neomediatech/fail2ban repository overview

Fail2ban Docker image based on Ubuntu

Clone this repo if you want to use configs already set by me.

⁠Configs

• If you use AbuseIPDB⁠ to query and/or report malicious IP, set an AbuseIPDB API Key⁠ in confs/action.d/abuseipdb.local⁠ or declare the docker env var ABUSEIPDB_APIKEY
• If you want to use a Redis instance to store matches, configure confs/action.d/redis.local⁠ and set rhost and rport or declare the docker env vars REDIS_HOST, REDIS_PORT and REDIS_KEY
• Set nodename and ignoreip in jail.d/neo.conf⁠ to match your needs

⁠Running

BASE_DIR="/srv/data/docker/containers/fail2ban/"
NAME="fail2ban"
docker run -d --privileged --net=host --name $NAME --hostname $NAME -v $BASE_DIR/confs:/data neomediatech/$NAME

Add a bind mount where to point your logs that f2b need to monitor for ex: -v $BASE_DIR/logs:/var/log

⁠Warning

• Portainer doesn't understand env_file parameter (at least for now, 27 feb 2019).
• If you use fail2ban as Docker container keep attention to kernel version used in host and in compiling the image.
  If they differs may be you cannot see host iptables rules. (At least this is I saw using Ubuntu 22.04 on host and fail2ban compiled on a Ubunru 20.04). This is not a fail2ban problem, but a iptables problem with different kernels.

⁠Wishlist

• Use a init system to allow f2b to reload rules without reload container