About
π³ Fail2ban Docker image based on Alpine Linux.
If you are interested, check out my other π³ Docker images!
π‘ Want to be notified of new releases? Check out π Diun (Docker Image Update Notifier) project!
Docker
Multi-platform image
Following platforms for this image are available:
$ docker run --rm mplatform/mquery crazymax/fail2ban:latest
Image: crazymax/fail2ban:latest
* Manifest List: Yes
* Supported platforms:
- linux/amd64
- linux/arm/v6
- linux/arm/v7
- linux/arm64
- linux/386
- linux/ppc64le
- linux/s390x
Environment variables
TZ
: The timezone assigned to the container (defaultUTC
)F2B_LOG_TARGET
: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT (defaultSTDOUT
)F2B_LOG_LEVEL
: Log level output (defaultINFO
)F2B_DB_PURGE_AGE
: Age at which bans should be purged from the database (default1d
)F2B_BACKEND
: Specifies the backend used to get files modification (defaultauto
)F2B_MAX_RETRY
: Number of failures before a host get banned (default5
)F2B_DEST_EMAIL
: Destination email address used solely for the interpolations in configuration files (defaultroot@localhost
)F2B_SENDER
: Sender email address used solely for some actions (defaultroot@$(hostname -f)
)F2B_ACTION
: Default action on ban (default%(action_)s
)F2B_IPTABLES_CHAIN
: Specifies the iptables chain to which the Fail2Ban rules should be added (defaultDOCKER-USER
)SSMTP_HOST
: SMTP server hostSSMTP_PORT
: SMTP server port (default25
)SSMTP_HOSTNAME
: Full hostname (default$(hostname -f)
)SSMTP_USER
: SMTP usernameSSMTP_PASSWORD
: SMTP passwordSSMTP_TLS
: SSL/TLS (defaultNO
)
β οΈ If you want email to be sent after a ban, you have to configure SSMTP env vars and set F2B_ACTION to%(action_mw)s
or%(action_mwl)s
Volumes
/data
: Contains customs jails, actions and filters and Fail2ban persistent database
Use this image
Docker Compose
Docker compose is the recommended way to run this image. Copy the content of folder examples/compose in /var/fail2ban/
on your host for example. Edit the compose and env files with your preferences and run the following commands :
docker-compose up -d
docker-compose logs -f
Command line
You can also use the following minimal command :
docker run -d --name fail2ban --restart always \
--network host \
--cap-add NET_ADMIN \
--cap-add NET_RAW \
-v $(pwd)/data:/data \
-v /var/log:/var/log:ro \
crazymax/fail2ban:latest
Notes
DOCKER-USER
chain
In Docker 17.06 and higher through docker/libnetwork#1675, you can add rules to a new table called DOCKER-USER
, and these rules will be loaded before any rules Docker creates automatically. This is useful to make iptables
rules created by Fail2Ban persistent.
If you have an older version of Docker, you may just change F2B_IPTABLES_CHAIN
to FORWARD
. This way, all Fail2Ban rules come before any Docker rules but these rules will now apply to ALL forwarded traffic.
More info : https://docs.docker.com/network/iptables/
DOCKER-USER
and INPUT
chains
If your Fail2Ban container is attached to DOCKER-USER
chain instead of INPUT
, the rules will be applied only to containers. This means that any packets coming into the INPUT
chain will bypass these rules that now reside under the FORWARD
chain.
This implies that sshd jail for example will not work as intended. You can create another Fail2Ban container. Take a look at this example.
Use fail2ban-client
Fail2ban commands can be used through the container. Here is an example if you want to ban an IP manually :
docker exec -t <CONTAINER> fail2ban-client set <JAIL> banip <IP>
Custom jails, actions and filters
Custom jails, actions and filters can be added respectively in /data/jail.d
, /data/action.d
and /data/filter.d
. If you add an action/filter that already exists, it will be overriden.
β οΈ Container has to be restarted to propagate changes
jail.local
configuration
Override You can also override the jail.local
configuration generated by this image if you want by creating a configuration file /data/jail.d/00-jail.local
.
FYI, here is the order jail configuration would be loaded:
jail.conf
jail.d/*.conf (in alphabetical order)
jail.local
jail.d/*.local (in alphabetical order)
Jail examples
Jail examples can be found in examples/jails to work with this image.
How can I help ?
All kinds of contributions are welcome π! The most basic way to show your support is to star π the project, or to raise issues π¬ You can also support this project by becoming a sponsor on GitHub π or by making a Paypal donation to ensure this journey continues indefinitely! π
Thanks again for your support, it is much appreciated! π
License
MIT. See LICENSE
for more details.