Having a Linux server exposed to the network is essentially like putting out a magnet for bots. If you haven't configured any security measures, you likely already have thousands of failed login attempts in your logs; there are automated machines constantly trying username and password combinations to try and take control of your machine through brute-force attacks.
This is where Fail2ban comes in, a tool that acts as a tireless watchdog. It's not a firewall in the strictest sense, but rather it analyzes system logs and, when it detects someone trying to force their way in, it slams the door in their face by blocking their IP address using tools like iptables or nftables. Let's see how to configure it to make your server a tough nut to crack.
What exactly is Fail2ban and how does it work?
To put it simply, Fail2ban is a daemon that continuously monitors the log files of your services. When it finds suspicious patterns that match predefined rules, called filters , it starts counting failures. If an IP address reaches the limit of allowed attempts within a certain time, the program executes an action , which typically involves adding that IP address to the firewall's blacklist.
These configurations are organized into what are called jails . A jail is basically a set of rules applied to a specific service (such as SSH, Apache, or MySQL). This way, you can have a very strict policy for remote access and a more permissive one for the web server, ensuring that intruders are automatically blocked without you having to manually check the logs every five minutes.
Installation according to your Linux distribution
Depending on which system you are using, the command to install it varies slightly, but it is generally available in almost all official repositories.
- On Ubuntu and Debian: It's very simple, you just have to run
sudo apt updatefollowed bysudo apt install fail2ban. - On Rocky Linux or AlmaLinux: Since these are Enterprise distributions, you must first enable the EPEL repository with
sudo dnf install epel-releaseand then install the package withsudo dnf install fail2ban fail2ban-firewalld. - In Alpine Linux: Use the APK manager with
sudo apk add fail2banAnd, since it uses OpenRC, you must enable it withsudo rc-update add fail2ban defaultand start it withsudo rc-service fail2ban start.
Master configuration: The secret of the .local file
A very common mistake is to edit the file directly. jail.confDon't do it! That file can be overwritten when you update the system. The golden rule is to create a copy called jail.localAny parameters you add to this second file will take precedence over the original, and your changes will be overwritten. safe from updates.
To begin, you can clone the original file with sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local and then open it with your favorite editor, such as nano or vim. In the section [DEFAULT] This is where you define the overall behavior of the system:
- bantime: The length of time the malicious IP address will remain frozen. This can be in seconds or using 'm' for minutes (e.g., 10m).
- findtime: The time interval in which Fail2ban checks for errors. If someone fails 5 times in an hour but the findtime is 10 minutes, they will not be banned.
- maxretry: The number of failed attempts allowed before the system says Enough and block the IP.
- ignoreip: Essential to avoid banning yourself. Here you must enter your public IP address or your VPN range.
Protecting specific services step by step
Once the general settings are configured, it's time to activate the jails for the services that concern you most. For a protection to work, you must set enabled = true in its respective section within jail.local.
SSH Access (The most critical point)
Port 22 is the number one target. A robust configuration would define maxretry = 3 or with a bantime = 3600 (one hour). Fail2ban will read the file. /var/log/auth.log (on Debian/Ubuntu) or / var / log / secure (on CentOS/RHEL) to detect authentication failures and close access to the attacker.
Web Servers (Apache and Nginx)
If you have a website or online store, bots will try to access sensitive routes such as /wp-admin o /login.phpYou can create custom filters in /etc/fail2ban/filter.d/ to detect these patterns. For example, to protect WordPress403 errors or failed attempts are monitored in wp-login.php, blocking the IP if it exceeds the limits set in the Apache or Nginx jail.
Databases and FTP
For MySQL, you can monitor the error log for the phrase Access denied for userIn the case of FTP (such as ProFTPD), it is vital to ensure that the logpath match the actual path to your logs, because if Fail2ban cannot find the log file, the protection simply will not work.
Advanced management with fail2ban-client
You don't always have to edit files and restart the service to make quick changes. The command fail2ban-client It allows you to manage the system on the fly from the console.
To see which jails are active and how many IPs are blocked, use sudo fail2ban-client statusIf you want to delve deeper into a service, such as SSH, run sudo fail2ban-client status sshdFurthermore, if by mistake You have blocked a colleague Or you can quickly release the IP address yourself with the command sudo fail2ban-client set sshd unbanip IP_A_DESBLOQUEAR.
Maintenance and troubleshooting
If you notice that Fail2ban isn't blocking as it should, the first place to look is the tool's own log file. /var/log/fail2ban.log. Using tail -f You can see in real time who is being banned and why.
Remember that Fail2ban stores the lock status in an SQLite database in /var/lib/fail2ban/fail2ban.sqlite3Therefore, if you restart the server, the IPs that were banned will be unbanned. will remain blocked until your penalty period expires. Whenever you make changes to configuration files, don't forget to apply the changes with sudo systemctl restart fail2ban.
Implementing this tool transforms your server from an easy target into an automated fortress, reducing CPU load by discarding malicious traffic at the network layer and allowing you to sleep soundly knowing that bots won't be able to brute-force their way in. By combining the use of .local files, the management of specific jails, and constant log monitoring, you achieve a defense-in-depth system essential for any Linux system administrator.