Fail2ban is a program that monitors login activity on your server and blocks offending IP addresses. By default, it will block IP addresses for 10 minutes before unblocking them. Fail2ban has filters to monitor Apache, Courier, SSH, and other programs for suspicious activity.

This guide assumes that you are running a modern version of Ubuntu x64.

Installing

Run the following commands to install Fail2ban.

sudo apt-get update
sudo apt-get install fail2ban

Configuring

The the default configuration file is located as follows.

/etc/fail2ban/jail.conf

To avoid possible conflict, you should make a copy of it. For this example, we will call it jail.local.

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Now that we have a backup, let’s begin editing. Open the jail.local file in your favorite text editor.

sudo vi /etc/fail2ban/jail.local

You may use my config example below. It is configured for SSH. There are some settings that you may want to tweak, such as:

• Adding email notifications for when someone is trying to access the server.
• The length of the ban.
• The max number of retries before a ban is executed.
• Include your static IP in “ignoreip” (if you have one).

Example config

[DEFAULT]
ignoreip = 127.0.0.1/8
bantime = 1800
maxretry = 4

[ssh-route]
maxretry = 3
action = iptables[name=SSH, port=ssh, protocol=tcp]
         sendmail-whois[name=SSH, dest=root, sender=fail2ban@your-domain.com]

Once you have made any configuration changes, restart Fail2ban and you’re good to go.

sudo service fail2ban restart