Fail2ban

Functionality:

Fail2Ban operates by monitoring log files (e.g. /var/log/auth.log, /var/log/apache/access.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP address that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator. Fail2Ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.

Contends of this package:

This package installs Fail2ban on BlueOnyx 5210R, 5211R and 5212R and activates it to protect the common internet facing services found on a BlueOnyx.

Fail2ban can be configured in the BlueOnyx GUI to use various methods to ban offending IP addresses. The availability of methods depends on which additional Shop packages (like APF/Firewalld) are installed. If APF/Firewalld is not present, Fail2ban will use nullroutes instead. If multiple methods for banning access are possible, then you can choose one in the GUI.

This package comes with a GUI interface that allows you to enable/disable Fail2ban and to configure the most common settings via the BlueOnyx GUI.

Recommendations:

Fail2ban should not be used at the same time with the packages Dfix or Dfix2. If you have Dfix2 installed and want to try Fail2ban, then simply disable Dfix2 via the GUI or uninstall Dfix2 first. The older Dfix *must* be uninstalled before you install Fail2ban.