Securing your Nginx server is critical to ensure the safety and integrity of your web applications. One effective way to enhance security is by using Fail2Ban, a powerful intrusion prevention software framework that protects servers from brute-force attacks. This article will guide you through the steps to install and configure Fail2Ban to protect an Nginx server on Ubuntu 22.04.

Step 1: Deploying a Cloud Instance on Shape.host

• Log in to Shape.host Dashboard:

• Navigate to the Shape.host website and log in to your account.

• Create a New Instance:

• Click on the “Create” button located at the top right corner of the dashboard.
• From the dropdown menu, select “Instances”.

• Select Instance Location:

• Choose the desired location for your server. For this tutorial, we’ll select “New York, USA”.

• Choose a Plan:

• Select a plan that fits your requirements. For example, you might choose a plan with 2 cores CPU, 2 GB Memory, and 50 GB SSD disk space.

• Select an Operating System:

• Scroll down to the “Choose an image” section and select “Ubuntu 22.04”.

• Configure Additional Options:

• (Optional) You can configure additional options like User Data Configuration and IPv6 Networking.
• Enter a hostname for your instance, e.g., “Tutorial Ubuntu”.
• Click on the “Create instance” button to deploy the instance.

Step 2: Connecting to Your Instance

• Retrieve SSH Credentials:

• Note the IP address of your newly created instance from the Shape.host dashboard.

• Connect via SSH:

• Open a terminal on your local machine.
• Use the following command to connect to your instance:
  ssh root@your_instance_ip
• Replace your_instance_ip with the actual IP address of your instance.

Step 3: Install Fail2Ban

First, update your package list and install Fail2Ban:

apt update
apt install fail2ban -y

Step 4: Configure Fail2Ban

Once installed, the next step is to configure Fail2Ban. The main configuration file is located at /etc/fail2ban/jail.conf, but it is best practice to create a local configuration file to override default settings:

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit the local configuration file:

nano /etc/fail2ban/jail.local

In this file, you can configure the default settings. For example, you can set the ignoreip parameter to whitelist your IP addresses, the bantime to define how long an IP is banned, and the findtime and maxretry parameters to configure the fail detection.

Add the following basic settings:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
bantime  = 1h
findtime  = 10m
maxretry = 5

Step 5: Configure Fail2Ban for Nginx

Next, you need to configure Fail2Ban to monitor Nginx logs. Fail2Ban comes with default configurations for various services, including Nginx. These configurations are located in the /etc/fail2ban/filter.d directory.

To enable Nginx protection, add the following sections to your /etc/fail2ban/jail.local file:

Protecting Nginx from HTTP Auth Failures

[nginx-http-auth]
enabled = true
port    = http,https
filter  = nginx-http-auth
logpath = /var/log/nginx/error.log
maxretry = 3

Protecting Nginx from Bad Bots

[nginx-badbots]
enabled  = true
port     = http,https
filter   = nginx-badbots
logpath  = /var/log/nginx/access.log
bantime  = 48h
maxretry = 1

Protecting Nginx from 404 Errors

[nginx-404]
enabled  = true
port     = http,https
filter   = nginx-404
logpath  = /var/log/nginx/access.log
maxretry = 5
findtime = 60m
bantime  = 24h

Protecting Nginx from Excessive Requests

[nginx-limit-req]
enabled  = true
port     = http,https
filter   = nginx-limit-req
logpath  = /var/log/nginx/access.log
maxretry = 10
findtime = 60m
bantime  = 24h

Step 6: Create Filter Configurations

If the filter configurations for Nginx do not already exist, you need to create them. For example, to create a filter for nginx-http-auth, create a file named nginx-http-auth.conf in the /etc/fail2ban/filter.d/ directory:

nano /etc/fail2ban/filter.d/nginx-http-auth.conf

Add the following content to the file:

[Definition]
failregex = no user/password was provided for basic authentication.*client: <HOST>
ignoreregex =

Repeat this process for the other filters (nginx-badbots, nginx-404, nginx-limit-req), ensuring the failregex patterns match the log entries you want to filter.

Step 7: Restart Fail2Ban

After configuring Fail2Ban, restart the service to apply the changes:

systemctl restart fail2ban

You can also enable Fail2Ban to start on boot:

systemctl enable fail2ban

Step 8: Monitor Fail2Ban

To ensure that Fail2Ban is working correctly, you can monitor its status using the following command:

fail2ban-client status

This command provides an overview of the jails that are active. To get detailed information about a specific jail, use:

fail2ban-client status <jail_name>

For example:

fail2ban-client status nginx-http-auth

By following these steps, you can significantly enhance the security of your Nginx server using Fail2Ban. This tool helps protect your server against various types of attacks by monitoring log files and banning malicious IP addresses.

For further security and performance optimization, consider using Shape.host services. Shape.host offers reliable Cloud VPS solutions that can help you achieve robust and scalable infrastructure for your web applications. Visit Shape.host to learn more about their offerings and how they can support your hosting needs.