In an era where automated bots and attackers relentlessly scan servers looking for vulnerabilities, administrators have to keep their finger on the pulse of security. This is especially true for bruteforce attacks, where attackers endlessly search through passwords hoping to find the right one. If the server isn't secure, sooner or later someone will get to the wrong place.
Fortunately, there's a tool that helps block such "guests" automatically. Meet Fail2Ban — a program that analyzes logs and blocks IP addresses from which suspicious activity is coming. How does it work and how do you set it up correctly? Let's find out.
Main threats Fail2Ban protects against
1. Bruteforce attacks
The most common threat — automatic password mining. Common attacks include SSH (terminal access to the server), FTP (file access), email services and site administration panels.
2. DDoS attacks on web applications
Some attackers flood web servers with multiple requests to overload them and disable them. Fail2Ban can detect such activity and block the attackers' IP addresses.
3. Hacking CMS and web applications
Attempts to exploit vulnerabilities in WordPress, Joomla and other CMS are also logged. Fail2Ban can monitor them and block IPs seen in "bad" behavior.
How does Fail2Ban work?
Fail2Ban analyzes logs (e.g. /var/log/auth.log for SSH) and looks for repeated failed login attempts. If there have been too many failed attempts from one IP in a short time, the program uses iptables (or another firewall) to temporarily block that address.
Main components:
- Jail — a rule that determines which logs to monitor and what action to take when suspicious activity is detected.
- Filter — a template for searching for suspicious log entries.
- Action — a command to be executed when a filter is triggered (e.g., IP blocking).
Fail2Ban installation
In most Linux distributions, Fail2Ban can be installed with the standard command:
After installation, Fail2Ban starts working right away, but requires customization.
Basic settings and configuration
The main configuration file /etc/fail2ban/jail.conf modify is not recommended — it is better to create jail.local:
Open jail.local and configure:
Configuring SSH security
Configuring protection of mail services
Configuring MySQL protection
Configuring Apache and Nginx protection
After making changes, be sure to restart the service:
Fail2Ban monitoring and management
Check active jails:
View blocked IPs for SSH:
Release IP manually:
In conclusion
Fail2Ban is certainly not a panacea for all cyberattacks, but it is a powerful tool that can significantly reduce risks.
It takes a few minutes to set up, and the benefits are huge. If you don't already have Fail2Ban on your server, now is the time to set it up and sleep better.
