Intrusion Detection & Prevention

Welcome to the final lesson on server security! We've covered firewalls and audits, which are crucial for prevention. But what if a determined attacker tries to bypass those defenses?

This lesson introduces Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). These tools provide an extra layer of active defense, helping you spot and stop malicious activity on your server.

An Intrusion Detection System (IDS) is like a security guard that constantly watches for suspicious activity. It monitors your server's network traffic or system logs for patterns that indicate an attack.

• Passive Monitoring: An IDS detects and alerts you about threats.
• No Blocking: It doesn't actively block or prevent the intrusion. Its job is purely to notify.
• Examples: Tools like Snort or Suricata can act as network-based IDS, analyzing incoming and outgoing data.

An Intrusion Prevention System (IPS) takes the IDS concept a step further. Instead of just alerting, an IPS actively intervenes to stop detected threats.

• Active Protection: It can automatically block malicious IP addresses, terminate suspicious connections, or drop harmful packets.
• Prevention Focus: The goal is to prevent the intrusion from succeeding in real-time.
• Fail2Ban: A popular example of a host-based IPS that we'll focus on today.

Fail2Ban is a powerful, open-source host-based IPS. It works by scanning log files (like those for SSH, web servers, or mail servers) for repeated failed login attempts or other suspicious patterns.

When it detects too many failed attempts from a single IP address within a specified time, Fail2Ban automatically updates your server's firewall rules to temporarily or permanently ban that IP address.

Fail2Ban operates using three core concepts:

• Filters: These are regular expressions that define patterns to look for in log files (e.g., 'failed password for root').
• Jails: A jail combines a filter with an action. It specifies which log file to monitor, which filter to use, and what action to take when the filter's conditions are met.
• Actions: These are the commands executed when an IP is banned, typically modifying firewall rules (like iptables or ufw) to block the source IP.

Fail2Ban is available in the default repositories of most Linux distributions. Let's install it on a Debian-based system (like Ubuntu).

First, update your package list, then install the fail2ban package:

Fail2Ban's main configuration file is /etc/fail2ban/jail.conf. However, you should never edit this file directly because it might be overwritten during updates.

Instead, create a copy named /etc/fail2ban/jail.local and make your changes there. This file overrides settings in jail.conf.

Here are some key global settings you might configure in jail.local:

• bantime: How long an IP is banned (e.g., 10m for 10 minutes).
• findtime: The window during which failed attempts are counted (e.g., 10m).
• maxretry: Number of failed attempts before an IP is banned (e.g., 5).

One of the most common uses for Fail2Ban is protecting SSH from brute-force attacks. In your /etc/fail2ban/jail.local file, you'll find sections for different services, called 'jails'.

To enable the SSH jail, you typically just need to set enabled = true under the [sshd] section. You can also customize its bantime, findtime, and maxretry values.

After editing, restart Fail2Ban for changes to take effect:

After configuring and starting Fail2Ban, you'll want to check its status and see if it's actively banning IPs. You can use the fail2ban-client command for this.

To check the overall status of Fail2Ban:

You've configured Fail2Ban to protect your SSH service. You set maxretry = 3 and bantime = 1h.

An attacker attempts to log in via SSH:

1. Failed login at 10:00:00
2. Failed login at 10:00:30
3. Failed login at 10:01:00
4. Failed login at 10:01:30

Assuming findtime is set to 10 minutes, what happens to the attacker's IP address?

Great job! You've learned how to add an active layer of defense to your server:

• IDS (Intrusion Detection System) detects and alerts on suspicious activity.
• IPS (Intrusion Prevention System) detects, alerts, and actively blocks threats.
• Fail2Ban is a host-based IPS that scans logs for malicious patterns and bans offending IP addresses by updating firewall rules.
• You learned to install Fail2Ban, configure global settings in jail.local, enable specific jails (like SSH), and monitor its status.

Implementing Fail2Ban significantly enhances your server's resilience against brute-force attacks and other automated threats. Keep practicing these skills to build truly robust and secure systems!