Fail2ban
Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.
1 Installation
First, install Gamin so that Fail2ban can detect modification to the log files:
# pacman -S gamin
Then, install fail2ban:
# pacman -S fail2ban
If you want Fail2ban to send an email when someone has been banned, you have to configure SSMTP (for example). You will also have to install whois to get some information about the attacker.
# pacman -S whois
Now you can start the fail2ban daemon:
# /etc/rc.d/fail2ban start
You can add it into DAEMONS array in /etc/rc.conf:
DAEMONS=(... fail2ban ...)
2 SSH jail
Edit /etc/fail2ban/jail.conf and modify the ssh-iptables section to enable it and configure the action.
If your firewall is iptables:
[ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois[name=SSH, dest=your@mail.org, sender=fail2ban@mail.com] logpath = /var/log/auth.log maxretry = 5
If your firewall is shorewall:
[ssh-shorewall] enabled = true filter = sshd action = shorewall sendmail-whois[name=SSH, dest=your@mail.org, sender=fail2ban@mail.com] logpath = /var/log/auth.log maxretry = 5
Also do not forget to add/change:
LogLevel VERBOSE
in your /etc/ssh/sshd_config. Else, password failures are not logged correctly.