How to install Fail2ban in rhel 6 & 7

What is fail2ban?

Fail2ban works by scanning and monitoring log files for selected entries then bans IPs that show the malicious signs like too many password failures, seeking for exploits, etc.


1. Install Fail2Ban


For RHEL 6


rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm


For RHEL 7


rpm -Uvh http://dl.fedoraproject.org/pub/epel/7/x86_64/Packages/e/epel-release-7-11.noarch.rpm

yum install fail2ban



2. Copy the Configuration File


The default fail2ban configuration file is located at /etc/fail2ban/jail.conf. The configuration work should not be done in that file, since it can be modified by package upgrades, but rather copy it so that we can make our changes safely.


We need to copy this to a file called jail.local for fail2ban to find it:


cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local



3. Configure defaults in Jail.Local


The first section of defaults covers the basic rules that fail2ban will follow to all services enabled for fail2ban that are not overridden in the service's own section.. If you want to set up more nuanced protection for your server, you can customize the details in each section.


You can see the default section below.

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1

# "bantime" is the number of seconds that a host is banned.
bantime  = 3600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 3

4. Add a jail file to protect SSH


Although you can add this parameters in the global jail.local file, it is a good practice to create seperate jail files for each of the services we want to protect with Fail2Ban.


So lets create a new jail for SSH with the vi editor.


vi /etc/fail2ban/jail.d/sshd.local


In the above file, add the following lines of code:


[sshd]
enabled = true
port = ssh
action = iptables-multiport
logpath = /var/log/secure
maxretry = 3
bantime = 3600

5. Restart Fail2Ban


service fail2ban restart


iptables -L



Check Fail2Ban Status

Use fail2ban-client command to query the overall status of the Fail2Ban jails.


fail2ban-client status


You can also query a specific jail status using the following command:

fail2ban-client status sshd


Manually Unban IP Banned by Fail2Ban


If for some reason you want to grant access to an IP that it is banned, use the following expression to manually unban an IP address, banned by fail2ban:

fail2ban-client set JAIL unbanip IP


eg. Unban IP 192.168.1.101, that was banned according to [ssh-iptables] jail:


fail2ban-client set sshd unbanip 192.168.1.101

How to take backup and restore svn repository

Step 1 

Create Dump from SVN repo

svnadmin dump /pathname/repo > /backup/svn/repo.dump

Compress backup svn to Gzip

For this we can compress the backup to and save disk size

svnadmin dump /pathname/repo | gzip -9 > /backup/svn/repo.dump.gz

Step 2

Restore Backup to repo

Create new repository with below command

svnadmin create /pathname/reponew

Now restore the dump to new repo

Before doing restore we need to unzip the dumb backup

gunzip /backup/svn/repo.dump.gz

svnadmin load /pathname/reponew < /backup/svn/repo.dumb

That’s all ……………….

How to take backup and restore data in graylog

Step 1

Graylog Backup Data

First we need to stop all the service of elasticsearch graylog-server

service elasticsearch stop

service graylog-server stop

Step 2

Now we are going to take dump backup from mongodb.

Mongo has content and setting of graylog. Use the below command to take dump backup.

logger -s -i “Dumping MongoDB” mkdir -p /u01/backup-graylogDB mongodump -h 127.0.0.1 -d graylog -o /u01/backup-graylogDB

This one for backup the contents and settings with data.

loger -s -i “Dumping MongoDB” tar -zcf /u01/backup-graylogDB/elasticsearch.tar.gz --directory=/var/lib/elasticsearch graylog

By default graylog indices have 12 gb by compressing it will reduce the size and save disk size.

Step 3

Graylog Restore Data

We need to stop the service like above.

Now untar the compress backup files with below command

tar xzf graylog.dump.tar.gz

tar xzf elasticsearch.tar.gz

Now restore the mongo Database with below command.

mongorestore -d graylog ./graylog

Now move the elasticsearch backup to their path.

mv elasticsearch /var/lib/elasticsearch

Now start the services of elasticsearch and graylog-server

service graylog-server start

service elasticsearch start

That’s all.