In this article, we have explained how to install and configure Fail2Ban for Linux SSH security.<\/p>\n
Fail2Ban is a powerful tool that helps protect your server by automatically detecting and blocking IP addresses after repeated failed login attempts. It monitors system log files for suspicious activity, such as brute-force attacks, and responds by actively updating firewall rules to prevent further access from malicious sources. This significantly reduces the risk of unauthorised access to services like SSH and enhances the overall security of your Linux server.<\/p>\n
Follow the guide:<\/strong><\/p>\n This custom jail.local file will override the default settings in jail.conf and ensure your changes are preserved during package updates.<\/li>\n This configuration instructs Fail2Ban to monitor SSH login attempts and ban IP addresses that exceed three failed logins within 10 minutes (600 seconds), blocking them for 1 hour (3600 seconds). To receive alerts and customised actions.<\/li>\n<\/ol>\n<\/li>\n Each filter file defines patterns that match suspicious log entries.<\/li>\n Alternatively, you can also check the status of the SSH jail to see if the IP appears in the list of banned addresses using:<\/p>\n This ensures your configuration is working as expected and actively protecting your server from brute-force attacks.<\/li>\n<\/ol>\n With Fail2Ban configured, your server is now better protected against brute-force and unauthorised SSH access. Regularly check your logs and jail status to maintain security. If you want any help, feel free to contact our support specialists.<\/p>\n Concerned about server threats? Learn How to check if your Linux server is under a DDOS attack<\/a><\/strong><\/em><\/p>\n","protected":false},"excerpt":{"rendered":" In this article, we have explained how to install and configure Fail2Ban for Linux SSH security. Fail2Ban is a powerful tool that helps protect your server by automatically detecting and…<\/p>\n\n
sudo apt update\r\nsudo apt upgrade<\/pre>\n<\/li>\n
sudo apt install fail2ban<\/pre>\n<\/li>\n
sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/pre>\n
\n
sudo nano \/etc\/fail2ban\/jail.local<\/pre>\n<\/li>\n
[sshd]\r\nenabled = true\r\nport\u00a0\u00a0\u00a0\u00a0 = ssh\r\nfilter\u00a0\u00a0 = sshd\r\nlogpath\u00a0 = \/var\/log\/auth.log\r\nmaxretry = 3\r\nfindtime = 600\r\nbantime\u00a0 = 3600<\/pre>\n
\nKey Parameters Explained:<\/strong><\/p>\n\n
\n<\/strong>You can also add:<\/p>\ndestemail = your@email.com\r\naction\u00a0\u00a0\u00a0 = %(action_mwl)s<\/pre>\n
\/etc\/fail2ban\/filter.d\/<\/pre>\n
sudo systemctl enable fail2ban\r\nsudo systemctl start fail2ban<\/pre>\n<\/li>\n
sudo fail2ban-client status<\/pre>\n<\/li>\n
sudo fail2ban-client status sshd<\/pre>\n<\/li>\n
sudo iptables -L<\/pre>\n
sudo fail2ban-client status sshd<\/pre>\n