File 2 ban

File2ban is used to block IP addresses. The technology is simple - it scans the logs (for example /var/log/apache/error_log) and bans IP that show malicious signs, for example, exceed the max. number of login attempts.

In the settings, parameters are set - how many access attempts can be made for a specified period of time, and a ban time interval.

However, it must be understood that File2Ban reduces, but does not completely eliminate the risk of stealing information from the server.

For serious server protection, you need to set up an SSH key login, or 2FA.

Installation

sudo apt install fail2ban

Let's start and make the daemon start automatically on every boot:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

Setting

All ban parameters are set in the configuration file jail.conf , which is located at /etc/fail2ban/jail.conf

By default, after installation, we have the following settings for banning via SSH:

[DEFAULT]
ignorecommand =
bantime = 10m
findtime = 10m
maxretry = 5

Where: bantime - [min] time for banning ip. findtime - [min] time interval during which you can try to log in to the server "maxretry" times. maxretry - [times] allowed number of login attempts, per "findtime" time interval.

If you decide to change the settings, then open the editor:

sudo nano /etc/fail2ban/jail.conf

After changing the parameters, restart the service:

sudo systemctl reload fail2ban
journalctl -b -u fail2ban

Debugging

If an error occurs due to the fact that file2ban does not find a log file in which to write logs:

then we could solve this problem like this:

# Checking if the file exists
find / -name "sshd_log"

# if not, then create the file by yourself
touch /var/log/sshd_log

# open file2ban to set the path to the logs
sudo nano /etc/fail2ban/jail.conf

# Find block [sshd]
# Delete a line to write a different path
logpath = %(sshd_log)s

# Insert a line to write the path
logpath  = /var/log/sshd_log

# Check the status of fail2ban and restart 
sudo systemctl status fail2ban
sudo systemctl reload fail2ban

Done!🎉 You have protected your server from a password and user guessing attack.

With Fila2Ban, you can protect not only SSH, but also apache, courier, etc. Reed more.