fail2ban scans log files for malicious activity and executes actions based on what it finds.
Note
See the full Salt Formulas installation and usage instructions.
Install the fail2ban package and enable the service.
Creates a jail.local config file based on pillar data to override configuration in the default jail.conf file and enables creation of all configuration files based on content blocks in pillar. See pillar-pt.example for reference
and consult the fail2ban documentation.
First, fail2ban uses settings defined in /etc/fail2ban/jail.conf. jail.conf is provided by the package, and should not be changed.
Next, it uses /etc/fail2ban/jail.local to override settings from jail.conf. The fail2ban.config state populates the jail.local file using data from pillar. The jail.local file is only created if you use the fail2ban.config state.
The fail2ban.config state also populates the jail.local, fail2ban.local and the .conf files in action.d and filter.d via content blocks in pillar.
In the pillar.example, note that the iptable action uses port=ssh (lowercase), not port=SSH (uppercase).