94 lines
3.1 KiB
Markdown
94 lines
3.1 KiB
Markdown
+++
|
|
date = '2024-10-23T20:43:44-03:00'
|
|
title = 'Securing Your Linux Server with Fail2Ban for SSH Protection'
|
|
description = "Thanwer's Blog Post about how to use Fail2ban"
|
|
tags = [
|
|
"webserver",
|
|
"GNU/Linux",
|
|
"Basics Series",
|
|
]
|
|
+++
|
|
|
|
[Fail2ban](https://github.com/fail2ban/fail2ban) is a software which scans log files like `/var/log/auth.log` and bans IP addresses which done too many failed login attempts.
|
|
|
|
This is just one layer of security and should be used together with other tools and techniques such as iptables and SSH hardening.
|
|
|
|
I always configure a simple SSH jail using fail2ban on my GNU/Linux servers.
|
|
|
|
Today, I am going to show you how to configure a simple SSH jail.
|
|
|
|
## Installing fail2ban
|
|
|
|
First you (obviously) need to install the fail2ban package.
|
|
|
|
```bash
|
|
apt install fail2ban # For Ubuntu/Debian
|
|
yum install fail2ban # For CentOS/RHEL
|
|
```
|
|
|
|
## Configuring Fail2Ban
|
|
|
|
The fail2ban configuration is very simple, the configuration files are located at: `/etc/fail2ban`
|
|
|
|
The `fail2ban.conf` contains the default configuration profile, it is a good practice to not edit this file, but instead create a separate file named `fail2ban.local`, which overrides `fail2ban.conf`:
|
|
|
|
```bash
|
|
cp /etc/fail2ban/fail2ban.conf /etc/fail2ban/fail2ban.local
|
|
```
|
|
|
|
The defauls should make a working setup for now, so let's skip this for now.
|
|
|
|
Next, we have the `jail.conf` file, which is where we configure our "jails" as the name suggests.
|
|
|
|
Here we are going to make some changes, so first let's create a `jail.local` file with the following content:
|
|
|
|
|
|
|
|
```
|
|
[DEFAULT]
|
|
bantime.multipliers = 5 15 30 60 300 720 1440 2880
|
|
bantime = 86400
|
|
findtime = 86400
|
|
maxretry = 2
|
|
ignoreip = 10.88.0.0/16 fd0d:6ce:3436::/48
|
|
|
|
[sshd]
|
|
backend=systemd
|
|
enabled=true
|
|
mode=aggressive
|
|
action = iptables[name=SSH, port=22, protocol=tcp]
|
|
```
|
|
|
|
Those settings are self explanatory, in the `[DEFAULT]` section we are setting some parameters, like for how long we should ban the attackers, and trusted IPs, remember to change those values as your needs, specially `ignoreip`.
|
|
|
|
Take your time to fine tune those parameters.
|
|
|
|
## Enabling and testing Fail2ban
|
|
|
|
Enable and start the fail2ban service
|
|
```bash
|
|
systemctl enable --now fail2ban
|
|
```
|
|
|
|
For SSH jails the test is very simple, you can test by simply failing to log on a couple times.
|
|
|
|
You can check the status with the command:
|
|
```bash
|
|
fail2ban-client status
|
|
fail2ban-client status sshd
|
|
```
|
|
|
|
|
|
|
|
As you can see, the SSH service on a cloud VPS is constantly being attacked, my server has almost 400 currently banned IPs.
|
|
|
|
## More jails!
|
|
|
|
Today I showed how to protect your GNU/Linux SSH service, but is is not over, you can use fail2ban to protect any service that you run!
|
|
|
|
You can even integrate fail2ban protection with [Cloudflare](https://github.com/nesrual/fail2ban-cloudflare!) if you use their services!
|
|
|
|
I suggest you to check the `/etc/fail2ban/filter.d` folder, which contains the default filters for popular services, like Apache, Asterisk, Mail server services, etc...
|
|
|
|
Be sure to take a look at the [official documentation](https://github.com/fail2ban/fail2ban/wiki).
|