Since I’m writing for once, here are a few pointers for using fail2ban.

Installation (on my Ubuntu 12.04):

sudo apt-get install fail2ban

Configuration:

sudo nano /etc/fail2ban/jail.conf

A few lines to add/change:

[DEFAULT]
 maxretry = 3 # change to what you like, I prefer 2
 ignoreip = 127.0.0.1 192.168.0.0/24 # you can add several ignored ranges, use cidr-format
 bantime = 3600 # default 600, change to 86400 for 24h

[ssh]
 enabled = true
 port = ssh
 filter = sshd
 logpath = /var/log/auth.log
 maxretry = 2

Restart the service

sudo service fail2ban restart

Checking in on how fail2ban is doing a few days later:

#!/bin/bash
zgrep -h Ban /var/log/fail2ban.log* | grep ssh | awk '{print $(NF)}' | sort | uniq -c

Save it as a file and give it a name you’ll remember, like analyze-fail2ban.sh,
then run chmod +x analyze-fail2ban.sh.
Finally run it with ./analyze-fail2ban.sh
…this will output a list of IP’s which have been banned by fail2ban (and how many times).

      1 115.249.171.19
      1 119.36.186.44
      1 166.111.230.4
      1 180.168.208.2

Now if we want to take this one step further we can run a whois -lookup on the IP’s to find out which network and which part of the world they’re from.
You can run whois from your terminal or use an online service like http://whois.arin.net/ or http://www.whoisip.se/. A quick search on Google for “whois ip” gives a ton of more or less crappy results on the subject.

For instance, if we check a few of the above:
(this is just the first few lines from the whois record)

inetnum:	115.249.0.0 - 115.249.255.255
netname:	RCOM-Static-DIA
country:	IN

inetnum:        119.36.0.0 - 119.36.255.255
netname:        UNICOM-HB
descr:          China Unicom HuBei Province Network
country:        CN

inetnum:        166.111.0.0 - 166.111.255.255
netname:        TUNET
descr:          imported inetnum object for IIINT
country:        CN

Amazing, isn’t it?

“What next?” you might ask, and well, there’s a few things you could try. For one, you usually find an abuse e-mail address, but who knows how often (if ever) anyone checks that account. Another thing could be to add firewall rules to block them… sure, they’ll probably be using a new IP the next time, but you could also block that whole network since you know the range they’re in.

Oh, The Art of Web has a nice and easy calculator for getting the “1.2.3.4 – 5.6.7.8″ range into the cidr-format which can be used with iptables and a lot of other systems. They also have really good additional information on fail2ban, see here.