What Service Was Fail2ban Configured To Protect?

Protecting your server from brute force attacks is a must. The question is, how exactly? Lucky for yous, Fail2Ban is just around the corner to protect your server, but Fail2Ban's default configuration needs some tweaking for optimal security. Worry not though, this tutorial has got you covered.

In this tutorial, you'll learn how to fix Fail2Ban and ward off brute force attacks past securing your SSH server.

Set up? Read on to optimize security for your SSH server!

Prerequisites

This tutorial comprises step-by-step instructions. If you'd like to follow along, exist sure you have the following in place:

An Ubuntu and Debian servers – This tutorial uses a server running Ubuntu 18.04 LTS to set up Fail2Ban and a Debian 10 server to exam Fail2Ban banning configurations.

Root admission or sudo privileges on the server to execute commands every bit a superuser.
Fail2Ban installed in an Ubuntu or Debian server.

Setting up a Base Firewall

Fail2Ban protects your server by monitoring the logs and banning IP addresses that make likewise many login attempts within a certain fourth dimension frame. Simply first, you'll ready up a base firewall where you lot tin can add rules to block malicious acts on your server.

1. Offset, run the service command below to stop Fail2Ban (fail2ban terminate) from running. Stop Fail2Ban when you make changes to your configuration files so that you can exam the changes and brand sure they work equally expected.

            sudo service fail2ban stop

ii. Run the apt install command to install Sendmail and IPTables-persistent. Sendmail is a program that Fail2Ban uses to notify yous when it bans an IP address. While IPTables-persistent is a program that saves your inverse configuration settings in the /etc/sysconfig/iptables file.

Having these programs installed keeps your firewall settings intact fifty-fifty if something unexpected happens, similar a ability outage.

            sudo apt install sendmail iptables-persistent -y

At present run each iptables control beneath to set upwards your firewall. These commands will not generate whatsoever output but add four rules to your firewall. These rules either allow or cake connections to your server.

            ## Outset Rule - Accepts all traffic generated by the server (lo interface)  sudo iptables -A INPUT -i lo -j Accept ## Second Dominion - Accepts all traffic that are function  ## of an established o related connection sudo iptables -A INPUT -k conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ## Third Rule - Allows SSH traffic on port 22 sudo iptables -A INPUT -p tcp --dport 22 -j Take ## 4th Rule - Arops all other traffic sudo iptables -A INPUT -j DROP

4. Run the iptables command beneath to view a summary of what yous have gear up in your firewall.

Below, highlighted are the rules that yous have added on your firewall.

five. Next, run the post-obit commands to save your rules in the /etc/sysconfig/iptables-config file and start the Fail2Ban service. The iptables-config file holds all your permanent firewall rules.

Fail2Ban will automatically add a few rules to your firewall to protect your server.

            sudo dpkg-reconfigure iptables-persistent sudo service fail2ban start

6. Finally, rerun the iptables command beneath to view your firewall rules.

A shown below, highlighted in reddish are the new rules that Fail2Ban has added to your firewall.

Adjusting your Local Fail2Ban Configuration

Now that yous take a basic firewall running, it's time to adjust your local Fail2Ban configuration file to add together more control on securing your server. This tutorial uses the /etc/fail2ban/jail.conf configuration file as it contains all necessary options to configure global settings for the Fail2Ban application.

Maybe, you want to create custom rules for your SSH server. If so, you'll create a new jail.local file (based on the jail.conf file) and put the SSH-specific rules in the jail.local file. Doing then lets you override settings in jail.conf file for your server.

ane. Run the awk command below to perform the post-obit:

Print the content ('{ printf "# "; print; }') of the /etc/fail2ban/jail.conf file.
Create a file named jail.local (based on the jail.conf file), which tin use to override the default settings in the jail.conf file.
Pipage the content of the /etc/fail2ban/jail.conf file to the tee command. Doing then volition write the jail.conf file'south content to your local filesystem (/etc/fail2ban/jail.local).

            awk '{ printf "# "; impress; }' /etc/fail2ban/jail.conf | sudo tee /etc/fail2ban/jail.local

Creating the jail.local file — Creating the *jail.local* file

2. Once you've created the jail.local file, run the ls command beneath. The command lists the contents of your server's Fail2Ban directory (/etc/fail2ban) to verify that your jail.local file is generated correctly.

If you lot encounter the new jail.local file, every bit shown below, then your local file was generated correctly.

Checking the newly created local file (jail.local) — Checking the newly created local file (*jail.local*)

iii. Open the /etc/fail2ban/jail.local file in your preferred text editor and navigate to the [ssh] department.

