Security Monitoring: Protecting the Front Door

In the previous lessons, we learned how to monitor performance and disk space. But for a server connected to the internet, the most important thing to monitor is Human Behavior.

Bots are constantly trying to guess your passwords (Brute Force). If you look at your server's logs, you will likely see hundreds of failed login attempts every hour. You shouldn't ignore these. You should use your logs to fight back.

In this lesson, we will focus on auth.log and the automated security tool Fail2Ban.

---

1. Analyzing auth.log: The Security Camera

Every time someone types a password into your server (valid or invalid), a record is created in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (Red Hat/CentOS).

Identifying an Attack:

A normal login looks like this: Mar 27 10:00:00 server sshd[123]: Accepted password for sudeep ...

A brute-force attack looks like this (repeated 500 times): Mar 27 10:00:02 server sshd[456]: Failed password for invalid user admin ... Mar 27 10:00:03 server sshd[789]: Failed password for invalid user root ...

---

2. Fail2Ban: The Automated Bouncer

Fail2Ban is a "Log-Scanning Daemon." It works in a three-step cycle:

1. Scan: It watches your auth.log files in real-time.
2. Match: It looks for patterns (RegEx) that indicate an attack (e.g., "3 failed logins in 1 minute from the same IP").
3. Execute: It automatically adds a rule to your Firewall (nftables/ufw) to block that IP address for a set amount of time (e.g., 24 hours).

---

3. Configuring your First 'Jail'

A "Jail" is a Fail2Ban policy for a specific service. You configure them in /etc/fail2ban/jail.local.

[sshd]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3
findtime = 10m
bantime  = 24h

The Logic:

• maxretry = 3: If they fail 3 times...
• findtime = 10m: ...within a 10-minute window...
• bantime = 24h: ...they are banned for 24 hours.

---

4. Practical: Managing the Banned

Sometimes, you (the admin) might accidentally mess up your password and get banned by your own server. You need to know how to "Release" an IP from jail.

# See which IPs are currently in jail
sudo fail2ban-client status sshd

# Unban a specific IP address
sudo fail2ban-client set sshd unbanip 1.2.3.4

---

5. Protecting More than SSH

Fail2Ban is highly flexible. You can use it to protect:

• Nginx/Apache: Block people trying to guess the URL to your admin panel.
• Nextcloud/Wordpress: Block people trying to log into your web apps.
• Custom Apps: If your app writes "Login failed" to a log file, Fail2Ban can protect it.

---

6. Example: A Brute-Force Heatmap (Python)

If you have servers across the world, you want to see which countries are attacking you the most. Here is a Python script that parses auth.log and aggregates the IPs of attackers.

import re
import collections

def analyze_attacks(log_path="/var/log/auth.log"):
    """
    Finds unique IPs that have failed login attempts.
    """
    print(f"--- Top Attacking IPs in {log_path} ---")
    
    # Regex to find IP addresses in failed password lines
    # Failed password for root from 1.2.3.4 port ...
    pattern = r"Failed password for .+ from ([\d\.]+)"
    
    attackers = collections.Counter()
    
    with open(log_path, "r", errors="ignore") as f:
        for line in f:
            if "Failed password" in line:
                match = re.search(pattern, line)
                if match:
                    ip = match.group(1)
                    attackers[ip] += 1
                    
    for ip, count in attackers.most_common(10):
        print(f"{ip:15} | {count} attempts")

if __name__ == "__main__":
    analyze_attacks()

---

7. Professional Tip: Jail the "Invalid Users"

Attackers always try to log in as root, admin, guest, or ubnt. In your SSH configuration, you should disable root login entirely. In Fail2Ban, you can create a rule that says: "If someone even implies they are trying to log in as an invalid user, ban them immediately for 48 hours."

---

8. Summary

Security monitoring is about turning your logs into a shield.

• auth.log is the primary record of identity attempts.
• Fail2Ban provides automated, rule-based firewall responses.
• Jail configuration allows you to customize the "Strictness" per service.
• fail2ban-client is your tool for managing bans.
• Log analysis is the foundation of incident response.

This concludes Module 13: System Logging and Monitoring. You now have the skills to watch, record, visualize, and protect your Linux environments.

In the next module, we will explore the human side of security: Linux Security Fundamentals—SSH, Sudo, and PAM.

Quiz Questions

1. Why is Fail2Ban better than simply having a firewall?
2. What is the difference between "findtime" and "bantime" in a Fail2Ban configuration?
3. How do you check if Fail2Ban has successfully added a rule to your system's firewall?

---

End of Module 13. Proceed to Module 14: Linux Security Fundamentals.