![\"\"](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2022\/11\/Linux-cheat-sheet.png\/public\")
<\/a><\/figure><\/div>\n\n\n\n\n\n<\/p>
What Is Fail2Ban and What Is It Used For?<\/h2>
Fail2Ban is a log-parsing application that protects Linux virtual server host<\/a> against many security threats, such as dictionary, DoS, DDoS, and brute-force attacks. It works by monitoring system logs for any malicious activity and scanning files for any entries matching identified patterns.<\/p> If Fail2Ban detects a spike of failed login attempts, it will automatically add new firewall rules to your iptables and block the source address for a specified time or indefinitely.<\/p> Installing Fail2Ban helps server owners mitigate any illegitimate activity automatically. It also alerts them via email whenever an attack is occurring.<\/p> A similar tool to Fail2Ban is Suricata<\/strong>, an intrusion detection and prevention system (IDS\/IPS). Instead of login attempts, this tool monitors your VPS network and notifies users about potentially malicious traffic.<\/p> If you want to set up the tool, check out our other tutorial to learn how to install Suricata on Ubuntu<\/a>. <\/p> To install the Fail2Ban service, connect to your server with root access using an SSH client like Terminal (macOS and Linux) or PuTTY<\/a> (Windows).<\/p> Here’s how to install Fail2Ban on Ubuntu<\/a>:<\/p> Hostinger VPS customers can also use Kodee <\/strong>AI Assistant to confirm Fail2ban’s status post-installation. Access it via your VPS dashboard’s left sidebar and ask it a question like the following example:<\/p> You can also ask Kodee to restart Fail2Ban by simply entering, “Restart Fail2Ban on my VPS.”<\/p> Follow these steps to install Fail2Ban on CentOS<\/a>:<\/p> Here’s how to install Fail2Ban on Debian:<\/p> Follow these instructions to install Fail2Ban on Fedora:<\/p> After installing Fail2Ban, consider configuring it. In this section, we will explore how to do it using the fail2ban.local<\/strong> and jail.local<\/strong> files.<\/p> The fail2ban.conf<\/strong> file houses Fail2Ban’s basic configuration. It contains the global settings that should not be modified.<\/p> If you want to make any changes, we recommend creating a local file. Make a copy of fail2ban.conf <\/strong>and rename it to fail2ban.local<\/strong> to override the default configuration profile.<\/p> Here’s how to change the name of the copy and setup the settings on fail2ban.local file:<\/p> Let’s go over the options and the values they can take.<\/p> Define the log output level as:<\/p> Log actions in a specific target socket, which can be:<\/p> Set the syslog socket file to auto<\/strong> or file<\/strong> (if you’ve set logtarget<\/strong> as SYSLOG<\/strong>).<\/p> Set the socket file to communicate with the daemon. The default location is \/var\/run\/fail2ban\/fail2ban.sock<\/strong>.<\/p> Set the PID file to store the process ID of the Fail2Ban server. The default location is \/var\/run\/fail2ban\/fail2ban.pid<\/strong>.<\/p> Fail2Ban has another configuration file named jail.conf<\/strong> which includes jails<\/strong> – filters with actions. However, users shouldn’t directly modify this file as it contains the basic rule set for the software.<\/p> Instead, make a copy of the original file and name it jail.local<\/strong>. Using it, you’ll be able to customize and setup filters and actions, such as ignoreip<\/strong>, bantime<\/strong>, findtime<\/strong>, maxretry<\/strong>, and backend<\/strong>.<\/p> ignoreip<\/strong><\/p> This feature requires you to specify trusted IP addresses, DNS hosts, or CIDR masks that Fail2Ban should ignore<\/strong>. This parameter permits all traffic coming from the specified sources. You can add multiple addresses and separate them with a space.<\/p> bantime<\/strong><\/p> This parameter sets the length of time that a client will be banned for after failed authentication. The ban period is measured in seconds, and the default number is 600 or 10 minutes.<\/p> findtime<\/strong><\/p> This setting determines the time period for failed login attempts. If a host fails authentication a certain number of times (based on the maxretry<\/strong> setting) during the set period, its IP address will be banned.<\/p> maxretry<\/strong><\/p> maxretry<\/strong> works together with findtime<\/strong> – it sets the maximum number of unsuccessful login attempts within the defined time window. The default value is 5.<\/p> backend<\/strong><\/p> This feature allows you to specify the backend configuration for file modification. The default value is auto<\/strong>, but if you use CentOS or Fedora, it needs to be systemd<\/strong>.<\/p> Here are the available values you can choose from:<\/p> You can also setup additional configurations in the jail.local<\/strong> file, including SSH<\/strong> and iptables<\/strong> settings. The available options include:<\/p> Fail2Ban is log-parsing software that helps protect Linux-based web servers against cyber attacks.