‍Fail2Ban is a powerful and popular open-source intrusion prevention framework that can help protect your AlmaLinux 9 server from malicious activities. By monitoring log files and automatically banning IP addresses that exhibit suspicious behavior, Fail2Ban adds an extra layer of security to your system. In this article, we will guide you through the process of installing Fail2Ban on AlmaLinux 9 and configuring it to enhance the security of your server.

Prerequisites

Before we begin, make sure you have the following prerequisites in place:

• An AlmaLinux 9 server with root access.
• A stable internet connection.

Step 1: Installing the EPEL Repository

The first step in installing Fail2Ban is to install the EPEL (Extra Packages for Enterprise Linux) repository. The EPEL repository provides additional packages that are not included in the default AlmaLinux repositories. To install the EPEL repository, open a terminal and run the following command:

yum install epel-release

When prompted for permission, press “y” and then hit “Enter” to continue with the installation.

Step 2: Installing Fail2Ban

Once the EPEL repository is installed, you can proceed with installing Fail2Ban. To install Fail2Ban, run the following command in the terminal:

yum install fail2ban

During the installation process, you may be prompted for several permissions. To proceed with the installation, simply press “y” and then hit “Enter”.

Step 3: Configuring Fail2Ban

After successfully installing Fail2Ban, we need to configure it to meet our specific requirements. Fail2Ban has two main configuration files: jail.conf and jail.local. While jail.conf contains the default configuration settings, we will be making changes in jail.local to avoid overwriting our modifications during package upgrades.

To open the jail.local file for editing, run the following command:

nano /etc/fail2ban/jail.local

In the jail.local file, you can define various settings to customize the behavior of Fail2Ban. Let’s add the following content to the file:

[DEFAULT]
# Ban hosts for one hour:
bantime = 3600
# Override /etc/fail2ban/jail.d/00-firewalld.conf:
banaction = iptables-multiport

[sshd]
enabled = true

The above configuration sets the ban time to one hour and uses the iptables-multiport ban action. Additionally, it enables the Fail2Ban protection for the SSH service ( sshd ).

Note: If your server uses firewalld instead of iptables, you can simply comment the banaction line by adding a # at the beginning of the line.

Once you have made the necessary changes, save the file and exit the editor.

Step 4: Enabling Fail2Ban

To ensure that Fail2Ban starts automatically when the system boots up, run the following command:

systemctl enable fail2ban

This will enable the Fail2Ban service to start on boot.

Step 5: Restarting Fail2Ban

After making changes to the Fail2Ban configuration, it is important to restart the service for the new settings to take effect. To restart Fail2Ban, run the following command:

systemctl restart fail2ban

Step 6: Checking Fail2Ban Status

To verify that Fail2Ban is up and running, you can use the fail2ban-client command to check the status. Run the following command:

fail2ban-client status

The output should display the number of jails and the list of jails, which should include sshd if you followed the configuration steps correctly.

To view detailed information about the sshd jail, run the following command:

fail2ban-client status sshd

The output will provide details about the current status of the SSH jail, including the number of failed login attempts and the list of banned IP addresses.

Step 7: Fine-tuning Fail2Ban Settings

By default, Fail2Ban uses a set of predefined values for ban time, find time, and max retries. However, these values may not be suitable for all scenarios. To customize the behavior of Fail2Ban, you can modify the jail.local file.

Let’s make some adjustments to the jail.local file to demonstrate how to fine-tune Fail2Ban settings. Open the file for editing:

nano /etc/fail2ban/jail.local

In the file, find the following lines and modify them as shown:

bantime = 600
findtime = 600
maxretry = 3

In this example, we have set the ban time to 600 seconds, meaning that a client will be blocked for 10 minutes if they make 3 unsuccessful login attempts within that time frame.

After making the changes, save the file and exit the editor.

Step 8: Verifying Fail2Ban Modifications

To verify that the changes in the jail.local file have been applied, run the following command:

fail2ban-client status sshd

The output will show the updated values for the ban time and the other settings.

Conclusion

Congratulations! You have successfully installed and configured Fail2Ban on your AlmaLinux 9 server. By implementing Fail2Ban, you have taken an important step towards enhancing the security of your server and protecting it from malicious activities.

Remember to regularly monitor the Fail2Ban logs and adjust the configuration settings as needed to ensure optimal protection. With Fail2Ban in place, you can have peace of mind knowing that your server is well-guarded against potential threats.

For more information about secure cloud hosting solutions and Cloud VPS services, visit Shape.host.

Now go ahead and explore the powerful features of Fail2Ban to safeguard your AlmaLinux 9 server. Stay secure, stay protected!

Christian Wells