1/logs/auth.log
maxretry=6
banaction=bridge-utils

Create action.d/bridge-utils.local:

[Definition]
# executed once at the start of fail2ban
actionstart = brctl ...
# executed once at the end of fail2ban
actionstop = brctl ...
# executed once before each actionban command
actioncheck = ...
# ban action
actionban = brctl ...
            brctl ...
# unban action
actionunban = brctl ...
              brctl ...

[Init]
# some default variables here

Restart fail2ban and test if it's working right.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"//careers.stackoverflow.com?utm_source=stackoverflow.com&amp;utm_medium=site-ui&amp;utm_campaign=footerlink\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2014 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a>                   with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2014.12.28.2142\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Server Fault works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\"dno\"></div>\r\n    </nosc"], "copyright__copyright__copyright": ["tl ...\n# executed once before each actionban command\nactioncheck = ...\n# ban action\nactionban = brctl ...\n            brctl ...\n# unban action\nactionunban = brctl ...\n              brctl ...\n\n[Init]\n# some default variables here\n\nRestart fail2ban and test if it's working right.\n\nshare|improve this answer\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}