fail2ban runs as root by default. This is unnecessary for its functionality, other than to alter firewall rules. The firewall rules can be safely done, using sudo to enable the required calls. The Debian/Ubuntu init.d file has provisions to start fail2ban as a non-root user, but newer releases use systemd to start and stop the process. This requires a different procedure.
This procedure is for my servers which use Shorewall to maintain the firewall. I will document my process for configuring
fail2ban in another post.
First, create the user fail2ban as system user with group(s) required to read the logs. Fail2ban does not need a shell. The home directory is set like similar system users on Ubuntu systems.
useradd --system --no-create-home --home-dir /var/lib/fail2ban --groups adm,www-data --shell /usr/sbin/nologin fail2ban
If you are using an init.d script to start fail2ban, set the user in
/etc/default/fail2ban. This value is not used by systemd. If you are using systemd there is no need to alter the /etc/default/fail2ban file.
If you are using systemd to start fail2ban, create the systemd file
/etc/systemd/system/fail2ban.service.d/override.conf. Omit the
[Unit] section if you are not using Shorewall.
[Service] User=fail2ban Group=adm # Run ExecStartPre with root-permission PermissionsStartOnly=true ExecStartPre=/bin/chown -R fail2ban:adm /var/run/fail2ban [Unit] Requires=shorewall.service After=shorewall.service
Create a sudoers file for fail2ban such as
/etc/sudoers.d/fail2ban Ensure required operations are included in the
Cmnd_Aalias definition. This file is configured to use shorewall and includes all the actions that could be called. If your sudoers configuration does not use an include directory, add the rules to your sudoers file, or enable use of an include directory.
# Sudoer rules for fail2ban User_Alias FAIL2BAN = fail2ban Cmnd_Alias FAIL2BAN = /sbin/shorewall allow, /sbin/shorewall6 allow, \ /sbin/shorewall logdrop, /sbin/shorewall6 logdrop, \ /sbin/shorewall drop, /sbin/shorewall6 drop, \ /sbin/shorewall logreject, /sbin/shorewall6 logreject, \ /sbin/shorewall logreject, /sbin/shorewall6 reject FAIL2BAN ALL = NOPASSWD: FAIL2BAN # EOF
Change the ownership of existing files.
chown -R fail2ban /var/log/fail2ban* /var/lib/fail2ban
Finally, stop and restart
fail2ban, check for the fail2ban process, and check your fail2ban log for errors.
systemctl stop fail2ban systemctl start fail2ban ps -fu fail2ban tail -60 /var/log/fail2ban.log | less
If you are using
fail2ban or a similar application to rotate logs, edit the configuration to create new logs owned by the