Plesk

Protection Against Brute Force Attacks (Fail2Ban)

  • Dmitry Bystrov

    • IP address banning (Fail2Ban) is an automated way to protect your
    server from brute force attacks. Fail2Ban uses regular expressions to
    monitor log files for patterns corresponding to authentication failures,
    seeking for exploits, and other entries that can be considered
    suspicious. Such log entries are counted, and, when their number reaches
    some predefined value, Fail2Ban either sends a notification email or
    bans the attacker’s IP for a pre-defined length of time. When the ban
    period is over, the IP address is automatically unbanned.

    Fail2Ban logic is determined by a number of jails. A jail is a set of
    rules covering an individual scenario. The settings of the jail
    determine what is to be done once an attack is detected according to a
    predefined filter (a set of one or more regular expressions for
    monitoring the logs). For more information, see Fail2Ban Jails
    Management    .

    In Plesk Obsidian, Fail2Ban is enabled by default: all available
    jails are turned on and the default Fail2Ban settings are used.
    In most cases, we recommend keeping them but you may want to adjust them
    if necessary.

    To change Fail2Ban settings:

    1. Go to  Tools & Settings > IP Address Banning (Fail2Ban) (under “Security”).
    2. Go to the “Settings” tab. Here you can change:
      • IP address ban period – the time interval in seconds for which
        an IP address is banned. When this period is over, the IP address
        is automatically unbanned.
      • Time interval for detection of subsequent attacks - the time
        interval in seconds during which the system counts the number of
        unsuccessful login attempts and other unwanted actions from an IP
        address.
      • Number of failures before the IP address is banned – the
        number of failed login attempts from the IP address.
    3. Click OK.

    Fail2Ban in Plesk has the following limitations and peculiarities:

    Tweet
    Share
    Share
    Email
    0 Shares