@UFHH01,
In response to your post, the following.
could you explain, why you declare a maximum value of "604800" seconds for a Fail2Ban bantime? You can even use a bantime of "-1" ( => 0, which defines a bantime without time limits => permanent ban ), so it's not clear, why you declare a time limitation.
In short, the "7 day maximum" (i.e. 604800) is the maximum period that can be set (in seconds).
Furthermore, the "-1 setting" does not work or does not work properly all the time and/or in all versions.
The same applies to ">604800 seconds" settings.
You can verify this by doing an intensive, long-run test (> 2 months).
Fail2Ban gives the option to whitelist ( ignore ) IPs, which you definetly should use for localhost, your server IP(s) and additional service IP(s). You find this setting over the Plesk Control Panel ....
Source: Protection Against Brute Force Attacks (Fail2Ban) ( Plesk 12 online documentation )
....
and as always at the "
/etc/fail2ban/jail.conf":
Example and description at jail.conf: ...
Not necessary to fiddle with the jail.conf file.
It certainly is not adviceable, given the fact that Fail2Ban is allowing for customization in the jail.local file.
Fail2Ban allows and almost prefers all customizations via .local files. Read the "README" file.
Plesk Panel uses the jail.local file to add whitelisted IPs.
In short, after adding a whitelisted IP via the Plesk Panel, no change in jail.conf is required or necessary.
I can't see any disadvantage of an iptables entry over Fail2Ban to a Plesk Firewall ruleset - could you explain, why you seem to prefer a Plesk Firewall rule to a Fail2Ban ban ( which might be permanent and temporary ) ?
Fail2Ban is based on filters, which are very prone to errors due to faulty regexps.
Iptables is based on complex rules, which are very prone to errors, as such very dangerous for the inexperienced sysadmin.
Plesk Firewall is just making work (relatively) easy and (automatically) creates the ruleset that one also can create with manual iptables edits.
Plesk Firewall has some nice advantages over manual editing of firewall rulesets, being
- the creation of rulesets, before activating them (in a different way that iptables allows),
- the possibility to revert some of the (still not activated) rulesets, making it less likely that errors and/or mistakes result in a shutdown of access to the server
- the impossibility to flush rules and/or rulesets with one accidental command, making it more safe,
- easy editing of existing firewall rules and/or rulesets,
and so on.
Fail2Ban is often creating (temporary) rules, that CAN be duplicates of other rules, making the firewall less effective and/or efficient.
Iptables is not that "easy" and/or "forgiving", it is easy for the inexperienced sysadmin to create duplicate rules, when manually editing the firewall.
Plesk Firewall is just making work (relatively) easy and it is very unlikely that duplicate rulesets, as such ineffective and/or inefficient rulesets, are created.
Plesk Firewall in combination with Fail2Ban is associated with
- invisibility of Fail2Ban additions to the (iptables) firewall,
- short duration of Fail2Ban additions to the (iptabels) firewall and hence reduced exposure to ineffectiveness and/or inefficiency.
In short, one can do whatever one desires, but it is adviceable to
- keep temporary IP bans automated with Fail2Ban,
- manage permanent IP blocks with iptables and/or Plesk Firewall, with Plesk Firewall being more safe, easy and so on.
Really, nobody wants to use iptables (certainly not if a GUI in Plesk exists), when a single iptables command can flush all firewall rules/rulesets and/or block full access.
Kind regards.....
'busted'
Facebook
Twitter
