How to Configure Fail2Ban for Server Defence

1. Install: apt install fail2ban (Debian/Ubuntu) or yum install fail2ban (RHEL)
2. Copy: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
3. In jail.local: [DEFAULT] bantime = 3600; findtime = 600; maxretry = 3
4. Enable SSH jail: [sshd] enabled = true
5. For web app: create a custom filter in /etc/fail2ban/filter.d/myapp.conf
6. Restart: systemctl restart fail2ban
7. Monitor: fail2ban-client status sshd shows banned IPs + stats

• Forgot ignoreip with your admin IP — you get banned
• bantime = 1h vs aggressive bots = they return every hour with a fresh IP
• maxretry = 10 — too liberal for SSH (attacker gets 10 password tries)
• No persistent banning — restart wipes bans (default behaviour)
• nginx log format differs from default fail2ban filter — nothing banned

To set up Fail2Ban for brute-force defense, install it using your package manager (e.g., sudo apt install fail2ban on Ubuntu). Configure the jail settings in /etc/fail2ban/jail.local to specify monitored services and ban durations. Start the service with sudo systemctl start fail2ban and enable it at boot using sudo systemctl enable fail2ban. Regularly check logs with fail2ban-client status to monitor activity.

Fail2Ban is a powerful tool designed to prevent brute-force attacks by monitoring log files and banning IP addresses that exhibit suspicious behavior. To install Fail2Ban, follow these steps:

1. Update your package index by running:

   sudo apt update

2. Install Fail2Ban using your package manager:

   sudo apt install fail2ban

3. Once installed, check that Fail2Ban is active by running:

   sudo systemctl status fail2ban

Upon successful installation, Fail2Ban will start with a default configuration that monitors several services, including SSH. However, to tailor it to your specific needs, you should create a local configuration file.

To do this:

1. Copy the default configuration file to create a local configuration:

   sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

2. Edit the local configuration file using your preferred text editor:

   sudo nano /etc/fail2ban/jail.local

In the jail.local file, you can enable or disable jails for specific services. For example, to enable SSH protection, ensure the following section is uncommented:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 600

Here, maxretry specifies the number of failed login attempts before an IP is banned, and bantime defines how long the ban lasts in seconds (600 seconds equals 10 minutes).

After saving your changes, restart the Fail2Ban service to apply the new settings:

sudo systemctl restart fail2ban