Running rootless fail2ban on debian

Where possible we prefer to run services as a non-root user. fail2ban also supports this, however the run-rootless.txt docs don't fully detail all the necessary steps.

Some of the steps are explained in the /etc/default/fail2ban config script. In addition to these a few other steps are needed. Below are all the steps to get a working rootless fail2ban on debian wheezy.

• Edit /etc/default/fail2ban
  • set the variable on the last line FAIL2BAN_USER="fail2ban"
• Run the command to create the user
  • useradd --system --no-create-home --home-dir / --groups adm fail2ban
• Edit your /etc/fail2ban/jail.local with the overrides for your local environment.
  • The key argument here is the banaction.
  • Add any other trusted IP's to the igonreip setting.

[DEFAULT]
banaction = iptables-xt_recent-echo
ignoreip = 127.0.0.1/8 10.1.1.0/24
bantime = 3600
destemail = ops@domain.org
chain = F2B

• Add the following line to /etc/fail2ban/action.d/iptables-xt_recent-echo.local
  • Since fail2ban runs as a non-root user it won't be able to add the necessary iptables "recent" module entry. We'll add this manually later.

[Definition]
actionstart =

• Set up iptables with lines such as the following.
  • NOTE THIS IS NOT A COMPLETE IPTABLES RULE SET, ONLY THE LINES FOR FAIL2BAN!!
  • These tell iptables to use the "recent" module to look for IP's from which it will drop the packets. The table referenced is /proc/net/recent/fail2ban-ssh as referenced by the --name argument. This is the file fail2ban will add IP's to, and iptables will be responsible for removing these IP's after the --seconds timeout.

$IPTABLES -N F2B
$IPTABLES -A INPUT -i eth0 -p tcp --dport 22 -j F2B
$IPTABLES -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
$IPTABLES -A FORWARD -i eth0 -p tcp --dport 22 -j F2B
$IPTABLES -A FORWARD -i eth0 -p tcp --dport 22 -j ACCEPT
$IPTABLES -A F2B -p tcp --dport 22 -m recent --update --seconds 3600 --name fail2ban-ssh -j DROP
$IPTABLES -A F2B -j RETURN

• Restart fail2ban and test
  • /etc/init.d/fail2ban restart
  • If you get the error Restarting authentication failure monitor: fail2banfind: '/proc/net/xt_recent': No such file or directory it means you haven't activated the iptables rule with the "recent" module from the previous step.