Fail2Ban: Daemon to ban hosts from repeated authentication errors
Log-based intrusion prevention via dynamic firewall management.
Learn more about Fail2Ban
Fail2Ban is a Python-based intrusion prevention daemon that monitors system log files for patterns indicating malicious behavior and automatically updates firewall rules to block offending hosts. The system employs regular expression pattern matching against log entries to detect repeated authentication failures or other suspicious activity, then invokes backend handlers to modify firewall configurations through iptables, pf, or other packet filtering systems. It operates through a modular architecture of filters, which define the patterns to match in log files, and actions, which specify the defensive responses to take when thresholds are exceeded. The daemon supports both IPv4 and IPv6 address families and can be configured with custom jails that monitor arbitrary log sources and trigger time-limited or permanent bans based on administrator-defined criteria. This event-driven approach provides automated defense against brute-force attacks and distributed scanning attempts without requiring manual intervention or complex real-time traffic analysis.
Log-Based Detection System
Analyzes existing system logs without requiring application modifications or agent installation. Supports any text-based log format through configurable regex patterns, enabling protection for legacy services and custom applications.
Automatic Firewall Management
Directly updates iptables, pf, or other firewall backends to block attackers in real-time. Temporary bans expire automatically after configurable timeouts, preventing permanent blocks from legitimate users with failed credentials.
File-Based Configuration Framework
Ships with pre-built filters for common services like SSH, Apache, and Nginx. Custom jails and filters are defined through configuration files without code changes, allowing teams to protect new services by writing pattern definitions.
from fail2ban.client.csocket import CSocket
client = CSocket()
client.send(["status", "sshd"])
response = client.receive()
if response[0] == 0:
print(f"Banned IPs: {response[1]}")See how people are using Fail2Ban
Related Repositories
Discover similar tools and frameworks used by developers
Volatility Framework
Open-source Python framework for extracting digital artifacts from RAM samples for Windows, Linux, and macOS forensics.
DVWA
PHP/MariaDB training platform for web security exploitation practice.
CyberChef
Browser-based data transformation tool with chainable operations.
WhatsMyName
JSON dataset for checking username availability across hundreds of websites for OSINT tools.
Subfinder
Passive subdomain discovery via DNS resolution and validation.