How to install and configure Fail2Ban

Fail2Ban is a security tool designed to protect Linux servers from brute-force attacks and other malicious activities by monitoring log files and blocking IP addresses that exhibit suspicious behavior. Here’s a step-by-step guide on how to install and configure Fail2Ban on a Linux server:

Install Fail2Ban:

1. Update Package List:
   sudo apt update # For Debian/Ubuntu

2. Install Fail2Ban:
   sudo apt install fail2ban # For Debian/Ubuntu


Configure Fail2Ban:

3. Copy the Default Configuration:
   sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local


   This step creates a local configuration file (jail.local) where you can override the default settings.

4. Edit the Configuration:
   sudo nano /etc/fail2ban/jail.local

   • Configure the [DEFAULT] section according to your needs. Pay attention to settings like bantime (duration of the ban in seconds) and findtime (time window for counting failed login attempts).
   • Review and customize the [sshd] section for SSH protection, and other sections as needed.

   Example [sshd] section:

   [sshd]


   enabled = true


   port = ssh


   filter = sshd


   logpath = /var/log/auth.log


   maxretry = 5

5. Create Custom Filters (Optional):
   • If you need to create custom filters for specific applications, you can define them in the filter.d directory (e.g., /etc/fail2ban/filter.d/myfilter.conf).
6. Restart Fail2Ban:
   sudo service fail2ban restart


Check Fail2Ban Status:

7. Check Status and Bans:
   sudo fail2ban-client status


   sudo fail2ban-client status sshd # Check status for a specific jail (e.g., sshd)

8. Check Logs:
   • Review Fail2Ban logs for any issues or blocked IP addresses:
     sudo tail -n 50 /var/log/fail2ban.log


Additional Tips:

• Customize Email Notifications (Optional):
  • Fail2Ban can send email notifications. Configure settings in jail.local and ensure your system is configured to send emails.
• Adjust Firewall Settings:
  • Ensure that your firewall allows access to the services you are protecting. Fail2Ban only blocks IP addresses; it doesn’t manage firewall rules.
• Automatic Unban (Optional):
  • You can configure automatic unbanning by setting up an unbanip script. Refer to the Fail2Ban documentation for details.

This guide provides a basic configuration for Fail2Ban. Make sure to adapt the settings based on your server’s needs and the specific services you want to protect. Always check the Fail2Ban documentation for the most up-to-date information and additional configuration options.