YouTip

[ Linux Command Reference](#) * * * fail2ban is an open-source intrusion prevention tool designed to protect Linux servers from brute-force attacks. It works by monitoring system log files (such as /var/log/auth.log) to detect malicious activities, such as multiple failed SSH login attempts, and then automatically updates firewall rules to block the IP addresses of these attackers. * * * ## fail2ban Core Features ### Real-time Log Monitoring fail2ban continuously monitors specified log files, searching for predefined patterns of malicious behavior. ### Automatic IP Blocking When multiple failed attempts are detected from the same IP address (configurable threshold), fail2ban automatically adds that IP to the firewall blocklist. ### Configurable Ban Duration Administrators can set an initial ban duration and escalating ban durations for repeated violations. ### Multi-service Support In addition to SSH, it also supports protection for Apache, Nginx, FTP, mail services, and many other services. ### Email Notifications Can be configured to send email notifications to administrators when IPs are blocked. * * * ## fail2ban Installation and Configuration ### Installation Methods On Debian/Ubuntu-based systems: ## Example sudo apt update sudo apt install fail2ban On RHEL/CentOS-based systems: ## Example sudo yum install epel-release sudo yum install fail2ban ### Basic Configuration The main configuration files for fail2ban are located at: * `/etc/fail2ban/jail.conf` - Main configuration file (not recommended for direct modification) * `/etc/fail2ban/jail.local` - User custom configuration (recommended for modifications here) Create a custom configuration file: sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local * * * ## fail2ban Common Commands ### Start/Stop/Restart Service ## Example sudo systemctl start fail2ban # Start service sudo systemctl stop fail2ban # Stop service sudo systemctl restart fail2ban # Restart service sudo systemctl enable fail2ban # Enable at boot ### Check Service Status sudo systemctl status fail2ban ### View Blocked IPs sudo fail2ban-client status sshd ### Unblock Specific IP sudo fail2ban-client set sshd unbanip 192.168.1.100 ### Manually Block IP sudo fail2ban-client set sshd banip 192.168.1.100 * * * ## fail2ban Configuration File Details ### Main Configuration Parameters ## Example # Ignored IP addresses (whitelist) ignoreip= 127.0.0.1/8 ::1 192.168.1.0/24 # Ban duration (seconds) bantime= 600 # Detection time window (seconds) findtime= 600 # Maximum retry attempts maxretry= 3 # Firewall backend used banaction= iptables-multiport # Enable SSH protection enabled= true # Log file path logpath= %(sshd_log)s # Filter name filter= sshd # Port number port= ssh ### Custom Filters Filters are defined in the `/etc/fail2ban/filter.d/` directory. For example, to create a custom SSH filter: 1. Copy the default SSH filter: sudo cp /etc/fail2ban/filter.d/sshd.conf /etc/fail2ban/filter.d/sshd-custom.conf 2. Edit the custom filter and modify the regular expression to match specific failure patterns. * * * ## fail2ban Practical Examples ### Protecting SSH Service 1. Edit the jail.local file: sudo nano /etc/fail2ban/jail.local 2. Add or modify the following content: enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 3 bantime = 3600 findtime = 600 3. Restart the fail2ban service: sudo systemctl restart fail2ban ### Protecting Apache Service 1. Ensure the following content is in jail.local: enabled = true port = http,https filter = apache-auth logpath = /var/log/apache2/error.log maxretry = 3 bantime = 86400 2. Restart the service to apply the configuration. * * * ## fail2ban Advanced Usage ### Using fail2ban to Protect Custom Services 1. Create a custom filter file: sudo nano /etc/fail2ban/filter.d/myapp.conf 2. Add filter rules (example): failregex = ^.* .* "POST /login.php.* 401 ignoreregex = 3. Add the corresponding jail in jail.local: enabled = true port = http,https filter = myapp logpath = /var/log/myapp/access.log maxretry = 5 bantime = 3600 ### Setting Up Email Notifications 1. Edit the jail.local file: destemail = admin@example.com sender = fail2ban@example.com mta = sendmail action = %(action_mwl)s 2. Ensure the system has a mail sending tool installed and configured (such as sendmail or postfix). * * * ## fail2ban Logs and Troubleshooting ### Viewing fail2ban Logs sudo tail -f /var/log/fail2ban.log ### Common Problem Solutions #### fail2ban Not Working * Check if the service is running: `sudo systemctl status fail2ban` * Check the logs for errors: `sudo journalctl -u fail2ban` #### IP Not Being Blocked * Confirm the log path is correct * Check if the filter regular expression matches log entries * Increase log level for debugging: set `loglevel = DEBUG` in jail.local #### False Positive IP Blocks * Add trusted IPs to the ignoreip list * Reduce maxretry or increase findtime * * * ## fail2ban Best Practices 1. **Regular Updates**: Keep fail2ban updated to get the latest security fixes and feature improvements. 2. **Reasonable Configuration**: * Set appropriate maxretry and bantime values * Don't set bantime too long to avoid blocking legitimate users * Don't set it too short either, otherwise the protection effect will be limited 3. **Monitoring and Review**: * Regularly check the list of blocked IPs * Analyze logs to understand attack patterns 4. **Multi-layer Protection**: * Combine fail2ban with other security measures (such as firewalls, strong password policies) * Consider changing the default SSH port 5. **Backup Configuration**: * Backup custom configuration files and filters * Document all modifications for troubleshooting recovery * * * ## Summary fail2ban is an important tool for Linux system security. By automatically detecting and blocking malicious behavior, it effectively prevents brute-force attacks. Correctly configuring and using fail2ban can significantly improve server security while reducing the workload of manual intervention by administrators. Through the introduction in this article, you should have mastered the basic usage and advanced configuration techniques of fail2ban, and be able to customize your own security protection strategy according to actual needs. * * Linux Command Reference](#)