spb/tools-spboucher-ai

1{2  "slug": "fail2ban",3  "name": "Fail2Ban",4  "aliases": ["fail2ban"],5  "vendor": { "name": "Fail2Ban project", "slug": "fail2ban-project", "website": "https://github.com/fail2ban/fail2ban" },6  "homepage_url": "https://github.com/fail2ban/fail2ban",7  "docs_url": "https://github.com/fail2ban/fail2ban/wiki",8  "repo_url": "https://github.com/fail2ban/fail2ban",9  "license_url": "https://github.com/fail2ban/fail2ban/blob/master/COPYING",10  "product_type": "application",11  "product_status": "active",12  "summary": "Log-scanning intrusion-prevention daemon that temporarily bans IP addresses showing repeated authentication failures by updating firewall rules",13  "description": "Fail2Ban is an open-source intrusion-prevention tool, written in Python and licensed under GPL-2.0 or later, that watches log files such as the SSH authentication log or web server access logs, matches failure patterns with regular expressions, and after a configurable number of hits within a time window bans the offending address for a period by inserting firewall rules. Jails pair a filter (what to match) with an action (what to do), and the package ships with filters for sshd, many mail servers, NGINX, Apache and other services, plus actions for iptables, nftables, firewalld, pf and even email notification. IPv6 is supported.\n\nIt is a standard addition to any server with sshd exposed to the internet, cutting the volume of brute-force attempts and the noise in logs. The fail2ban.org domain now points to the GitHub repository, which hosts the documentation wiki.\n\nFail2Ban reacts only to what appears in local logs, so it has no notion of reputation shared across machines, can lock out legitimate users behind NAT, and must be tuned when log formats change.",14  "capabilities": ["Regex-based log filters for sshd, web servers, mail servers and custom services", "Time-windowed thresholds with configurable ban durations and recidive escalation", "Actions for iptables, nftables, firewalld, pf and notification hooks", "IPv4 and IPv6 support", "fail2ban-client for inspecting and managing jails at runtime"],15  "workflows": ["Protect an internet-facing SSH server from password guessing", "Ban clients hammering a login endpoint behind NGINX", "Escalate repeat offenders with the recidive jail"],16  "advantages": ["Simple to install and enable with sane defaults", "Works with any service that writes logs", "Lightweight and packaged by every major distribution"],17  "limitations": ["Local signals only; no shared threat intelligence", "Can block legitimate users sharing an IP address", "Filters need maintenance when log formats change"],18  "prerequisites": ["Python 3", "Root access to manage the firewall"],19  "audiences": ["Linux and BSD server administrators", "Self-hosters exposing SSH or web logins"],20  "alternatives": ["crowdsec"],21  "comparison_notes": "CrowdSec covers the same detect-and-ban loop but adds behavior scenarios, remediation components for proxies and CDNs, and a crowd-sourced reputation blocklist; Fail2Ban remains the simpler, dependency-free choice for a single host.",22  "categories": [{ "slug": "security-tools", "primary": true }],23  "tags": ["intrusion-prevention", "ssh", "firewall", "open-source", "self-hosted", "python", "linux", "security"],24  "use_cases": ["harden-servers"],25  "operating_systems": ["linux"],26  "execution_modes": ["self-hosted"],27  "interfaces": ["cli"],28  "deployment_models": ["on-premises"],29  "integrations": ["iptables", "nftables", "firewalld", "pf", "OpenSSH", "NGINX", "Postfix"],30  "data_formats": ["INI configuration", "log files"],31  "languages": ["Python"],32  "source_model": "open-source",33  "license_spdx": "GPL-2.0-or-later",34  "pricing_model": ["open-source", "free"],35  "self_hostable": true,36  "sources": [37    { "url": "https://github.com/fail2ban/fail2ban", "type": "official_site", "title": "fail2ban/fail2ban on GitHub", "supports": ["name", "summary", "capabilities"], "checked_at": "2026-11-02", "note": "www.fail2ban.org redirects to this repository." },38    { "url": "https://github.com/fail2ban/fail2ban/wiki", "type": "official_docs", "title": "Fail2Ban Wiki", "supports": ["capabilities", "workflows"], "checked_at": "2026-11-02" },39    { "url": "https://github.com/fail2ban/fail2ban/blob/master/COPYING", "type": "license_page", "title": "Fail2Ban COPYING (GPL-2.0)", "supports": ["license_spdx", "source_model"], "checked_at": "2026-11-02" }40  ],41  "confidence": "high",42  "discovery_method": "editorial-research",43  "depth": "standard",44  "editorial_status": "reviewed",45  "visibility": "public",46  "featured": false,47  "author": "batch-B2"48}49