sudo apt install fail2ban -y<\/pre>\nOnce installed, start and enable the service:<\/p>\n
sudo systemctl enable fail2ban && sudo systemctl start fail2ban<\/pre>\nTo check if the service is up and running, execute the following command:<\/p>\n
sudo systemctl status fail2ban<\/pre>\nYou should receive the following output:<\/p>\n
root@host:~# sudo systemctl status fail2ban\r\n\u25cf fail2ban.service - Fail2Ban Service\r\n Loaded: loaded (\/lib\/systemd\/system\/fail2ban.service; enabled; vendor preset: enabled)\r\n Active: active (running) since Tue 2022-10-04 18:14:04 CDT; 4s ago\r\n Docs: man:fail2ban(1)\r\n Main PID: 147319 (fail2ban-server)\r\n Tasks: 5 (limit: 4575)\r\n Memory: 11.6M\r\n CPU: 338ms\r\n CGroup: \/system.slice\/fail2ban.service\r\n \u2514\u2500147319 \/usr\/bin\/python3 \/usr\/bin\/fail2ban-server -xf start\r\n\r\nOct 04 18:14:04 host.test.vps systemd[1]: Started Fail2Ban Service.\r\nOct 04 18:14:04 host.test.vps fail2ban-server[147319]: Server ready<\/pre>\n<\/span>Step 3. Configure Fail2ban<\/span><\/h2>\nFail2ban configuration files are stored in \/etc\/fail2ban\/<\/b> directory on the server.<\/p>\nroot@host:\/etc\/fail2ban# ll\r\ntotal 80\r\ndrwxr-xr-x 6 root root 4096 Oct 4 18:13 .\/\r\ndrwxr-xr-x 103 root root 12288 Oct 4 18:13 ..\/\r\ndrwxr-xr-x 2 root root 4096 Oct 4 18:13 action.d\/\r\n-rw-r--r-- 1 root root 2816 Nov 23 2020 fail2ban.conf\r\ndrwxr-xr-x 2 root root 4096 Mar 10 2022 fail2ban.d\/\r\ndrwxr-xr-x 3 root root 4096 Oct 4 18:13 filter.d\/\r\n-rw-r--r-- 1 root root 25071 Mar 10 2022 jail.conf\r\ndrwxr-xr-x 2 root root 4096 Oct 4 18:13 jail.d\/\r\n-rw-r--r-- 1 root root 645 Nov 23 2020 paths-arch.conf\r\n-rw-r--r-- 1 root root 2827 Nov 23 2020 paths-common.conf\r\n-rw-r--r-- 1 root root 650 Mar 10 2022 paths-debian.conf\r\n-rw-r--r-- 1 root root 738 Nov 23 2020 paths-opensuse.conf\r\n<\/pre>\nAll configuration settings are stored in the jail.conf<\/b> file but in most cases, you should not modify this file but provide customizations in jail.local file, or separate .conf files under jail.d\/<\/b> directory. Modifying this file may result in overwriting the values on the next system update. That is why we are going to make a copy of the original jail.conf<\/b> with the new name jail.local<\/b> as described in the previous sentence.<\/p>\ncp jail.conf jail.local<\/pre>\nNow we are ready to do some modifications in order to protect SSH.<\/p>\n
If you want to apply some rule for all of the services supported by Fail2ban, you need to make changes under the [DEFAULT]<\/b> section near the top of the file. For example, the ban time is set to 10 minutes by default, but you can increase that value, for example, to 60 minutes.<\/p>\nbantime = 60m\r\n<\/pre>\nOther important parameters are findtime<\/b> and maxretry<\/b> that always work together. Let’s set maxretry to 3 and findtime to 5 minutes:<\/p>\nfindtime = 5m\r\nmaxretry = 3<\/pre>\nThis means that the client will be banned if there are 3 failed attempts to log in to the server in 5 minutes.<\/p>\n
The next parameters that are often used are the email parameters. These parameters will help us to receive an email alert when fail2ban takes action and banning users. This is an explanation of the destemail, sender<\/b> and mta<\/b>.<\/p>\n# Destination email address used solely for the interpolations in\r\n# jail.{conf,local,d\/*} configuration files.\r\ndestemail = root@localhost<\/b>\r\n\r\n# Sender email address used solely for some actions\r\nsender = root@fq-hostname<\/b>\r\n\r\n# E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA for the\r\n# mailing. Change mta configuration parameter to mail if you want to\r\n# revert to conventional 'mail'.\r\nmta = sendmail<\/b>\r\n<\/pre>\n The ban messages are sent to destemail<\/b>, the sender<\/b> is the FROM field in the email, and mta<\/b> is the mail service. By default, the mail service for fail2ban is sendmail, but you can configure any mail service you want. It will work.<\/p>\n
Now, let’s test the Fail2ban configuration about the previous changes.<\/p>\n
ssh user@192.168.0.1\r\nuser@192.168.0.1's password:\r\nPermission denied, please try again.\r\nuser@192.168.0.1's password:\r\nPermission denied, please try again.\r\nuser@192.168.0.1's password:\r\nuser@192.168.0.1: Permission denied (publickey,password).\r\nssh user@92.168.0.1\r\nssh: connect to host 192.168.1.107 port 22: Connection refused<\/pre>\nAs you can see, after three failed login attempts, Fail2ban closed the SSH connection. The user will be banned for 5 minutes. If you try to login in that 5 minutes, then the connection will be refused as described above.<\/p>\n
If you want to learn more about every parameter in jail.conf file, just execute the following command:<\/p>\n
man jail.conf<\/pre>\nYou should receive the following output:<\/p>\n
JAIL.CONF(5) Fail2Ban Configuration JAIL.CONF(5)\r\n\r\nNAME\r\n jail.conf - configuration for the fail2ban server\r\n\r\nSYNOPSIS\r\n fail2ban.conf fail2ban.d\/*.conf fail2ban.local fail2ban.d\/*.local\r\n\r\n jail.conf jail.d\/*.conf jail.local jail.d\/*.local\r\n\r\n action.d\/*.conf action.d\/*.local action.d\/*.py\r\n\r\n filter.d\/*.conf filter.d\/*.local\r\n\r\nDESCRIPTION\r\n Fail2ban has four configuration file types:\r\n\r\n fail2ban.conf\r\n Fail2Ban global configuration (such as logging)\r\n\r\n filter.d\/*.conf\r\n Filters specifying how to detect authentication failures\r\n\r\n action.d\/*.conf\r\n Actions defining the commands for banning and unbanning of IP address\r\n\r\n jail.conf\r\n Jails defining combinations of Filters with Actions.\r\n\r\n<\/pre>\nThat’s it. You successfully protect SSH with Fail2Ban on Ubuntu 22.04. Of course, you do not have to do this on your own. You just need to sign up for one of our NVMe VPS plans and submit a support ticket. We are available 24\/7<\/p>\n
If you liked this about how to protect SSH with Fail2Ban on Ubuntu 22.04<\/a>, please share it with your friends on social networks or simply leave a reply below.<\/p>\n","protected":false},"excerpt":{"rendered":"In this tutorial, we are going to show you how to protect SSH with Fail2ban on Ubuntu 22.04 SSH stands … <\/p>\n
Read More<\/a><\/p>\n","protected":false},"author":4,"featured_media":43635,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1703,13,1698],"tags":[280,68,59],"yoast_head":"\nHow To Protect SSH with Fail2Ban on Ubuntu 22.04 - RoseHosting<\/title>\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n \n \n \n \n \n\t \n\t \n\t \n