{"id":2082,"date":"2013-09-28T21:36:32","date_gmt":"2013-09-29T02:36:32","guid":{"rendered":"https:\/\/www.rosehosting.com\/blog\/?p=2082"},"modified":"2022-06-03T03:52:17","modified_gmt":"2022-06-03T08:52:17","slug":"install-fail2ban-on-centos","status":"publish","type":"post","link":"https:\/\/www.rosehosting.com\/blog\/install-fail2ban-on-centos\/","title":{"rendered":"Install Fail2ban on CentOS"},"content":{"rendered":"
<\/p>\n
In this article we will explain how to install fail2ban on CentOS<\/a>. Fail2ban is a free and open source framework developed in Python. It is an excellent and very helpful tool for stopping the endless brute force attacks on your services and preventing intrusions into your system. Fail2ban scans the log files on your server for repeated password failures and bans the offending IP addresses. Installing Fail2Ban on CentOs is an easy task if you carefully follow the steps bellow.<\/p>\n <\/p>\n Fail2ban is not available by default under CentOS, so first we need to enable the third party EPEL repository.<\/p>\n CentOS 6 32 bit:<\/p>\n CentOS 6 64 bit:<\/p>\n You can verify that the EPEL repository is enabled by executing:<\/p>\n Install fail2ban using the standard way for installing rpm packages:<\/p>\n Set fail2ban to start automatically on boot:<\/p>\n With this, the installation is done. Now you need to tweak fail2ban’s settings according to your needs by editing the default configuration file ‘jail.conf’ located in the ‘\/etc\/fail2ban’ directory on your server. In this file you can set which services you want to be monitored, the number of failed login attempts before the IP address is banned, the ban time of the IP address, etc…<\/p>\n Open the \/etc\/fail2ban\/jail.conf file and add your own IP address and all your trusted IP addresses into the ignoreip<\/strong> line. Each IP address\/network can be separated with a space. For example:<\/p>\n The next thing you will notice is bantime<\/strong>. This number shows how long the IP address will be blocked for by the server in seconds. The default number is 600 seconds and you can decrease or increase this number according to your needs.<\/p>\n maxretry<\/strong> is the number of failed login attempts before fail2ban bans an IP address.<\/p>\n findtime<\/strong> is a time frame in which a host has to log in. This means that if a host fails to log in to some of your services in this time frame it will be banned. The default findtime is 600 seconds.<\/p>\n This file also contains default sections with basic rules about a few services that can be monitored.<\/p>\n Once you have made the desired changes in the default jail.conf file you need to restart fail2ban:<\/p>\n You can check the iptables rules added by fail2ban by executing:<\/p>\n# rpm -Uvh http:\/\/mirror.pnl.gov\/epel\/\/6\/i386\/epel-release-6-8.noarch.rpm<\/pre>\n
# rpm -Uvh http:\/\/mirror.us.leaseweb.net\/epel\/6\/x86_64\/epel-release-6-8.noarch.rpm<\/pre>\n
# yum repolist\r\nRepository base is listed more than once in the configuration\r\nrepo id repo name status\r\nbase CentOS 6 - i686 - Base 4,787+15\r\nepel Extra Packages for Enterprise Linux 6 - i386 7,959\r\nextras CentOS-6 - Extras 12\r\nupdates CentOS-6 - Updates 844+50\r\nupdates-released CentOS 6 - i686 - Released Updates 844+50\r\nrepolist: 14,446<\/pre>\n
# yum install fail2ban<\/pre>\n
# chkconfig --add fail2ban\r\n# chkconfig fail2ban on<\/pre>\n
# \"ignoreip\" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not\r\n# ban a host which matches an address in this list. Several addresses can be\r\n# defined using space separator.\r\nignoreip = 127.0.0.1 1.2.3.4 123.123.123.0\/24<\/pre>\n
# service fail2ban restart<\/pre>\n
# iptables -L<\/pre>\n