ssh root@IP_Address -p Port_number<\/pre>\nReplace “root” with a user that has sudo privileges if necessary. Additionally, replace “IP_Address” and “Port_Number” with your server\u2019s respective IP address and SSH port number.<\/p>\n
You can check whether you have the proper Ubuntu version installed on your server with the following command:<\/p>\n
$ lsb_release -a<\/pre>\nYou should get an output like this:<\/p>\n
No LSB modules are available.\r\nDistributor ID: Ubuntu\r\nDescription: Ubuntu 22.04 LTS\r\nRelease: 22.04\r\nCodename: jammy<\/pre>\nBefore starting, you have to make sure that all Ubuntu OS packages installed on the server are up to date.
\nYou can do this by running the following commands:<\/p>\n
$ sudo apt update -y\r\n$ sudo apt upgrade -y<\/pre>\n<\/span>Step 2. Install Fail2ban<\/span><\/h2>\nFail2ban is available in the default Ubuntu repository, so we can simply run the following command to install it.<\/p>\n
$ sudo apt install fail2ban -y<\/pre>\nThen, invoke this command to enable and run fail2ban<\/p>\n
$ sudo systemctl enable --now fail2ban<\/pre>\nFail2ban is installed and running now, you can verify this by invoking this command:<\/p>\n
$ sudo systemctl status fail2ban<\/pre>\n<\/p>\n
<\/span>Step 3. Configure Fail2ban<\/span><\/h2>\nIn Ubuntu, you will see the configuration files in \/etc\/fail2ban\/jail.conf and \/etc\/fail2ban\/jail.d\/defaults-debian.conf. Fail2ban will load .local first first before loading .conf files. So, it is necessary to create a copy of the default jail.conf file as jail.local. We will configure everything by modifying the jail.local file. Please also note that modifying the default .conf files is not recommended, as they could be overwritten upon update.<\/p>\n
$ sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/pre>\n<\/span>Whitelist IP<\/span><\/h2>\nThe first thing you need to do is to whitelist your own server, let’s edit \/etc\/fail2ban\/jail.local, and uncomment the ‘ignoreip’ line. You can also add other IP addresses, and they should be separated with a space or comma.<\/p>\n
$ sudo nano \/etc\/fail2ban\/jail.local<\/pre>\nFind the line ‘ignoreip’ and uncomment it.<\/p>\n
#ignoreip = 127.0.0.1\/8 ::1<\/pre>\nIt should look like this:<\/p>\n
ignoreip = 127.0.0.1\/8 ::1<\/pre>\n<\/p>\n
Let’s keep the editor open and continue to the next step.<\/p>\n
<\/span>Ban Time Set-Up<\/span><\/h2>\nThe ban time is when an IP is banned after a specific number of failed authentication attempts. By default, the value is 10 minutes with 10 minutes finder on five retries. It means that Fail2ban jail with active filtering will ban the attacker’s IP address for 10 minutes after it has retried the same attack in 10 minutes (find time) x 5 times (retries).<\/p>\n
It is advised to set different ban times as some banning should automatically be longer than others, including retries that should be less or more. This is a personal preference, but setting the time long enough to disrupt malicious user activities is preferred. If you want to ban the attacking IP address permanently, you can set the bantime value to -1.<\/p>\n
In this tutorial, we are going to adjust the bantime to 60 minutes.<\/p>\n
bantime = 60m<\/pre>\n<\/p>\n
<\/span>Email Notifications<\/span><\/h2>\nIf you want to receive an email every time fail2ban bans an IP address in jail, you can set an e-mail address in the jail. Still in \/etc\/fail2ban\/jail.local, we need to modify these values. Make sure to set the destemail<\/em> to your own actual email address.<\/p>\ndestemail = you@yourdomain.com\r\nsender = fail2ban@host.yourserver.com<\/pre>\nIf you want to receive a notification email when an IP address is blocked due to failed SSH login attempt, you can put this line under [sshd] jail.<\/p>\n
action = %(action_mwl)s<\/pre>\nThe “mwl” after the “action_” tells fail2ban to send you emails along with the logs too. If you do not want to receive the log, simply use “mw”.<\/p>\n
Also, make sure to enable your ‘sshd’ jail. It should look like this.<\/p>\n
[sshd]\r\n\r\n# To use more aggressive sshd modes set filter parameter \"mode\" in jail.local:\r\n# normal (default), ddos, extra or aggressive (combines all).\r\n# See \"tests\/files\/logs\/sshd\" or \"filter.d\/sshd.conf\" for usage example and details.\r\n#mode = normal\r\nport = ssh\r\nlogpath = %(sshd_log)s\r\nbackend = %(sshd_backend)s\r\nenabled = true<\/strong>\r\naction = %(action_mwl)s<\/pre>\n<\/p>\n
Save the changes, exit from the nano editor then restart fail2ban to load the new configuration.<\/p>\n
$ sudo systemctl restart fail2ban<\/pre>\n