OS4X Fail2Ban integration - Revision history

Admin at 12:14, 6 May 2026

2026-05-06T12:14:39Z

2026-05-06T12:14:04Z

OS4X Configuration

2026-05-06T11:20:14Z

Test

2026-05-06T11:18:59Z

Test

2026-05-06T11:14:20Z

OS4X Configuration

2026-05-06T11:11:04Z

Fail2Ban filter

2026-05-06T11:10:55Z

Fail2Ban filter

2026-05-06T11:10:27Z

Test

2026-05-06T11:10:05Z

Test

2026-05-06T11:09:11Z

Test

← Older revision		Revision as of 12:14, 6 May 2026
Line 1:		Line 1:
−	Since OS4X 2026-05-06, OS4X offers a capability to write a logfile compatible to [https://github.com/fail2ban/fail2ban Fail2Ban]. This system helps you to prevent attacks from externally.	+	Since OS4X 2026-05-06, OS4X offers a capability to write a logfile compatible to [https://github.com/fail2ban/fail2ban Fail2Ban]. This system helps you to prevent attacks from externally. This functionality only supports incoming TLS connections.

	= Installation =		= Installation =

@@ Line 11: / Line 11: @@
 In Configuration -> Logging, define a path in [[OS4X_Core_configuration#Absolute_path_to_Fail2Ban_logfile|Absolute path to Fail2ban logfile]]. This file must be writable by the [[OS4X_Core_configuration#run_OS4X_programs_as_user|OS4X daemon running user]].
-Then create the file and optionalle change permissions:
+Then create the file and optionalle change permissions, otherwise Fail2Ban will fail to start due to a missing log file to be analyzed:
   touch /opt/os4x/tmp/fail2ban.log
   chmod 666 /opt/os4x/tmp/fail2ban.log

@@ Line 57: / Line 57: @@
 The configured Fail2Ban log file should state something like this:
-  TLS error 167772359 during connect try from 10.10.14.7: peer did not return a certificate. Your communication partner must configure a TLS client certificate (or you may lower your security settings globally by disabling 'Configuration' -> 'TLS' -> 'TLS server: check client certificate validity'). If your partner is Seeburger, he must enable the checkbox '2-way authentication' in the partner settings, tab 'Connection'.
+  TLS error 167772359 during connect try from 10.10.14.7: peer did not return a certificate
 Retry this three times within ten minutes, succeeding connection tries must fail with a "<code>connection refused</code>" error from client side.

← Older revision		Revision as of 11:18, 6 May 2026
Line 60:		Line 60:

	Retry this three times within ten minutes, succeeding connection tries must fail with a "<code>connection refused</code>" error from client side.		Retry this three times within ten minutes, succeeding connection tries must fail with a "<code>connection refused</code>" error from client side.
		+
		+	= Unban =
		+	Easy allowing new connections from a client:
		+	fail2ban-client set os4x unbanip 10.10.14.7

@@ Line 10: / Line 10: @@
 == OS4X Configuration ==
 In Configuration -> Logging, define a path in [[OS4X_Core_configuration#Absolute_path_to_Fail2Ban_logfile|Absolute path to Fail2ban logfile]]. This file must be writable by the [[OS4X_Core_configuration#run_OS4X_programs_as_user|OS4X daemon running user]].
 == Fail2Ban filter ==

@@ Line 18: / Line 18: @@
 [Definition]
 failregex =
-     ^TLS error .+ during connect try from <HOST>: .*
+     ^TLS error .+ during connect try from <HOST>: .*$
-     ^TLS error .+ during connect try from <HOST> (.+): .*
+     ^TLS error .+ during connect try from <HOST> (.+): .*$
 ignoreregex =
 </pre>

@@ Line 49: / Line 49: @@
 With the TLS server configured to [[OS4X_Core_configuration#TLS_server:_check_client_certificate_validity|check the TLS client certificate]], connect from an external host to your TLS listener port without a TLS client certificate:
   openssl s_client -connect 192.168.40.24:6619 -tls1_2
-(with "<code>tls1_2</code>" for TLS 1.2, adopt to "<code>tls1_3</code>" if required).
+(with "<code>tls1_2</code>" for TLS 1.2, adopt to another version if required).
 The configured Fail2Ban log file should state something like this:

← Older revision		Revision as of 11:10, 6 May 2026
Line 53:		Line 53:
	The configured Fail2Ban log file should state something like this:		The configured Fail2Ban log file should state something like this:
	TLS error 167772359 during connect try from 10.10.14.7: peer did not return a certificate. Your communication partner must configure a TLS client certificate (or you may lower your security settings globally by disabling 'Configuration' -> 'TLS' -> 'TLS server: check client certificate validity'). If your partner is Seeburger, he must enable the checkbox '2-way authentication' in the partner settings, tab 'Connection'.		TLS error 167772359 during connect try from 10.10.14.7: peer did not return a certificate. Your communication partner must configure a TLS client certificate (or you may lower your security settings globally by disabling 'Configuration' -> 'TLS' -> 'TLS server: check client certificate validity'). If your partner is Seeburger, he must enable the checkbox '2-way authentication' in the partner settings, tab 'Connection'.
		+
		+	Retry this three times within ten minutes, succeeding connection tries must fail with a "<code>connection refused</code>" error from client side.

← Older revision		Revision as of 11:09, 6 May 2026
Line 52:		Line 52:

	The configured Fail2Ban log file should state something like this:		The configured Fail2Ban log file should state something like this:
		+	TLS error 167772359 during connect try from 10.10.14.7: peer did not return a certificate. Your communication partner must configure a TLS client certificate (or you may lower your security settings globally by disabling 'Configuration' -> 'TLS' -> 'TLS server: check client certificate validity'). If your partner is Seeburger, he must enable the checkbox '2-way authentication' in the partner settings, tab 'Connection'.