Merge pull request linode#885 from EdwardAngert/f2b-markdownfix

EdwardAngert · web-flow · commit a0cb44e105a2 · 2017-08-23T18:37:05.000-04:00
Fail2ban markdownfix and some light bonus copyedit
diff --git a/docs/security/using-fail2ban-for-security.md b/docs/security/using-fail2ban-for-security.md
@@ -2,18 +2,18 @@
 author:
   name: Elle Krout
   email: ekrout@linode.com
-description: 'Use Fail2ban to block automated system attacks and further harden your server. Fail2ban monitors system logs for symptoms of an automated attack, bans the IP and alerts you of the attach through email.'
-keywords: 'fail2ban'
+description: 'Fail2ban monitors system logs for symptoms of an automated attack, bans the IP and alerts you of the attach through email. Use Fail2ban to thwart automated system attacks and further harden your server.'
+keywords: 'fail2ban,ip whitelisting,jail.local'
 alias: ['tools-reference/tools/using-fail2ban-to-block-network-probes/']
 license: '[CC BY-ND 4.0](https://creativecommons.org/licenses/by-nd/4.0)'
-modified: Wednesday, March 8th, 2017
+modified: Wednesday, August 23, 2017
 modified_by:
   name: Linode
 published: 'Monday, October 12th, 2015'
 title: Using Fail2ban to Secure Your Server
 ---
 
-Fail2ban is a log-parsing application that monitors system logs for symptoms of an automated attack on your Linode. When an attempted compromise is located, using the defined parameters, Fail2ban will add a new rule to iptables, thus blocking the IP address of the attacker, either for a set amount of time or permanently. Fail2ban will also alert you through email that an attack is occurring.
+Fail2ban is a log-parsing application that monitors system logs for symptoms of an automated attack on your Linode. When an attempted compromise is located, using the defined parameters, Fail2ban will add a new rule to iptables to block the IP address of the attacker, either for a set amount of time or permanently. Fail2ban can also alert you through email that an attack is occurring.
 
 ![Using Fail2ban to secure your server](/docs/assets/fail2ban_tg.png "Using Fail2ban to secure your server")
 
@@ -27,7 +27,7 @@ Fail2ban is primarily focused on SSH attacks, although it can be further configu
 >
 >Fail2ban is intended to be used in conjunction with an already-hardened server and should not be used as a replacement for secure firewall rules.
 
-## Installing Fail2ban
+## 1) Install Fail2ban
 
 Follow the [Getting Started](/docs/getting-started) guide to configure your basic server. You may also want to review the [Securing Your Server](/docs/security/securing-your-server) guide before beginning.
 
@@ -121,55 +121,59 @@ Follow the [Getting Started](/docs/getting-started) guide to configure your basi
         ufw allow ssh
         ufw enable
 
-## Configuring Fail2ban
+## 2) Configure Fail2ban
 
-Fail2ban reads its configuration files so that all `.conf` files are read first and `.local` files override any settings. Because of this, all changes to the configuration are generally done in `.local` files, leaving the `.conf` files untouched.
+Fail2ban reads `.conf` configuration files first, then `.local` files override any settings. Because of this, all changes to the configuration are generally done in `.local` files, leaving the `.conf` files untouched.
 
-### fail2ban.local Configuration
+### Configure fail2ban.local
 
-1.  The file `fail2ban.conf` contains the default configuration profile. The default settings will give you a sane and working setup so this is the best place to start. If you want to make any changes, it's best to do it in a separate file, `fail2ban.local`, which overrides `fail2ban.conf`. Rename a copy `fail2ban.conf` to `fail2ban.local`. 
+1.  `fail2ban.conf` contains the default configuration profile. The default settings will give you a reasonable working setup. If you want to make any changes, it's best to do it in a separate file, `fail2ban.local`, which overrides `fail2ban.conf`. Rename a copy `fail2ban.conf` to `fail2ban.local`. 
 
         cp /etc/fail2ban/fail2ban.conf /etc/fail2ban/fail2ban.local
 
-3.  From here, you can opt to edit the definitions in `fail2ban.local` to match your desired configuration. The values that can be changed are:
+2.  From here, you can opt to edit the definitions in `fail2ban.local` to match your desired configuration. The values that can be changed are:
 
