Step-By-Step Guide To Setting Up Fail2ban

Let's keep going with our series of articles on Linux server security. In our last post, we talked about Linux firewall and blocking individual IP addresses of users who might try to pick at your ‘root’ password. Of course, you can look for logs and add suspicious IP’s to firewall rules, but that can be time consuming so we're gonna cover a more efficient method . That method is fail2ban, used by Linux server administrators everywhere, and we're going to use it to automatically add new IPs to a firewall block list if those IPs fail a few login attempts. We'll need to install EPEL repository and fail2ban package first:


[root@ServerSuit ~]# rpm -Uvh http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm
[root@ServerSuit ~]# yum install fail2ban

Then let’s go to fail2ban directory and set basic configuration settings in ‘fail2ban.local’ configuration file:


[root@ServerSuit ~]# cp /etc/fail2ban/fail2ban.conf /etc/fail2ban/fail2ban.local
[root@ServerSuit ~]# touch /var/log/fail2ban.log
[root@ServerSuit ~]# nano /etc/fail2ban/fail2ban.local

Make sure to change directives in configuration file as shown here:


loglevel = INFO
logtarget = /var/log/fail2ban.log
dbpurgeage = 604800

Fail2ban logs will be writed in ‘/var/log/fail2ban.log’ and it’s database will keep all records for 7 days. Then, we need to configure access rules:


[root@ServerSuit ~]# cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
[root@ServerSuit ~]# nano /etc/fail2ban/jail.local

Now we need to set default settings in jail configuration file:


ignoreip = 127.0.0.1/0
bantime=600
findtime=600
maxretry=5

You can add your own IP address to ‘ignoreip’ setting- separated with a space- to ensure that your IPs won't be banned. Settings above will ensure that every IP, other than the ones you designated to be ignored, will be banned for 600 seconds if they fail to login  5 times within 600 seconds. Finally, last we need to add SSH related configuration to same file:


[sshd]
Enabled = true
port    = ssh
logpath = %(sshd_log)s

Now, enable autostart of fail2ban server and start it:


[root@ServerSuit ~]# chkconfig fail2ban on
[root@ServerSuit ~]# service fail2ban start

Now try to see if it works. If you try to login with wrong password intentionally, you should see the following in ‘/var/logs/fail2ban.log’ file:


2016-04-04 03:26:49,878 fail2ban.filter   [14695]: INFO    [sshd] Found 
2016-04-04 03:26:51,247 fail2ban.filter   [14695]: INFO    [sshd] Found 
2016-04-04 03:26:57,721 fail2ban.filter   [14695]: INFO    [sshd] Found 
2016-04-04 03:27:04,751 fail2ban.filter   [14695]: INFO    [sshd] Found 
2016-04-04 03:27:09,198 fail2ban.filter   [14695]: INFO    [sshd] Found 
2016-04-04 03:27:10,003 fail2ban.actions  [14695]: NOTICE  [sshd] Ban 
2016-04-04 03:37:10,950 fail2ban.actions  [14695]: NOTICE  [sshd] Unban 

Notice that your IP got unbanned after 10 minutes just the way we set it up! You can look for banned IP’s:


[root@ServerSuit ~]# fail2ban-client -i

Fail2Ban v0.9.3 reads the log file that contains password failure reports and bans the corresponding IP addresses using firewall rules.


fail2ban> status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     5
|  `- File list:        /var/log/secure
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list: 
fail2ban>

And it will release banned IPs if you end up locking yourself from the server from one of your own IPs:


[root@LinuxSuitTest ~]# fail2ban-client set sshd unbanip 

Fail2ban is a brilliant solution which supports a lot of applications, including Apache, exim, dovecot,proFTPd and so on. In this article I showed you how to configure it to protect your server from a SSH bruteforce attack.

ServerSuit, of course, can configure it for your server as soon as it's added to the dashboard! Fail2ban is among the many preconfigured packages we've curated for you to make server setup, administration and management as easy as possible. So even though, with this article, you now know how to setup fail2ban, with ServerSuit you won't even have to! Registration is free, and you get a no-commitment 30-day free trial when you first register. Give it a try!

Till next time!

