{"id":401,"date":"2020-10-14T15:00:45","date_gmt":"2020-10-14T15:00:45","guid":{"rendered":"https:\/\/dft.wiki\/?p=401"},"modified":"2026-04-21T13:35:56","modified_gmt":"2026-04-21T17:35:56","slug":"increase-security-with-fail2ban-on-ubuntu-20-4","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=401","title":{"rendered":"Increasing Security with Fail2Ban on Ubuntu"},"content":{"rendered":"

Fail2Ban<\/strong> is a service that watches the log files of your services, such as SSH, HTTP, and FTP, looking for consecutive authentication fails that may indicate an unauthorized person trying to get in.<\/p>\n

When detecting a possible intruder that fails to log in X attempts in Y length of time, it bans the origin IP address for Z time. It creates a rule in your firewall to ban and automatically removes it after the ban time expires.<\/p>\n

sudo apt update\r\nsudo apt install fail2ban\r\nsudo systemctl status fail2ban<\/pre>\n
You might see the service active (running).<\/p>\n
sudo cp \/etc\/fail2ban\/jail.{conf,local}\r\nsudo nano \/etc\/fail2ban\/jail.local<\/pre>\n
Inform your white list. Uncomment this line and fill it with the “safe” IP addresses. Usually, I would put the loopback interfaces (127.0.0.1\/8 and ::1), and if you access your network remotely via VPN for example, I would also include the VPN network IP (10.8.0.0\/24) in this list.<\/p>\n
ignoreip = 127.0.0.1\/8 ::1 10.8.0.0\/24<\/pre>\n
Before you leave the file, you have to define X, Y, and Z:<\/p>\n
bantime = 1d<\/strong>\r\nfindtime = 60m<\/strong>\r\nmaxretry = 5<\/strong>\r\nbackend = systemd<\/strong><\/pre>\n
In my case, if someone fails 5 times 60 minutes will be banned for 1 day. Change also the backend to “systems” because it comes by default as “auto” but for some reason, the filter was not catching anything.<\/p>\n
Configure the e-mail alert notification when someone is banned (you need an SMTP server installed and running):<\/p>\n
destemail = admin@yourdomain.com\r\nsender = root@yourdomain.com\r\naction = %(action_mw)s<\/pre>\n
Now you can go down and look for the service you want to protect. You should only enable the ones that you need, not just everything without criteria.<\/p>\n
[sshd]\r\nenabled = true<\/strong>\r\n#mode = normal\r\nport = ssh\r\nlogpath = %(sshd_log)s\r\nbackend = %(sshd_backend)s<\/pre>\n
Insert the enabled = true<\/strong> at the “Jail” you are creating.<\/p>\n
In the example above, I activated on my SSH server, and I would do the same with HTTP, FTP, and any other service that is exposed to the internet and requires authentication.<\/p>\n
Note that I left one commented line on the last example. You can uncomment the mode = normal<\/strong> and change it to a more aggressive approach, like DDoS<\/strong>, extra,<\/strong> or aggressive<\/strong>. See “filter.d\/sshd.conf” for usage example and details.<\/p>\n
Save the configuration file, restart your service, and check if it is running or has failed due to any configuration issue:<\/p>\n
sudo systemctl restart fail2ban\r\nsudo systemctl status fail2ban<\/pre>\n
Fail2Ban offers a CLI that makes it possible for you to interact with the service called fail2ban-client<\/strong>. See examples of usage:<\/p>\n
sudo fail2ban-client status sshd\r\nsudo fail2ban-client set sshd unbanip 1.1.1.1\r\nsudo fail2ban-client set sshd banip 1.1.1.1\r\nsudo fail2ban-client -h<\/pre>\n
Right after setting up this service, I just received 46 new emails of banned IPs trying to enter my SSHD as root (I omitted the last number):<\/p>\n
Total failed: 1106<\/strong>\r\nTotal banned: 38<\/strong>\r\nBanned IP list<\/strong>: 93.39.184.1X 95.78.251.11X 208.109.11.3X 167.71.237.7X 162.243.130.8X 82.65.23.6X 100.26.163.9X (...)<\/pre>\n
Checking the origin of the IP addresses, I can only say that they come from anywhere: USA, CH, IND, SG, RU, IT, FR, UK, GER, VN, NL, HK, etc. Most of them are from OVH SAS and DigitalOcean (private cloud services).<\/p>\n
Consequently, from the large number of “hackers”, I had to disable the email notification (more than 10 emails per hour).<\/p>\n
A week after setting up this safety tool, the number of bans on my SSH fell from 200 a day to 4. The only reason I see for it is that by being banned, many might get discouraged to keep trying. So, for the same reason, I will disable ping responses to not advertise that my server is live and see if I get any improvement.<\/p>\n
If you want to get all the status at the same time (it is one big line):<\/p>\n
fail2ban-client status | sed -n 's\/,\/\/g;s\/.*Jail list:\/\/p' | xargs -n1 fail2ban-client status<\/pre>\n
\n
BONUS<\/strong><\/p>\n
Did you know you can use Fail2Ban also to protect your WordPress<\/strong> website? See more in WordPress Configuration Tips and Tricks [Link<\/a>].<\/p>\n
As an alternative to Fail2Ban, the open source SSHGuard<\/strong> aims to accomplish the same goal [Link<\/a>].<\/p>\n
sudo apt update && sudo apt install sshguard -y\r\necho '192.168.1.0\/24' >> \/etc\/sshguard\/whitelist\r\nsudo nano \/etc\/sshguard\/sshguard.conf<\/pre>\n
Configure accordingly.<\/p>\n
# For IPTABLES\r\nBACKEND=\"\/usr\/lib\/sshguard\/sshg-fw-iptables\"\r\n# For NFTABLES\r\n#BACKEND=\"\/usr\/lib\/sshguard\/sshg-fw-nft-sets\"\r\nWHITELIST_FILE=\"\/etc\/sshguard\/whitelist\"\r\nBLOCK_TIME=1200\r\nDETECTION_TIME=1800\r\nTHRESHOLD=30<\/pre>\n
Start and check the activity in the logs.<\/p>\n
sudo systemctl enable sshguard --now\r\nsudo journalctl -u sshguard -f<\/pre>\n
List the banned IPs and unban by line number.<\/p>\n
sudo iptables --list sshguard --line-numbers --numeric\r\nsudo iptables --delete sshguard <line-number><\/pre>\n","protected":false},"excerpt":{"rendered":"
Fail2Ban is a service that watches the log files of your services, such as SSH, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,6],"tags":[],"class_list":["post-401","post","type-post","status-publish","format-standard","hentry","category-linux","category-raspberry-pi"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=401"}],"version-history":[{"count":17,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/401\/revisions"}],"predecessor-version":[{"id":5498,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/401\/revisions\/5498"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}