Chef Infrastructure Automation Cookbook - Second Edition

Managing fail2ban to ban malicious IP addresses

Brute-force attacks against any of your password protected services, such as SSH, and break-in attempts against your web server happen frequently for every public-facing system.

The fail2ban tool monitors your log files and acts as soon as it discovers malicious behavior in the way you told it to. One common use case is blocking malicious IP addresses by establishing firewall rules on the fly using iptables.

In this section, we'll take a look at how to set up a basic protection for by SSH using fail2ban and iptables.

Getting ready

Make sure that you have a cookbook named my_cookbook and that the run_list of your node includes my_cookbook, as described in the Creating and using cookbooks recipe in Chapter ...