ttionya/fail2ban repository overview

⁠fail2ban

This project is forked from crazy-max/docker-fail2ban⁠ and modified based on it. Any subsequent mention of upstream refers to that project.

Note: If you are NOT looking for this project with a strong purpose, please use the crazymax/fail2ban⁠ image directly.

⁠About

Three modifications were made when rebuilding of this project:

1. Built based on debian:13-slim instead of alpine

   Alpine does not support the systemd backend. If you need to set backend: systemd due to the journal logging system, you can try using this image.

2. Support OpenSSH's new daemon name in sshd filter

   OpenSSH earlier renamed its daemon from sshd to sshd-session, which requires updating the journalmatch to correctly parse sshd logs. Fail2Ban has already merged the necessary changes but has not yet released a new version. For details, please refer to fail2ban/fail2ban#3782⁠ and fail2ban/fail2ban@54c0eff⁠.

   This project includes all 3 changes made to config/filter.d/sshd.conf between Fail2Ban version 1.1.0 and the current master branch (1.1.0...master⁠).

3. Built-in inotify-tools, including the inotifywait command.

   If your log file names rotate over time, you can use inotifywait to monitor file creation or deletion and reload Fail2Ban.

⁠Usage

⁠fail2ban

The configuration for Fail2Ban is the same as upstream, please refer to the crazy-max/docker-fail2ban documentation⁠.

⁠inotifywait

You can use the built-in inotifywait to monitor the creation and removal of log files.

You only need to mount the configuration file to /etc/inotifywait.conf. This configuration file is specific to this image.

The typical configuration file is as follows:

# fail2ban-client reload (for all)
-m -e create,moved_from --include .*\.access\..*\.log$ /var/logs/nginx

# fail2ban-client reload nginx
-m -e create,moved_from --include .*\.access\..*\.log$ /var/logs/nginx [nginx]

# fail2ban-client reload nginx && fail2ban-client reload httpd
-m -e create,moved_from --include .*\.access\..*\.log$ /var/logs/nginx [nginx httpd]

1. Each line is an option section for inotifywait (excluding the inotifywait command).
2. Blank lines and lines starting with # are ignored.
3. The trailing [jail] is OPTIONAL and represents which jails need to be reloaded when the watch is triggered, separated by SPACES.

⁠Example

docker run -d \
  --mount type=bind,source=/path/to/fail2ban/data,target=/data \
  --mount type=bind,source=/path/to/inotifywait.conf,target=/etc/inotifywait.conf \
  --mount type=bind,source=/path/to/logs,target=/var/logs \
  ttionya/fail2ban

⁠Versioning

The version is divided into three parts, separated by hyphens (-).

The image version number follows the upstream release method and only retains the fail2ban version number.

⁠Schedule

To ensure the use of the latest dependencies, this image is rebuilt every Monday at 6:00 AM.

⁠Thanks

• crazy-max/docker-fail2ban⁠
• Byh0ki/fail2ban⁠
• fail2ban/fail2ban⁠

⁠License

MIT