detecting-port-scanning-with-fail2ban

Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatically banning offending IP addresses and alerting security teams to suspicious network probing.

Ir a la instalación

Repositorio: AgentFlocks/flocks
Última actividad en el origen: 5 de mayo de 2026 a las 05:45
Idioma detectado de SKILL.md: inglés
Estrellas: 445
Forks: 83

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/AgentFlocks/flocks --skill detecting-port-scanning-with-fail2ban

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

5 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

Detecting Port Scanning with Fail2ban

When to Use

Automatically blocking IP addresses that perform port scans against internet-facing servers

Defending SSH, HTTP, FTP, and other services against brute force attacks with automated IP banning

Creating custom detection filters for organization-specific attack patterns in log files

Reducing noise from automated scanning bots before traffic reaches IDS/IPS for deeper analysis

Implementing defense-in-depth by adding host-based automated response to network monitoring

Do not use as the sole network security control, for protecting against distributed attacks from many source IPs, or as a replacement for proper firewall rules and network segmentation.

Prerequisites

Fail2ban 0.11+ installed (fail2ban-client --version)

Root/sudo access for iptables/nftables manipulation

Services logging connection attempts to parseable log files (syslog, auth.log, access.log)

iptables or nftables installed and operational as the host firewall

Optional: SMTP server for email notifications on ban events

Workflow

Step 1: Install and Configure Fail2ban

# Install Fail2ban sudo apt install -y fail2ban # Create local configuration (never edit jail.conf directly) sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local # Configure global defaults sudo tee /etc/fail2ban/jail.local << 'EOF' [DEFAULT] # Ban duration (1 hour default, escalates for repeat offenders) bantime = 3600 # Detection window findtime = 600 # Max failures before ban maxretry = 5 # Ban action using iptables banaction = iptables-multiport banaction_allports = iptables-allports # Email notifications destemail = security@example.com sender = fail2ban@example.com mta = sendmail action = %(action_mwl)s # Ignore internal networks ignoreip = 127.0.0.1/8 ::1 10.10.0.0/16 # Use systemd journal backend where available backend = systemd [sshd] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 3 bantime = 7200 findtime = 300 [sshd-ddos] enabled = port = ssh filter = sshd-ddos logpath = /var/log/auth.log maxretry = 6 bantime = 3600 EOF