fail2ban is an open source software for linux machines that automatically bans IP addresses that have too many connection failures.
See more articles from iGuRu.gr when you search for news on Google.
A security solution for servers and also for home machines running linux is the well-known fail2ban. If you have a server running Plesk, fail2ban is already installed (IP Address Banning).
But if you have a different server utility, or simply have a home computer running linux, then see how to install and configure the free fail2ban security software.
What is fail2ban
Fail2ban is a free utility that will automatically block an IP address if it attempts and fails to connect to a server too many times.
When someone tries to connect to your server, whether it's an SSH server, a web or email server, or a Minecraft server, they're usually required to enter a username and password before they're allowed access.
Normal people entering (or guessing) their account information, the fastest they can do is write one attempt every 10-20 seconds. When credentials are entered faster, it's a sign that you have a problem, as a bot may be performing a brute-force attack.
To detect a brute-force attack, you need to monitor the login requests that fail to enter an account. Once an intruder is identified, they should be prevented from making further attempts. This requires you to be in physical form 24 hours a day with your eyes open on your computer screen.
The only practical way is to automate the whole process with your own bot. With some simple configuration, the fail2ban software will manage the tracking, and once it detects an intrusion attempt it will perform the ban for you.
fail2ban integrates with the linux iptables firewall. It enforces bans on suspicious IP addresses by adding rules to the firewall.
Of course, if you're concerned about security, you probably already have a firewall configured with a well-populated set of rules. fail2ban simply adds and removes its own rules only, leaving your normal firewall functions untouched.
Install fail2ban
Installing fail2ban is simple. We used an Ubuntu 22.04.4 so the command is as follows: sudo apt-get install fail2ban
In Fedora, type: sudo dnf εγκατάσταση fail2ban
In Manjaro use pacman: sudo pacman -Sy fail2ban
Configuring fail2ban
The fail2ban installation contains a default configuration file called jail.conf . This file is overwritten when fail2ban is upgraded, so you will lose our changes if you make any adjustments to this file.
Instead, you should copy the jail.conf file to another one that you will call jail.local which, like jail.conf, is automatically read by fail2ban.
By placing your configuration changes in jail.local, they will be preserved across all upgrades as jail.local will not be tampered with, and as mentioned both files are automatically read by fail2ban.
Copy the file: with the command: sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Now open the jail.local file with your favorite editor. We will use gedit: sudo gedit /etc/fail2ban/jail.local
You should look for two sections in the file: [DEFAULT] and [sshd].
The [DEFAULT] section starts somewhere on line 40. It's a long section with lots of comments and explanations.
Read the whole thing but the basics about [DEFAULT] are around line 90 where you'll find the following four settings you need to know:
ignoreip : This is where you write a list of allowed IP addresses that will never be blocked. The localhost IP address ( 127.0.0.1) is on the list by default, along with the IPv6 equivalent ( ::1), you just need to remove the “bar” to enable it. If there are other IP addresses that you know should never be blocked, add them to this list and leave a space between them.
bantime : The length of time an IP address is banned for (the “m” stands for minutes). If you type a value without “m” or “h” (for hours) it will be treated as seconds. A value of -1 will permanently ban an IP address. Be very careful not to get locked out permanently.
findtime : The time period within which too many failed login attempts will result in an IP address being blocked.
maxretry : The value for “too many failed attempts”.
If a connection from the same IP address makes maxretry failed connection attempts within the findtime period, they are blocked for the duration of the bantime. The only exceptions are the IP addresses in the ignoreip list.
fail2ban jailbreaks IP addresses for a specified period of time. fail2ban supports several different jails and each one represents bans that apply to a connection type.
This allows you to have different jail settings for different connection types such as ssh, http, proxy, ftp etc.
The settings in the [DEFAULT] section are the defaults. Now, let's look at the settings for the [JAILS] section and more specifically the [SSH] subsection.
Jail configuration
Jail has default settings from [DEFAULT] that if they don't match what you want applied, you can set them to your liking for each service separately and for bantime, findtime, and maxretry.
Scroll down to about line 280 and you'll see the [sshd] section.
First of all you should enable the jail for ssh service violations first. So here you have to write the command: enable = true
Here also you can set jail values for the SSH service. For example, the default setting from [DEFAULT] was five failed attempts, but if you want to be more careful with SSH connections, you can drop it to three failed attempts: maxretry = 3
The remaining definitions refer to the default “ssh” port (port 22 unless you want another) and tell Fail2ban to look at the log file located in the default folder (/var/log/auth.log) for this section and analyze the log file.
You should tell it enable = true for all services you want to enable fail2ban.
In general, the fail2ban config file is quite large and full of features, as long as you have an appetite for reading. For example around line 170, in [ACTIONS] you can set it to send you a warning email if someone is caught in the lens.
At the end of all settings save and close the file.
Enable fail2ban
After configuring fail2ban you should enable it to run as an autostart service. Then you need to test it to make sure it works as expected.
To enable it as a service, use the systemctl command: sudo systemctl enable fail2ban
And to start the service: sudo systemctl start fail2ban
You can check the status of the service using the systemctl command again: sudo systemctl status fail2ban.service
And to get the status from fail2ban use the command: sudo fail2ban-client status
And if you want to look a little deeper include the name of the service in the previous command: sudo fail2ban-client status sshd
Dimitris hates Mondays...