<\/p> This article has demonstrated howto install Fail2Ban on popular operating systems, such as Ubuntu, CentOS, Debian, and Fedora. We have also explained how to edit fail2ban.local<\/strong> and jail.local<\/strong>, the software’s configuration files.<\/p> We hope this article has helped you set up Fail2Ban on your Linux server. If you have any questions or suggestions, leave them in the comments section below.<\/p> \n\n\n Complete Iptables Tutorial<\/a> Yes, it is an essential part of your server’s security infrastructure. Fail2Ban will help secure your machine from cyber attacks that try to meddle with your login credentials. <\/p> <\/div> UFW is an additional security layer to protect your VPS from port-scanning attacks. While Fail2Ban uses iptables as the default firewall system, you can customize the software and enable UFW instead. <\/p> <\/div> A DDoS attack is a malicious attempt to interrupt the operation of a targeted server or service by flooding it with fake requests. Using the jail configuration file of Fail2Ban, you can create customized rules to detect excessive requests and block their sources.<\/p> <\/div> Fail2Ban is active and running as soon as you enable it. Users don’t need to modify its configuration as the software actually provides reasonable protection right off the bat.<\/p> <\/div> <\/div>\n","protected":false},"excerpt":{"rendered":" Fail2Ban is arguably the best software to secure a Linux server and protect it against automated attacks. When enabled, it […]<\/p>\n![\"\"](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2023\/02\/VPS-hosting-banner.png\/public\")
<\/a><\/figure>How to Install Fail2Ban<\/h2>
Ubuntu:<\/h3>
\n
apt-get update && apt-get upgrade<\/pre>
\n
apt-get install fail2ban<\/pre>
\n
apt-get install sendmail<\/pre>
\n
sudo systemctl status fail2ban<\/pre>
![\"Kodee](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2022\/05\/hpanel-vps-kodee-systemctl.png\/public\")
<\/a><\/figure><\/div>CentOS:<\/h3>
\n
sudo yum install epel-release<\/pre>
\n
sudo yum install fail2ban<\/pre>
\n
sudo systemctl enable fail2ban<\/pre>
sudo systemctl start fail2ban<\/pre>
Debian:<\/h3>
\n
apt-get update && apt-get upgrade -y<\/pre>
\n
apt-get install fail2ban<\/pre>
\n
apt-get install sendmail-bin sendmail<\/pre>
\n
systemctl status fail2ban<\/pre>
Fedora:<\/h3>
\n
dnf update<\/pre>
\n
dnf install fail2ban<\/pre>
\n
dnf install sendmail<\/pre>
\n
systemctl start fail2ban<\/pre>
systemctl enable fail2ban<\/pre>
\n
systemctl start sendmail<\/pre>
systemctl enable sendmail<\/pre>
How to Set Up Fail2Ban<\/h2>
Edit the Default Settings with fail2ban.local (Optional)<\/h3>
\n
cp \/etc\/fail2ban\/fail2ban.conf \/etc\/fail2ban\/fail2ban.local<\/pre>
\n
sudo nano \/etc\/fail2ban\/fail2ban.local<\/pre>
\n
loglevel = INFO<\/pre>
\n
![\"An](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2022\/05\/An-excerpt-from-the-fail2ban.local-config-file-talking-about-the-loglevel-option.png\/public\")
<\/a><\/figure><\/div>logtarget = STDERR<\/pre>
\n
syslogsocket = auto<\/pre>
![\"An](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2022\/05\/An-excerpt-from-the-fail2ban.local-config-file-talking-about-the-syslogsocket-option.png\/public\")
<\/a><\/figure><\/div>socket = \/var\/run\/fail2ban\/fail2ban.sock<\/pre>
![\"An](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2022\/05\/An-excerpt-from-the-fail2ban.local-config-file-talking-about-the-socket-option.png\/public\")
<\/a><\/figure><\/div>pidfile = \/var\/run\/fail2ban\/fail2ban.pid<\/pre>
![\"An](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2022\/05\/An-excerpt-from-the-fail2ban.local-config-file-talking-about-the-pidfile-option.png\/public\")
<\/a><\/figure><\/div>Setting Up the jail.local Configuration File<\/h3>
![\"An](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2022\/05\/An-excerpt-from-the-jail.local-config-file-talking-about-the-ignoreip-option.png\/public\")
<\/a><\/figure><\/div>![\"An](\"\/tutorials\/wp-content\/uploads\/sites\/2\/2022\/05\/An-excerpt-from-the-jail.local-config-file-with-the-bantime-parameter..png\")
<\/a><\/figure><\/div>![\"An](\"\/tutorials\/wp-content\/uploads\/sites\/2\/2022\/05\/An-excerpt-from-the-jail.local-config-file-with-the-findtime-parameter..png\")
<\/a><\/figure><\/div>![\"An](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2022\/05\/An-excerpt-from-the-jail.local-config-file-with-the-maxretry-parameter.png\/public\")
<\/a><\/figure><\/div>\n
![\"An](\"\/tutorials\/wp-content\/uploads\/sites\/2\/2022\/05\/An-excerpt-from-the-jail.local-config-file-with-the-backend-parameter..png\")
<\/a><\/figure><\/div>\n
Conclusion<\/h2>
Learn other VPS security best practices<\/h4>\n
\nHow to Setup OpenVPN on Linux<\/a>
\nHow to Configure UFW Firewall on Ubuntu<\/a>
\nHow to Install ClamAV on CentOS<\/a><\/p>\n <\/div>\n\n\n\n<\/p>Fail2Ban Configuration FAQ<\/h2>
Do I Need Fail2Ban?<\/h3>
Does Fail2Ban Work with UFW?<\/h3>
Does Fail2Ban Prevent DDoS Attacks?<\/h3>
Does Fail2Ban Work Out of the Box?<\/h3>