# Présentation

<span style="color: rgb(0, 0, 0);">[![fail2ban_2.png](https://docs.rakouns.bzh/uploads/images/gallery/2026-06/scaled-1680-/fail2ban-2.png)](https://docs.rakouns.bzh/uploads/images/gallery/2026-06/fail2ban-2.png)</span>

## <span style="color: rgb(0, 0, 0);">Qu'est ce que Fail2Ban ?</span>

<span style="color: rgb(0, 0, 0);">Fail2Ban est un outil de protection qui analyse les logs des services exposés (SSH, applications web, reverse proxy, etc.) et bannit automatiquement les adresses IP qui présentent un comportement suspect : tentatives de connexion échouées répétées, scan d'endpoints, brute-force, etc.</span>

<span style="color: rgb(0, 0, 0);">Concrètement, Fail2Ban fonctionne en trois briques :</span>

<table border="1" cellpadding="0" cellspacing="0" class="MsoNormalTable" id="bkmrk-brique-r%C3%B4le-filter-u" style="width: 985px; border-collapse: collapse; border-image: initial; height: 157px; border: medium none currentcolor;" width="624"><thead><tr style="mso-yfti-irow: 0; mso-yfti-firstrow: yes;"><td style="width: 118.953px; border: 1pt solid rgb(204, 204, 204); background: rgb(31, 45, 61); padding: 4pt 7pt;" width="147"><span style="color: rgb(255, 255, 255);">**<span style="font-size: 10.5pt;">Brique</span>**</span>

</td><td style="width: 720.047px; border-width: 1pt 1pt 1pt medium; border-style: solid solid solid none; border-color: rgb(204, 204, 204) rgb(204, 204, 204) rgb(204, 204, 204) currentcolor; border-image: initial; background: rgb(31, 45, 61); padding: 4pt 7pt;" width="477"><span style="color: rgb(255, 255, 255);">**<span style="font-size: 10.5pt;">Rôle</span>**</span>

</td></tr></thead><tbody><tr style="mso-yfti-irow: 1;"><td style="width: 118.953px; border-width: medium 1pt 1pt; border-style: none solid solid; border-color: currentcolor rgb(204, 204, 204) rgb(204, 204, 204); border-image: initial; padding: 4pt 7pt;" width="147"><span style="font-size: 10.5pt; color: rgb(0, 0, 0);">Filter</span>

</td><td style="width: 720.047px; border-width: medium 1pt 1pt medium; border-style: none solid solid none; border-color: currentcolor rgb(204, 204, 204) rgb(204, 204, 204) currentcolor; padding: 4pt 7pt;" width="477"><span style="font-size: 10.5pt; color: rgb(0, 0, 0);">Une expression régulière qui repère une ligne de log correspondant à une tentative échouée</span>

</td></tr><tr style="mso-yfti-irow: 2;"><td style="width: 118.953px; border-width: medium 1pt 1pt; border-style: none solid solid; border-color: currentcolor rgb(204, 204, 204) rgb(204, 204, 204); border-image: initial; padding: 4pt 7pt;" width="147"><span style="font-size: 10.5pt; color: rgb(0, 0, 0);">Jail</span>

</td><td style="width: 720.047px; border-width: medium 1pt 1pt medium; border-style: none solid solid none; border-color: currentcolor rgb(204, 204, 204) rgb(204, 204, 204) currentcolor; padding: 4pt 7pt;" width="477"><span style="font-size: 10.5pt; color: rgb(0, 0, 0);">La configuration qui associe un filter à un service, une durée de ban, un nombre d'essais max, et une action</span>

</td></tr><tr style="mso-yfti-irow: 3; mso-yfti-lastrow: yes;"><td style="width: 118.953px; border-width: medium 1pt 1pt; border-style: none solid solid; border-color: currentcolor rgb(204, 204, 204) rgb(204, 204, 204); border-image: initial; padding: 4pt 7pt;" width="147"><span style="font-size: 10.5pt; color: rgb(0, 0, 0);">Action</span>

</td><td style="width: 720.047px; border-width: medium 1pt 1pt medium; border-style: none solid solid none; border-color: currentcolor rgb(204, 204, 204) rgb(204, 204, 204) currentcolor; padding: 4pt 7pt;" width="477"><span style="font-size: 10.5pt; color: rgb(0, 0, 0);">Ce qui se passe quand le seuil est dépassé (le plus souvent : bannir l'IP via le pare-feu)</span>

