Fail2ban is a program that monitors login activity on your server and blocks offending IP addresses. By default, it will block IP addresses for 10 minutes before unblocking them. Fail2ban has filters to monitor Apache, Courier, SSH, and other programs for suspicious activity.
This guide assumes you are running a modern 64-bit Ubuntu.
Run the following commands to install Fail2ban.
sudo apt-get update
sudo apt-get install fail2banThe default configuration file is located at the following path.
/etc/fail2ban/jail.confTo avoid possible conflict, you should make a copy of it. For this example, we will use the name jail.local.
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.localNow that we have a backup, let’s begin editing. Open the jail.local file in your favorite text editor.
sudo vi /etc/fail2ban/jail.localYou may use my config example below. It is configured for SSH. There are some settings that you may want to tweak, such as:
Adding email notifications when someone attempts to access the server.
The length of the ban.
The maximum number of retries before a ban is executed.
Include your static IP in “ignoreip” (if you have one).
[DEFAULT]
ignoreip = 127.0.0.1/8
bantime = 1800
maxretry = 4
[ssh-route]
maxretry = 3
action = iptables[name=SSH, port=ssh, protocol=tcp]
sendmail-whois[name=SSH, dest=root, sender=fail2ban@your-domain.com]Once you have made any configuration changes, restart Fail2ban, and you’re good to go.
sudo service fail2ban restart