Fail2ban is an intrusion prevention software framework that protects computer servers from primarily brute-force attacks, banning bad user agents, banning URL scanners, and much more.
Update your server.
apt update && apt full-upgrade
Install fail2ban
apt install fail2ban -y
After successful installation, the Fail2ban service should start automatically. You can verify this by running the command:
systemctl status fail2ban
If the service is not active on your system, then you can use the following commands to starts and enable it:
systemctl start fail2ban systemctl enable fail2ban
Lastly, verify the version and build of fail2ban:
fail2ban-client --version
Output:
Fail2Ban v0.11.2
After completing the installation, we now need to do some setup and basic configuration. Fail2ban comes with two configuration files which are located in /etc/fail2ban/jail.conf and The default Fail2ban /etc/fail2ban/jail.d/defaults-debian.conf. Do not modify these files. The original set-up files are your originals and will be replaced in any update to Fail2ban in the future.
Now let’s setup copies ending in .local instead of .conf as Fail2ban will always read .local files first before loading .conf if it cannot find one.
To do this, use the following command:
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Now open the configuration file to proceed with configuring:
nano /etc/fail2ban/jail.local
Some items to mofify.
Bantime Increment
# "bantime.increment" allows to use database for searching of previously banned ip's to increase a # default ban time using special formula, default it is banTime * 1, 2, 4, 8, 16, 32... bantime.increment = true
Whitelist IPs in Fail2ban
ignoreip = 127.0.0.1/8 ::1 192.167.5.5 (example IP address)
Default Ban Time Set-Up
E-Mail set up with Fail2ban
Note, by default, Fail2ban uses sendmail MTA for email notifications. You can change this to the mail function by doing the following:
Change from:
mta = sendmail
Change to:
mail = sendmail
Fail2ban Jails
Fail2ban ships with a number of jail for different services. You can also create your own jail configurations. By default, only the ssh jail is enabled. To enable a jail, you need to add enabled = true after the jail title. The following example shows how to enable the postfix jail.
[postfix] enabled = true port = smtp,ssmtp filter = postfix logpath = /var/log/mail.log
The settings we discussed in the previous section, can be set per jail. Here is an example:
/etc/fail2ban/jail.local
[sshd] enabled = true maxretry = 3 findtime = 1d bantime = 4w ignoreip = 127.0.0.1/8 11.22.33.44
The filters are located in the /etc/fail2ban/filter.d directory, stored in a file with the same name as the jail. If you have a custom setup and experience with regular expressions, you can fine-tune the filters.
Each time the configuration file is modified, the Fail2ban service must be restarted for changes to take effect:
sudo systemctl restart fail2ban
Fail2ban Client
Fail2ban ships with a command-line tool named fail2ban-client that you can use to interact with the Fail2ban service.
To view all available options, invoke the command with the -h option:
fail2ban-client -h
This tool can be used to ban/unban IP addresses, change settings, restart the service, and more. Here are a few examples:
Get the current status of the server:
fail2ban-client status
Check the jail status:
fail2ban-client status sshd [bash] Unban an IP: [bash] sudo fail2ban-client set sshd unbanip 11.22.33.44
Ban an IP:
sudo fail2ban-client set sshd banip 11.22.33.44