In today’s digital landscape, cybersecurity is of paramount importance. As businesses increasingly rely on remote access, securing their systems against unauthorized access becomes crucial. One effective way to protect your SSH (Secure Shell) server from brute-force attacks is by using Fail2Ban, an intrusion prevention framework written in Python. In this article, we will guide you through the process of installing and configuring Fail2Ban on Debian 11.

1. Introduction to Fail2Ban

Fail2Ban is an open-source software that acts as an additional layer of security for your SSH server. It works by monitoring log files, such as SSH, ProFTP, Apache, etc., for failed login attempts and automatically blocks the IP addresses from which these attempts originate. By doing so, Fail2Ban effectively mitigates the risk of brute-force attacks.

2. Installing Fail2Ban on Debian 11

Before we can configure Fail2Ban, we need to install it on our Debian 11 system. Follow the steps below to install Fail2Ban:

1. Update the system packages by running the following command:

apt update -y
apt upgrade -y

2. Install the Fail2Ban package by executing the command:

apt install fail2ban -y

3. Enable Fail2Ban to start automatically on system boot by running:

systemctl enable fail2ban

4. To check the status of the Fail2Ban service, use the command:

systemctl status fail2ban

You should see an output similar to the following:

● fail2ban.service - Fail2Ban Service
Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2021-08-04 14:06:32 GMT; 2min 26s ago
Docs: man:fail2ban(1)
Main PID: 73604 (fail2ban-server)
Tasks: 5 (limit: 4677)
Memory: 15.5M
CPU: 743ms
CGroup: /system.slice/fail2ban.service
└─73604 /usr/bin/python3 /usr/bin/fail2ban-server -xf start

Aug 04 14:06:32 server systemd[1]: Starting Fail2Ban Service...

3. Configuring Fail2Ban

Now that Fail2Ban is installed, we can proceed with the configuration. Fail2Ban has two main configuration files: jail.conf and jail.local. We will create a jail.local file to customize the configuration without affecting the original jail.conf file.

Whitelisting IP Addresses

To prevent certain IP addresses from being blocked by Fail2Ban, we can whitelist them. Follow the steps below to add IP addresses to the whitelist:

1. Create a jail.local configuration file by copying the default jail.conf file:

cp /etc/fail2ban/jail.{conf,local}

2. Open the jail.local file for editing:

nano /etc/fail2ban/jail.local

3. Locate the following line in the file and uncomment it to whitelist the IP address:

ignoreip = 127.0.0.1/8::1

Uncomment the line and add your IP address at the end, separated by a space:

ignoreip = 127.0.0.1/8::1 <Your IP address here>

For example:

ignoreip = 127.0.0.1/8 ::1 198.100.0.10 198.100.0.20 10.10.0.20

Ban Settings

Fail2Ban provides three main options to configure the ban settings: bantime, findtime, and maxretry. These options determine how long an IP address is banned, the time window for detecting repeated failed login attempts, and the maximum number of retries allowed before blocking, respectively.

To adjust these settings, follow the steps below:

1. Open the jail.local file for editing:

nano /etc/fail2ban/jail.local

2. Locate the following lines in the file and modify them according to your requirements:

bantime = 10m
findtime = 10m
maxretry = 5

These values represent the default settings. Adjust them as needed.

Email Notifications

Fail2Ban can send email notifications to keep you informed about blocked IP addresses and relevant log lines. However, to receive email alerts, you need to have an SMTP server installed on your system.

To configure email notifications, follow these steps:

1. Open the jail.local file for editing:

nano /etc/fail2ban/jail.local

2. Locate the following line and ensure that it is present in the file:

# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
action_mwl = %(action_)s %(mta)s-whois-lines[sender="%(sender)s", dest="%(destemail)s", logpath="%(logpath)s", chain="%(chain)s"]

3. Update the email addresses with your desired sender and recipient addresses:

destemail = admin@xyz.com
sender = root@xyz.com

4. Interacting with Fail2Ban

Fail2Ban provides a command-line tool called fail2ban-client to interact with the service. This tool allows you to perform various actions, such as checking the status of jails, banning and unbanning IP addresses, and more.

To use fail2ban-client, follow the steps below:

1. To check the status of a specific jail, use the following command:

fail2ban-client status <jail-name>

For example, to check the status of the sshd jail, run:

fail2ban-client status sshd

2. To unban an IP address, use the command:

fail2ban-client set <jail-name> unbanip <IP address>

Replace <jail-name> with the name of the jail and <IP address> with the actual IP address you want to unban.

3. To ban an IP address, use the command:

fail2ban-client set <jail-name> banip <IP address>

Replace <jail-name> with the name of the jail and <IP address> with the IP address you want to ban.

5. Conclusion

Securing your SSH server is vital to protect your system from unauthorized access. Fail2Ban offers an effective solution by automatically blocking IP addresses that engage in brute-force attacks. In this article, we discussed how to install and configure Fail2Ban on Debian 11, including whitelisting IP addresses, adjusting ban settings, and configuring email notifications. By implementing these steps, you can enhance the security of your SSH server and ensure a safe and reliable environment for your business.

Remember, cybersecurity is an ongoing process, and regularly updating and monitoring your systems is crucial. If you’re looking for professional and reliable cloud hosting services, consider Shape.host. They offer scalable and secure Linux SSD VPS solutions tailored to meet your specific needs. Protect your business today with Fail2Ban and Shape.host’s robust hosting services.

Shape.host is a leading provider of Linux SSD VPS hosting services. With their cutting-edge infrastructure and exceptional support, they offer reliable and secure hosting solutions for businesses of all sizes. Whether you need a single VPS or a cluster of servers, Shape.host has the expertise and resources to meet your requirements. Experience the power of Shape.host’s cloud hosting today and enjoy a seamless and worry-free hosting experience.

Christian Wells