There are various intrusion prevention software available to prevent brute-force attacks. Here is How to Install, Configure PyFilter to Control Illegitimate SSH Login Attempts. PyFilter project is sponsored by Digital Ocean and developed by individual developer as Free Software under GNU GPL 3.0 License. PyFilter has own Github repo, own website. I guess a question will arise in mind – why not Fail2Ban but PyFilter? PyFilter has PyFilter-Admin which provides statistical information including total bans which is not easy to setup with Fail2Ban (we have shown configuration with Badips with Fail2Ban for analytics). As it is modern, written in Python, in future we hope that we can easily implement Big Data analysis tools with it or create a WordPress Plugin. There is nothing wrong to test different prevention software. Fail2Ban of course time tested, powerful but never just easy even for an used sysadmin to handle. There are actually more bigger hammers for intrusion prevention, but commonly our need is limited to LAMP/LEMP servers and SSH. Here is official website and official GitHub repo of PyFilter :
1 2 | https://pyfilter.co.uk/ https://github.com/Jason2605/PyFilter |
Here is PyFilter Admin :
1 | https://github.com/Jason2605/PyFilter-Admin |
Developer has written guide on Digital Ocean and official website. We are combining PyFilter and PyFilter-Admin in this guide.
---
Remember : If you get wrongly locked-in, you need to either login to web admin console of webhost to flash iptables or request your webhost to do so. We will suggest to use our method to use cron to flash iptables every 5 minutes during testing if your web admin console of webhost has no web based SSH (that is not uncommon among OpenVZ servers). As we told before – before throwing stones towards hackers, you should be careful. Do not run Fail2Ban or DenyHost with PyFilter.
Install, Configure PyFilter to Control SSH Login Attempts
PyFilter needs Python 3. Python 3 is by default installed on Ubuntu 16.04 (and will be on Ubuntu 18.04 LTS). For single server installation, you simply need to clone the GitHub repo :
1 2 3 | cd ~ git clone https://github.com/Jason2605/PyFilter.git ls -al |
You’ll see a directory named PyFilter.git. You will move that directory to /usr/local/ :
1 2 | sudo mv PyFilter /usr/local/PyFilter cd /usr/local/PyFilter |
Next, work on the configuration files :
1 2 | sudo cp Config/config.default.json Config/config.json cat Config/config.json |
You’ll see the defaults settings as output. You can change the settings as per your need. This is default config file :
1 | https://github.com/Jason2605/PyFilter/blob/master/Config/config.default.json |
Add your server’s IP or VPN’s IP in "ignored_ips": ["127.0.0.1"], during testing. Last step is simply executing the script and creating system service :
1 2 3 4 5 | sudo chmod +x run.sh ./run.sh ## create service sudo chmod +x install.sh ./install.sh |
Now, if you run :
1 | sudo systemctl status PyFilter |
You’ll get normal expected output like any other system service. We need to install GEOIP, which is optional unless you need the name of countries.
1 2 | ## pip install geoip2 pip3 install geoip2 |
If you face error, that is not strange. If you face error, ask on StackOverflow. Not everything on this earth has explainable reason!
For using PyFilter-Admin and manually add IPs via it, you need Redis :
1 2 | pip3 install redis nano Config/config.json |
Find the line "database": "sqlite" and change it to "database": "redis". This will be the config :
1 2 3 4 5 6 7 8 9 10 | "redis": { "host": "127.0.0.1", "password": null, "database": 0, "sync_bans": { "active": true, "name": "your_hostname", "check_time": 600 } }, |
Restart PyFilter like any other service and check status :
1 2 | sudo systemctl restart PyFilter sudo systemctl status PyFilter |
It is better to install PyFilter-Admin on development server first to test than running on LAMP server with production WordPress like site. For running PyFilter-Admin, run these commands :
1 2 3 | git clone https://github.com/Jason2605/PyFilter-Admin pip install -r requirements.txt python run_server.py |
Default username is PyFilter The default password is PyFilter12345. Just to remind, for Django we run :
1 | python manage.py runserver your-server-ip:8000 |
Then navigate to the admin panel’s URL in a browser like :
1 | http://your-server-ip:8000/admin/ |
