Article

Table of Contents
Try Vultr Today with

$50 Free on Us!

Setup Fail2ban Ubuntu x64

Published on: Thu, May 14, 2015 at 11:26 am EST
Server Apps Ubuntu

Fail2ban is a program that monitors login activity on your server and blocks offending IP addresses. By default, it will block IP addresses for 10 minutes before unblocking them. Fail2ban has filters to monitor Apache, Courier, SSH, and other programs for suspicious activity.

This guide assumes that you are running a modern version of Ubuntu x64.

Installing

Run the following commands to install Fail2ban.

sudo apt-get update
sudo apt-get install fail2ban

Configuring

The the default configuration file is located as follows.

/etc/fail2ban/jail.conf

To avoid possible conflict, you should make a copy of it. For this example, we will call it jail.local.

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Now that we have a backup, let's begin editing. Open the jail.local file in your favorite text editor.

sudo vi /etc/fail2ban/jail.local

You may use my config example below. It is configured for SSH. There are some settings that you may want to tweak, such as:

  • Adding email notifications for when someone is trying to access the server.
  • The length of the ban.
  • The max number of retries before a ban is executed.
  • Include your static IP in "ignoreip" (if you have one).

Example config

[DEFAULT]
ignoreip = 127.0.0.1/8
bantime = 1800
maxretry = 4

[ssh-route]
maxretry = 3
action = iptables[name=SSH, port=ssh, protocol=tcp]
         sendmail-whois[name=SSH, dest=root, sender=fail2ban@your-domain.com]

Once you have made any configuration changes, restart Fail2ban and you're good to go.

sudo service fail2ban restart

Want to contribute ?

You could earn up to $300 by adding new articles