Extending Fail2Ban configuration

About

This page explains how to tune/extend Fail2Ban the right way, so that Kolmisoft update scripts would not overwrite your changes.

Writing your own modifications for Fail2Ban

In order Kolmisoft update scripts would not overwrite your changes - you have to put it in file named the same way except the extension - it has to be named ".local" at the end instead of ".conf".

For example - if you would like to modify main configuration jail.conf - you would have to create your own configuration file named jail.local. Put all your changes there and Fail2Ban will use your configuration instead of Kolmisoft.

Important - you don't have to copy the whole jail.conf file to jail.local, you can just put there only one section you would like to behave differently. For example - default Kolmisoft Fail2Ban configuration file jail.conf has these rules:

[ast-hgc-200]
enabled  = true           
filter   = asterisk_hgc_200     
action   = iptables-allports[name=AST_HGC_200, port=5060, protocol=all]
          sendmail-banned[name=Asterisk_HGC_200]
logpath  = /var/log/asterisk/messages
maxretry = 20
bantime = -1

If you are an experienced user and you know that there should not be any unauthenticated calls in your system - it is advised to modify this configuration to look like this:

[ast-hgc-200]
enabled  = true           
filter   = asterisk_hgc_200     
action   = iptables-allports[name=AST_HGC_200, port=5060, protocol=all]
          sendmail-banned[name=Asterisk_HGC_200]
logpath  = /var/log/asterisk/messages
maxretry = 1
bantime = -1

You have to put this configuration to /etc/fail2ban/jail.local. This modification will ensure, that the offender will get ban from the first try.