> For the complete documentation index, see [llms.txt](https://surftest.gitbook.io/axelar-wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://surftest.gitbook.io/axelar-wiki/english/security-setup/file-2-ban.md).

# File 2 ban

[File2ban](https://www.fail2ban.org/wiki/index.php/Main_Page) is used to block IP addresses. The technology is simple - it scans the logs (for example /var/log/apache/error\_log) and bans IP that show malicious signs, for example, exceed the max. number of login attempts. 

In the settings, parameters are set - how many access attempts can be made for a specified period of time, and a ban time interval.

{% hint style="warning" %}
However, it must be understood that File2Ban reduces, but does not completely eliminate the risk of stealing information from the server. 

For serious server protection, you need to set up an [SSH key login](/axelar-wiki/english/security-setup/ssh-key-login-+-disable-password.md), or [2FA](/axelar-wiki/english/security-setup/2fa-for-ssh.md).
{% endhint %}

### Installation

```
sudo apt install fail2ban
```

Let's start and make the daemon start automatically on every boot:

```
sudo systemctl start fail2ban
sudo systemctl enable fail2ban
```

### Setting

All ban parameters are set in the configuration file **jail.conf** , which is located at `/etc/fail2ban/jail.conf`

By default, after installation, we have the following settings for banning via SSH:

```
[DEFAULT]
ignorecommand =
bantime = 10m
findtime = 10m
maxretry = 5
```

Where:\
**bantime** - \[min] time for banning ip.\
**findtime** - \[min] time interval during which you can try to log in to the server "maxretry" times.\
**maxretry** - \[times] allowed number of login attempts, per "findtime" time interval.

If you decide to change the settings, then open the editor:

```
sudo nano /etc/fail2ban/jail.conf
```

After changing the parameters, restart the service:

```
sudo systemctl reload fail2ban
journalctl -b -u fail2ban
```

### Debugging

If an error occurs due to the fact that file2ban does not find a log file in which to write logs:

![](/files/NXMhG69X5tDYrNtef9FZ)

then we could solve this problem like this:

```
# Checking if the file exists
find / -name "sshd_log"

# if not, then create the file by yourself
touch /var/log/sshd_log

# open file2ban to set the path to the logs
sudo nano /etc/fail2ban/jail.conf

# Find block [sshd]
# Delete a line to write a different path
logpath = %(sshd_log)s

# Insert a line to write the path
logpath  = /var/log/sshd_log

# Check the status of fail2ban and restart 
sudo systemctl status fail2ban
sudo systemctl reload fail2ban
```

![](/files/FuU4ZUmL3Q6c59Cr6fA2)

Done!🎉 You have protected your server from a password and user guessing attack.

With Fila2Ban, you can protect not only SSH, but also apache, courier, etc. [Reed more](https://www.fail2ban.org/wiki/index.php/Fail2ban:About).