April 21 2016

Add or review comments

Please leave your comment

Existing comments

Comments 60


buy cialis generic online cheap
Prostate Gland Infection And Cephalexin haurrehigh [url=https://cialisse.com/]Cialis[/url] Engeda Canadian Cialis Without Prescription Awagosoods <a href=https://cialisse.com/#>cialis generic reviews</a> noinly How Much Amoxicillin Do I
Zitourn
Precio Viagra De 100 haurrehigh [url=https://xbuycheapcialiss.com/]cialis online cheap[/url] Engeda Dyazide Without Prescription
Lbgsesse
st martin viagra <a href="http://genqpviag.com/#">street value of viagra</a> viagra sample [url=http://genqpviag.com/]walmart pharmacy viagra[/url] ’
Lbgsesse
Jdbxsesse
viagra australia <a href="http://llviabest.com/#">viagra online order australia</a> best online for generic viagra [url=http://llviabest.com/]generic viagra, canada[/url] ’
Jdbxsesse
Jdbxsesse
viagra australia <a href="http://llviabest.com/#">viagra online order australia</a> best online for generic viagra [url=http://llviabest.com/]generic viagra, canada[/url] ’
Ahkdsesse
pills viagra pharmacy 100mg <a href="http://storerxpharmcanada.com/ ">canada pharmacy online orders</a> best online canadian pharcharmy
Ahkdsesse
Ahkdsesse
pills viagra pharmacy 100mg <a href="http://storerxpharmcanada.com/ ">canada pharmacy online orders</a> best online canadian pharcharmy
Lbsxsesse
online pharmacy no prescription <a href="https://ssviagriia.com/ ">need prescription for viagra in cyprus?</a> canadian drugstore
Lbsxsesse
Lbsxsesse
online pharmacy no prescription <a href="https://ssviagriia.com/ ">need prescription for viagra in cyprus?</a> canadian drugstore
FvfcExole
profesional viagra <a href="http://hopeviagrin.com/ ">canadian pharma companies</a> purchase viagra without prescription
FvfcExole
Kuikinend
buy viagra <a href="http://viagerkr.com/ ">buy viagra online australia</a> buy viagra with paypal
Kuikinend
Kuikinend
buy viagra <a href="http://viagerkr.com/ ">buy viagra online australia</a> buy viagra with paypal
JbnbUript
canada medication pharmacy <a href="http://online21rxon.com/ ">cialis daily</a> pharmacy uk
JbnbUript
JbnbUript
canada medication pharmacy <a href="http://online21rxon.com/ ">cialis daily</a> pharmacy uk
NncsExole
viagra users comments <a href="http://lightvigra.com/ ">herbal viagra/free samples</a> online viagra
NncsExole
NncsExole
viagra users comments <a href="http://lightvigra.com/ ">herbal viagra/free samples</a> online viagra
Kbcxhifs
drug costs <a href="http://xuypharmacyonline.com/">approved canadian pharmacies online</a> prescription drug cost
Kbcxhifs
Kbcxhifs
drug costs <a href="http://xuypharmacyonline.com/">approved canadian pharmacies online</a> prescription drug cost
Fqhhsesse
Fqhhsesse
canadian cialis <a href="http://happyrxpharmacy21.com/ ">web medical information</a> canadian pharmacy kingcanadian viagra
Ahbzsesse
cash loans lowell ma <a href="http://daymoneygo.com/ ">fha payday loan</a> best rated payday loan company
Ahbzsesse
Ahbzsesse
cash loans lowell ma <a href="http://daymoneygo.com/ ">fha payday loan</a> best rated payday loan company
Labxsesse
cialis 20 mg etkisi <a href="https://jecialisbn.com/ ">priapizm cialis treatment</a> cialis prescription nhs
Labxsesse
Labxsesse
cialis 20 mg etkisi <a href="https://jecialisbn.com/ ">priapizm cialis treatment</a> cialis prescription nhs
FbsgExole
cialis no prescription <a href="https://llecialisjaw.com/ ">cialis daily online </a> cialis mit dapoxetine
FbsgExole
FbsgExole
cialis no prescription <a href="https://llecialisjaw.com/ ">cialis daily online </a> cialis mit dapoxetine
Kbbfinend
cvs viagra <a href="http://kloviagrli.com/ ">freeviagrasamplepack </a> sams viagra
Kbbfinend
Kbbfinend
cvs viagra <a href="http://kloviagrli.com/ ">freeviagrasamplepack </a> sams viagra
JbnvUript
ez payday loans of indiana <a href="http://samcash21.com/ ">cash advance on ontario works</a> capital payday loan review
JbnvUript
JbnvUript
ez payday loans of indiana <a href="http://samcash21.com/ ">cash advance on ontario works</a> capital payday loan review
Jbbnsesse
tomar cialis es bueno <a href="http://ljcialishe.com/ ">immagini cialis</a> viagra and cialis uk
Jbbnsesse
Jbbnsesse
tomar cialis es bueno <a href="http://ljcialishe.com/ ">immagini cialis</a> viagra and cialis uk
Fqbbsesse
instant payday loans bad credit uk <a href="http://ascashapply.com/ ">amscot cash advance how it works</a> payday loans roanoke virginia
Fqbbsesse
Fqbbsesse
instant payday loans bad credit uk <a href="http://ascashapply.com/ ">amscot cash advance how it works</a> payday loans roanoke virginia
AbcfHemyinend
viagra online united states <a href="https://viagriyvik.com/ ">http://viagriyvik.com/ </a> buying viagra from sydney
AbcfHemyinend
AbcfHemyinend
viagra online united states <a href="https://viagriyvik.com/ ">http://viagriyvik.com/ </a> buying viagra from sydney
FjjuExole
viagra femenina <a href="https://viagraonlinejc.com/ ">women viagra pill </a> buying viagra
FjjuExole
FjjuExole
viagra femenina <a href="https://viagraonlinejc.com/ ">women viagra pill </a> buying viagra
NbmoExole
buy cialis online <a href="https://buycialisxz.com/ ">cialis withouth prescriptiong </a> cialis mastercard
NbmoExole
NbmoExole
buy cialis online <a href="https://buycialisxz.com/ ">cialis withouth prescriptiong </a> cialis mastercard
Kndnhifs