Uncomment the [sshd] and enabled options by deleting the # symbol in front of the options, as shown below to enable SSH.

From this indicate through the rest of the tutorial, remove the # symbol in forepart of either sections or options to enable them.

four. Scroll down, and uncomment the [DEFAULT] section shown beneath. This section is where yous configure the default settings for Fail2Ban. Whatsoever settings in this section volition be practical to all jails that Fail2Ban manages.

Uncommenting the [DEFAULT] option — Uncommenting the **[DEFAULT]** option

5. Next, coil downward to the bantime section, and set up a bantime for lx minutes. The bantime option sets the amount of time, in minutes, that an IP address is banned after a failed login attempt.

The default bantime setting is 600 seconds (10 minutes). You tin can adjust this setting to your liking, but it'southward important to annotation that the lower the bantime setting, the more load your server will feel.

half dozen. Navigate to the findtime and maxretry options. Proceed the findtime as is (10m) and lower the maxretry to 3.

The findtime option sets the amount of time, in minutes, that an IP accost can fail to log in before it gets banned. While the maxretry selection sets the number of failed login attempts before an IP address is banned.

The default findtime setting is x minutes, and maxretry is 5 minutes. As a result, an IP address that fails to log in v times within a 10 minute period will be banned.

Setting a Window Time for an IP Address to Login Before Getting Banned — Setting a Window Fourth dimension for an IP Address to Login Before Getting Banned

vii. Scroll down, uncomment and configure the destemail, sender, and mta options:

destemail – Enter an e-mail accost where Fail2Ban sends notifications.
sender – Set the "From" field in the email that Fail2Ban sends to destemail.
mta – Go on the default (sendmail) as is. The mta option sets the email delivery agent that Fail2Ban uses to transport notifications.

Configuring destemail, sender, and mta options

8. Navigate to the action options, every bit shown below, and uncomment the action_mwl option. Doing so lets Fail2Ban transport logwatch emails to you. You can review logwatch emails to farther investigate any potential security problems on your server.

Save the changes and exit from the text editor.

9. Now run the commands below to restart your fail2ban service.

            sudo service fail2ban stop sudo service fail2ban kickoff

x. Finally, run the beneath command to check your fail2ban service status. sudo service fail2ban status If the Fail2Ban service is working, you'll go an output like the 1 below.

            sudo service fail2ban status

If the Fail2Ban service is working, you lot'll go an output like the i below.

Testing your Banning Configurations

You've just configured Fail2Ban, and then now it's time to test if the banning configurations actually work. Attempt multiple failed SSH logins to your Fail2Ban server from a secondary server and see if that secondary server gets banned.

ane. Log in to your secondary server (Debian), and run the beneath command to SSH into your Fail2Ban server.

This demo uses a Debian 10 server with an IP of 134.122.xx.103 to ssh to the fail2ban server that has an IP of 69.28.83.134.

2. Enter a random password when prompted and press Enter.

On the commencement try, the Fail2Ban server volition cease the SSH login try and print the Permission denied message, as shown below. Repeat the SSH login attempt about two to three times more than, and the Fail2Ban server will eventually stop responding to your SSH login attempt.

At this signal, you won't get a Permission denied message anymore only a bare screen. Getting a blank screen indicates that your second server (Debian) has been banned from the Fail2Ban server.

Testing if a server gets banned from Fail2Ban server after several failed logins — Testing if a server gets banned from Fail2Ban server later on several failed logins

Simply perhaps you already have a list of IP accost to cake from your Fail2Ban server. If so, open up the jail.local file and navigate to the [DEFAULT] section. Uncomment the ignoreip selection and set the IP addresses to cake, as shown below.

The address can be either multiple split up IPv4 or IPv6 entries, or else separated by commas.

Setting IP Addresses to Block from Fail2Ban Server

iii. On your Fail2Ban server (Ubuntu), rerun the iptables command below to view your firewall rules.

Detect below that there is a new rule that rejects SSH login attempts from the 134.122.20.103 IP accost.

Y'all'll also receive an email from Fail2Ban, upon a successful ban, with a log file attached if yous accept sendmail set up on your Fail2Ban server. The electronic mail notification indicates that Fail2Ban has successfully stopped a creature-force set on and saved your server from potential damages.

Determination

Throughout this tutorial, you've learned how to configure Fail2Ban on an Ubuntu server. At this point, y'all should be well-equipped with the knowledge to protect your SSH server from beast-force attacks.

Now, why not take this newfound knowledge up a notch? Peradventure begin with blocking IPs on all ports with Fail2Ban on a docker host?