     -   `loglevel`: The level of detail that Fail2ban's logs provide can be set to 1 (error), 2 (warn), 3 (info), or 4 (debug).
-    -   `logtarget`: Logs actions into a specific file. The default value of `/var/log/fail2ban.log` puts all logging into the defined file. Alternately, you can change the value to STDOUT, which will output any data; STDERR, which will output any errors; SYSLOG, which is message-based logging; and FILE, which outputs to a file.
+    -   `logtarget`: Logs actions into a specific file. The default value of `/var/log/fail2ban.log` puts all logging into the defined file. Alternately, you can change the value to:
+        -  `STDOUT`: output any data
+        -  `STDERR`: output any errors
+        -  `SYSLOG`: message-based logging
+        -  `FILE`: output to a file
     -   `socket`: The location of the socket file.
     -   `pidfile`: The location of the PID file.
 
-### jail.local Basic Configuration
+## 3) Configure jail.local Settings
 
-1.  The `jail.conf` file will enable Fail2ban for SSH by default for Debian and Ubuntu, but not CentOS. All other protocols and configurations (HTTP, FTP, etc.) are commented out. If you want to change this, it's recommended to create a `jail.local` for editing just like you did with `fail2ban.local`.
+1.  The `jail.conf` file will enable Fail2ban for SSH by default for Debian and Ubuntu, but not CentOS. All other protocols and configurations (HTTP, FTP, etc.) are commented out. If you want to change this, create a `jail.local` for editing:
 
         cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
 
 2.  **If using CentOS or Fedora** you will need to change the `backend` option in `jail.local` from *auto* to *systemd*. This is not necessary on Debian 8 or Ubuntu 16.04, even though both use systemd as well.
 
-        {: .file-excerpt}
-        /etc/fail2ban/jail.local
-        :   ~~~ conf
-            # "backend" specifies the backend used to get files modification.
-            # Available options are "pyinotify", "gamin", "polling", "systemd" and "auto".
-            # This option can be overridden in each jail as well.
-            
-            . . .
-            
-            backend = systemd
-            ~~~
+    {: .file-excerpt}
+    /etc/fail2ban/jail.local
+    :   ~~~ conf
+        # "backend" specifies the backend used to get files modification.
+        # Available options are "pyinotify", "gamin", "polling", "systemd" and "auto".
+        # This option can be overridden in each jail as well.
+
+        . . .
+        
+        backend = systemd
+        ~~~
 
-3.  No jails are enabled by default in CentOS 7. For example, to enable the SSH daemon jail, uncomment the following lines in `jail.local:
+    No jails are enabled by default in CentOS 7. For example, to enable the SSH daemon jail, uncomment the following lines in `jail.local`:
 
-        {: .file-excerpt}
-        /etc/fail2ban/jail.local
-        :   ~~~ conf
-            [sshd]
-            enabled = true
-            ~~~
+    {: .file-excerpt}
+    /etc/fail2ban/jail.local
+    :   ~~~ conf
+        [sshd]
+        enabled = true
+        ~~~
 
-#### IP Whitelisting        
+### Whitelist IP
 
-Add any IPs to the `ignoreip` line that you wish Fail2ban to ignore. By default, this command will not ban the localhost. If you work from a single IP address often, it may be beneficial to add it to the ignore list:
+To ignore specific IPs, add them to the `ignoreip` line. By default, this command will not ban the localhost. If you work from a single IP address often, it may be beneficial to add it to the ignore list:
 
 {: .file-excerpt}
 /etc/fail2ban/jail.local
@@ -182,13 +186,13 @@ Add any IPs to the `ignoreip` line that you wish Fail2ban to ignore. By default,
     ignoreip = 127.0.0.1/8 123.45.67.89
     ~~~
 
-If you wish to whitelist IPs only for certain jails, this can be done with the `fail2ban-client` command. Replace `JAIL` with the name of your fail, and `123.45.67.89` with the IP you wish to whitelist.
+If you wish to whitelist IPs only for certain jails, this can be done with the `fail2ban-client` command. Replace `JAIL` with the name of your jail, and `123.45.67.89` with the IP you wish to whitelist.
 
