OS4X Fail2Ban integration
Jump to navigation
Jump to search
Since OS4X 2026-05-06, OS4X offers a capability to write a logfile compatible to Fail2Ban. This system helps you to prevent attacks from externally.
Installation
On Debian based systems, it is very easy to install Fail2Ban:
apt update && apt -y install fail2ban
Configuration
Several configuration files and options must be set up for a working Fail2Ban environment.
OS4X Configuration
In Configuration -> Logging, define a path in Absolute path to Fail2ban logfile. This file must be writable by the OS4X daemon running user.
Fail2Ban filter
Create the following file:
/etc/fail2ban/filter.d/os4x.conf
with the following content:
[Definition] failregex = TLS error .+ during connect try from <HOST>: .* ignoreregex =
Fail2Ban jail
Create the following file:
/etc/fail2ban/jail.d/os4x.conf
with the following content:
[os4x] enabled = true port = 6619 filter = os4x logpath = /opt/os4x/tmp/fail2ban.log maxretry = 3 findtime = 600 bantime = 3600 action = %(action_mwl)s
Change the TCP port 6619 to your configured TLS listener port if necessary.
Restart Fail2Ban service
systemctl reload fail2ban