Fail2ban is an intrusion prevention software that protects computer servers from brute-force attacks. It can run on POSIX systems that have an interface to a packet-control system or has a firewall installed locally.
In this tutorial, we will learn how to install Fail2ban on Ubuntu 22.04.
How Fail2ban works is that it scans files such as /var/log/auth.log and bans IP addresses conducting too many failed login attempts. It updates firewall system rules and blocks out all those IPs trying to log in with the wrong credentials.
Install Fail2ban on Ubuntu 22.04
Fail2ban most probably comes preinstalled on your server, but if not there you can install using the following steps.
1. Update system repositories.
To make our systems repositories up to date, use the following command.
$ sudo apt update && upgrade -y
2. Install Fail2ban
After the updates are complete, we can go ahead and install fail2ban. Use the following command to do so.
sudo apt install fail2ban
You should be in a position to see the following from your terminal
#output The following additional packages will be installed: python3-pyinotify whois Suggested packages: mailx monit sqlite3 python-pyinotify-doc The following NEW packages will be installed: fail2ban python3-pyinotify whois 0 upgraded, 3 newly installed, 0 to remove and 182 not upgraded. Need to get 473 kB of archives. After this operation, 2,486 kB of additional disk space will be used. Do you want to continue? [Y/n] y
3. Configuring Fail2ban
To configure Fail2ban, we can edit two files,
Fail2ban configurations reside in
fail2ban.conf file and you are not advised to modify them. What you can do is to copy the contents of fail2ban.conf file and create another file called
fail2ban.local file which you can then edit. to do so use the following command.
cp /etc/fail2ban/fail2ban.conf /etc/fail2ban/fail2ban.local
Now we need to open fail2ban.local file on a text editor.
sudo nano /etc/fail2ban/fail2ban.local
Here you don’t have to change anything for now but whenever you need to make any change, always do it at .local file
Jail.local file have configuration options such as,
ignoreip where you can set a range of IPs to be ignored.
Bantime use to set the amount of time an IP address is banned from accessing the server. It is 600 seconds.
Maxretry use to set the number of failures before an IP address is banned. It is 5 trials.
Findtime use to set the time in which the host should not use up the
maxretry number in order not to get banned (generically set to
Backend allows you to set the backend configurations for file modifications. The default is always auto.
So to create a
jail.local file use the following command.
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Now you can open in your favorite text editor with the following command.
sudo nano jail.local
After doing your configurations remember to restart the fail2ban service. For me I haven’t started the service, so let’s start fail2ban service.
$ sudo systemctl start fail2ban $ sudo systemctl status fail2ban
● fail2ban.service - Fail2Ban Service Loaded: loaded (/lib/systemd/system/fail2ban.service; disabled; vendor pre> Active: active (running) since Sat 2022-07-02 11:16:49 EAT; 9s ago Docs: man:fail2ban(1) Main PID: 27843 (fail2ban-server) Tasks: 5 (limit: 9355) Memory: 11.9M CPU: 123ms CGroup: /system.slice/fail2ban.service └─27843 /usr/bin/python3 /usr/bin/fail2ban-server -xf start Jul 02 11:16:49 zx-pc systemd: Started Fail2Ban Service. Jul 02 11:16:50 zx-pc fail2ban-server: Server ready
Fail2ban is now running, you can now make your desired configurations.
To check the version of installed Fail2ban use the following command.
fail2ban-client version 0.11.2
Congratulations you have successfully installed Fail2ban. For more information consult Fail2ban documentation.