SSH Fail2Ban Setup
Fail2Ban is a log based intrusion prevention system that can be utilized to reduce some brute force attacks against the SSH daemon. If Fail2Ban sees a specific number of failed access attempts from a single IP within a time-frame, it will modify the iptables firewall to ban (REJECT) that IP for a defined amount of time.
|Dynamically blocking IP’s in this manner may not be very effective against a botnet since the IP address can be frequently rotated.|
For most distributions the sshd jail comes pre-enabled with Fail2Ban. However If you moved the SSH listening port as detailed in the "Hardening SSH configuration" guide, then you will have to modify the sshd jail regardless. This way Fail2Ban knows which port to instruct iptables to restrict for future brute forcing baddies.
Let's open the jail.local file. If the file doesn't exist, then it's okay to create a new one.
Append the following to the file (assuming that you moved the SSH listening port to “2222.”)
[sshd] enabled = true port = 2222
Save your configuration and restart the fail2ban daemon.
systemctl restart fail2ban
You can verify that the sshd jail is enabled with the fail2ban-client command-line utility.
Status |- Number of jail: 3 `- Jail list: sshd
You can also display additional details, such as banned IP's by specifying the sshd jail.
fail2ban-client status sshd
To unban an IP address from Fail2Ban, you can run the following command:
fail2ban-client set sshd unbanip 192.168.0.1
The Fail2ban log can be located in "/var/log/fail2ban.log". You can live monitor the log from a terminal with tail:
tail -F /var/log/fail2ban.log