run fail2ban in kubernetes?

Question

My Situation at the moment: I'm setting up a mail server and just after getting it to work, the logs are flooded with authentication failed messages from an suspicious iran network trying to login to random accounts.

After some googeling I found out that fail2ban can stop those attacks, but there's one problem: how to use fail2ban in kubernetes? My Ideas:

I found this plugin for traefik, but it requres the traefik instance to be connected to thei SaaS managment service, what I don't need
Installing fail2ban on the host: As kubernetes connects multiole nodes, fail2ban on node 1 only gets the logs from this node and cannot block traffik coming in on node 2.

Is there a solution to run fail2ban In kubernetes, maybe linked to the ingress controller, as it is possible with traefik, but without any connection to a SaaS provider?

Did you come up with a way that works for you? – Alexander Jul 22 '21 at 03:49 — Alexander, Jul 22 '21 at 03:49
I'm working on it: https://gitlab.com/Hobyte/kube2fail – 8bit Jul 23 '21 at 08:51 — 8bit, Jul 23 '21 at 08:51

score 1 · Answer 1 · answered Mar 01 '21 at 22:12

1

There isn't really a good way to do this. Both on the log access front, and more importantly on tweaking the iptables rules from inside a container. You could definitely use the core engine of fail2ban to build a tool around the k8s native APIs (pods/logs, NetworkPolicy) however I don't know any such project at time of writing.

answered Mar 01 '21 at 22:12

coderanger

52,400
4
52
75

Getting the logs can be achieved using [kail](https://github.com/boz/kail) – 8bit Jul 02 '21 at 07:05

score 0 · Accepted Answer · answered Jun 21 '21 at 21:11

In theory, you will need to run fail2ban with certain capabilities:

  "spec": {
    "hostNetwork": true,
    "containers": [{
      "name": "netadmin",
      "securityContext": {"capabilities": { "add": ["NET_ADMIN", "NET_RAW"] }}

See here:

Docker - modifying IPTABLES for host from container

and here:

relationship between K8S iptables and the one of a container inside a pod

You will also need to pass the correct logs to fail2ban inside the container.

run fail2ban in kubernetes?

2 Answers2

Linked