# Jail

[![fail2ban_2.png](https://docs.rakouns.bzh/uploads/images/gallery/2026-06/scaled-1680-/fail2ban-2.png)](https://docs.rakouns.bzh/uploads/images/gallery/2026-06/fail2ban-2.png)

## <span style="color: windowtext;">Principe</span>

La jail relie un filter à :

<span style="mso-list: Ignore;">•<span style="font: 7.0pt 'Times New Roman';"> </span></span>une source de log (logpath ou backend pour Docker),

<span style="mso-list: Ignore;">•<span style="font: 7.0pt 'Times New Roman';"> </span></span>des seuils (maxretry, findtime, bantime),

<span style="mso-list: Ignore;">•<span style="font: 7.0pt 'Times New Roman';"> </span></span>une action (action, par défaut iptables classique, ou iptables-docker pour les conteneurs).

Convention Rakouns : un fichier par jail dans <span style="font-size: 10.5pt; line-height: 120%; font-family: Consolas; color: black; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">/etc/fail2ban/jail.d/</span>, nommé <span style="font-size: 10.5pt; line-height: 120%; font-family: Consolas; color: black; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">rakouns-&lt;service&gt;.conf</span>.

## <span style="color: windowtext;">Structure générale d'une jail</span>

```
[rakouns-<service>]
enabled  = true
filter   = rakouns-<service>
logpath  = <chemin ou source du log>
backend  = polling          ; obligatoire pour les logs Docker json-file
maxretry = 5
findtime = 10m
bantime  = 1h
action   = iptables-docker[name=<service>]
```

<p class="callout info">**<span style="font-size: 10.5pt; line-height: 115%; color: black; mso-color-alt: windowtext;">Note — </span>**<span style="font-size: 10.5pt; line-height: 115%; color: black; mso-color-alt: windowtext;">backend = polling est requis pour tout service conteneurisé dont les logs sont au format json-file : le backend auto/systemd ne détecte pas les nouvelles lignes correctement dans ce format.</span></p>

## <span style="color: windowtext;">Exemple générique : jail SSH</span>

```
[sshd]
enabled  = true
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 5
findtime = 10m
bantime  = 1h
```

C'est le cas le plus simple : pas de Docker, pas d'action custom, le ban standard sur la chaîne INPUT suffit.

## <span style="color: windowtext;">Fil rouge : jail Vaultwarden</span>

Créer <span style="font-size: 10.5pt; line-height: 120%; font-family: Consolas; color: black; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">/etc/fail2ban/jail.d/rakouns-vaultwarden.conf</span> :

```
[rakouns-vaultwarden]
enabled  = true
filter   = rakouns-vaultwarden
logpath  = /var/lib/docker/containers/<container_id>/<container_id>-json.log
backend  = polling
maxretry = 5
findtime = 10m
bantime  = 24h
action   = iptables-docker[name=vaultwarden]
```

Points clés :

<span style="mso-list: Ignore;">•<span style="font: 7.0pt 'Times New Roman';"> </span></span><span style="font-size: 10.5pt; line-height: 115%; font-family: Consolas; color: black; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">backend = polling</span> → indispensable, sinon la jail reste en <span style="font-size: 10.5pt; line-height: 115%; font-family: Consolas; color: black; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">0 currently failed</span> même en cas d'attaque réelle.

<span style="mso-list: Ignore;">•<span style="font: 7.0pt 'Times New Roman';"> </span></span><span style="font-size: 10.5pt; line-height: 115%; font-family: Consolas; color: black; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">action = iptables-docker\[name=vaultwarden\]</span> → utilise l'action custom créée en Page 2, qui cible <span style="font-size: 10.5pt; line-height: 115%; font-family: Consolas; color: black; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">DOCKER-USER</span> avec une chaîne dédiée <span style="font-size: 10.5pt; line-height: 115%; font-family: Consolas; color: black; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">f2b-vaultwarden</span>.

<span style="mso-list: Ignore;">•<span style="font: 7.0pt 'Times New Roman';"> </span></span><span style="font-size: 10.5pt; line-height: 115%; font-family: Consolas; color: black; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">bantime = 24h</span> plus long que la valeur par défaut, car Vaultwarden contient des coffres de mots de passe : la tolérance au brute-force doit être minimale.

<p class="callout info"><span style="color: windowtext;">**<span style="font-size: 10.5pt; line-height: 115%; color: black; mso-color-alt: windowtext;">Note — </span>**<span style="font-size: 10.5pt; line-height: 115%; color: black; mso-color-alt: windowtext;">Le container\_id change si le conteneur est recréé (mise à jour d'image, docker compose up -d --force-recreate). Un script de détection automatique du chemin de log peut éviter d'avoir à mettre à jour la jail manuellement à chaque recréation.</span></span></p>

## <span style="color: windowtext;">Jail recidive</span>

Recommandé en complément de toutes les jails de service : bannit plus longtemps une IP déjà bannie plusieurs fois.

```
[recidive]
enabled  = true
filter   = recidive
logpath  = /var/log/fail2ban.log
banaction = iptables-allports
bantime  = 1w
findtime = 1d
maxretry = 3
```

## <span style="color: windowtext;">Recharger et activer une jail</span>

```
sudo fail2ban-client reload
# ou, pour recharger une jail spécifique sans tout relancer :
sudo fail2ban-client reload rakouns-vaultwarden
```

Vérifier qu'elle est bien prise en compte :

```
sudo fail2ban-client status
Status

|- Number of jail:      3

`- Jail list:   sshd, recidive, rakouns-vaultwarden
```

Puis le détail d'une jail précise :

```
sudo fail2ban-client status rakouns-vaultwarden
Status for the jail: rakouns-vaultwarden
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- File list:        /var/lib/docker/containers/.../....log
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:
```