     fail2ban-client set JAIL addignoreip 123.45.67.89   
 
-#### Ban Time and Retry Amount
+### Ban Time and Retry Amount
 
-The `bantime`, `findtime`, and `maxretry` then need to be set. These are the values that define the circumstances and the length of time of a ban.
+Set `bantime`, `findtime`, and `maxretry` to define the circumstances and the length of time of a ban:
 
 {: .file-excerpt}
 /etc/fail2ban/jail.local
@@ -208,9 +212,9 @@ The `bantime`, `findtime`, and `maxretry` then need to be set. These are the val
 
 -   `maxretry`: How many attempts can be made to access the server from a single IP before a ban is imposed. The default is set to 3.
 
-#### Email Alerts
+### Email Alerts
 
-If you wish to receive email when Fail2ban is triggered, adjust the email settings:
+To receive email when fail2ban is triggered, adjust the email settings:
 
 -   `destemail`:  The email address where you would like to receive the emails.
 
@@ -224,7 +228,7 @@ If you wish to receive email when Fail2ban is triggered, adjust the email settin
 
 You will also need to adjust the `action` setting, which defines what actions occur when the threshold for ban is met. The default, `%(action_)s`, only bans the user. `%(action_mw)s` will ban and send an email with a WhoIs report; while `%(action_mwl)s` will ban and send an email with the WhoIs report and all relevant lines in the log file. This can also be changed on a jail-specific basis.
 
-### Jail Configuration
+### Other Jail Configuration
 
 Beyond the basic settings address above, `jail.local` also contains various jail configurations for a number of common services, including SSH. By default, only SSH is enabled.
 
@@ -255,11 +259,11 @@ An average jail configuration will resemble the following:
 
 ## Failregexs
 
-Although Fail2ban comes with a number of filters for use, you may want to further customize these filters or create your own to suit your needs. Fail2ban uses *regular expressions* (*regex*) to parse log files, looking for instances of attempted break-ins and password failures. Fail2ban uses Python's regex extensions.
+Although Fail2ban comes with a number of filters, you may want to further customize these filters or create your own to suit your needs. Fail2ban uses *regular expressions* (*regex*) to parse log files, looking for instances of attempted break-ins and password failures. Fail2ban uses Python's regex extensions.
 
-The best way to understand how failregex works is to write one. Although we do not advise having Fail2ban monitor your Wordpress' `access.log` on heavily-trafficked websites due to CPU concerns, it provides an instance of an easy-to-understand log file that you can use to learn about the creation of any failregex.
+The best way to understand how failregex works is to write one. Although we do not advise having Fail2ban monitor your Wordpress's `access.log` on heavily-trafficked websites due to CPU concerns, it provides an instance of an easy-to-understand log file that you can use to learn about the creation of any failregex.
 
-### Writing the Regex
+### Write a Regex for Fail2ban
 
 1.  Navigate to your website's `access.log` (generally located at `/var/www/example.com/logs/access.log`) and find a failed login attempt. It will resemble:
 
@@ -313,7 +317,7 @@ The best way to understand how failregex works is to write one. Although we do n
         
         <HOST> - - \[\d{2}/\w{3}/\d{4}:\d{2}:\d{2}:\d{2} -\d{4}\] "POST /wp-login.php HTTP/1.1" 200
 
-### Using the Failregex
+### Apply the Failregex
 
 With the failregex created, it then needs to be added to a filter.
 
@@ -356,9 +360,9 @@ With the failregex created, it then needs to be added to a filter.
 
 ## Using the Fail2ban Client
 
-Fail2ban provides a command `fail2ban-client` that can be used to run Fail2ban from the command line. The input should be as follows: 
+Fail2ban provides a command `fail2ban-client` that can be used to run Fail2ban from the command line:
 
-    `fail2ban-client COMMAND`
+    fail2ban-client COMMAND
 
 -   `start`: Starts the Fail2ban server and jails.
 -   `reload`: Reloads Fail2ban's configuration files.