</td></tr></tbody></table>

<span style="color: rgb(0, 0, 0);">Le flux est donc : **log → filter (regex) → jail (seuils) → action (ban pare-feu).**</span>

<span style="color: rgb(0, 0, 0);">Sur une infra exposée sur Internet (Rakouns), chaque service accessible publiquement (Vaultwarden, Emby, Matrix, NPM, etc.) est une cible potentielle de scan automatisé et de brute-force. Sans fail2ban :</span>

<span style="color: rgb(0, 0, 0);"><span style="mso-list: Ignore;">•<span style="font: 7.0pt 'Times New Roman';"> </span></span>Les logs d'authentification se remplissent de tentatives parasites.</span>

<span style="color: rgb(0, 0, 0);"><span style="mso-list: Ignore;">•<span style="font: 7.0pt 'Times New Roman';"> </span></span>Les services restent exposés à du brute-force lent et discret (peu de requêtes par minute, sous le radar d'un rate-limiting applicatif).</span>

<span style="color: rgb(0, 0, 0);"><span style="mso-list: Ignore;">•<span style="font: 7.0pt 'Times New Roman';"> </span></span>Aucune réponse automatique n'existe en cas d'attaque ciblée.</span>

## <span style="color: rgb(0, 0, 0);">Spécificités de l'infra Rakouns</span>

<span style="color: rgb(0, 0, 0);">Sur l'infra Rakouns, la quasi-totalité des services tournent en conteneurs Docker derrière NPM (Nginx Proxy Manager) comme reverse proxy. Cela introduit deux contraintes particulières :</span>

<span style="color: rgb(0, 0, 0);"><span style="mso-list: Ignore;">1.<span style="font: 7.0pt 'Times New Roman';"> </span></span>**Le ban classique d'iptables ne suffit pas avec Docker.** Docker manipule ses propres règles iptables et les insère avant les règles fail2ban standards (chaîne <span style="font-size: 10.5pt; line-height: 115%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">INPUT</span>). Il faut donc cibler explicitement la chaîne <span style="font-size: 10.5pt; line-height: 115%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">DOCKER-USER</span>, via une action personnalisée (<span style="font-size: 10.5pt; line-height: 115%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">iptables-docker</span>), pour qu'un ban soit réellement effectif sur le trafic redirigé vers les conteneurs.</span>

<span style="color: rgb(0, 0, 0);"><span style="mso-list: Ignore;">2.<span style="font: 7.0pt 'Times New Roman';"> </span></span>Le format des logs Docker (<span style="font-size: 10.5pt; line-height: 115%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">json-file</span>**) nécessite le backend <span style="font-size: 10.5pt; line-height: 115%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">polling</span>** dans la configuration jail, car le backend par défaut (<span style="font-size: 10.5pt; line-height: 115%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">auto</span>/<span style="font-size: 10.5pt; line-height: 115%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">systemd</span>) ne lit pas correctement ce format.</span>

<span style="color: rgb(0, 0, 0);">Sur le host AlmaLinux (Comms / OVH VPS), une bascule vers <span style="font-size: 10.5pt; line-height: 120%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">iptables-legacy</span> a également été nécessaire pour la compatibilité avec les actions fail2ban, et un contexte SELinux dédié (<span style="font-size: 10.5pt; line-height: 120%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">var\_log\_t</span>) a dû être appliqué aux chemins de logs Docker pour autoriser leur lecture.</span>

## <span style="color: rgb(0, 0, 0);">Convention de nommage Rakouns</span>

<span style="color: rgb(0, 0, 0);">Toutes les jails créées sur l'infra Rakouns sont préfixées <span style="font-size: 10.5pt; line-height: 120%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">rakouns-</span> (ex : <span style="font-size: 10.5pt; line-height: 120%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">rakouns-vaultwarden</span>, <span style="font-size: 10.5pt; line-height: 120%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">rakouns-emby</span>, <span style="font-size: 10.5pt; line-height: 120%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">rakouns-npm</span>) afin de les distinguer clairement des jails par défaut fournies avec le paquet (<span style="font-size: 10.5pt; line-height: 120%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">sshd</span>, <span style="font-size: 10.5pt; line-height: 120%; font-family: Consolas; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">recidive</span>, etc.).</span>