Installing & Configuring Fail2ban to Secure your Server

As we have mentioned previously, how to Secure your Server SSH Login. Today, we are going to Install and Configure Fail2ban, to black list illegitimate connections, most likely (DDOS, Bruteforce Attacking, etc..) on your Server.

Fail2ban is not available in CentOS package repository. Therefore, we need to install EPEL (Extra Packages for Enterprise Linux) repository first. EPEL contains additional packages for all CentOS versions, one of these additional packages is Fail2Ban.

First, we ensure that our System is up to date

# yum update && yum upgrade

Then, we install we will EPEL repository :

# yum install epel-release

Now, we should be able to proceed with Fail2ban installation:

# yum install fail2ban fail2ban-systemd

After we complete the installation, we need to enable and start the service:

# systemctl enable fail2ban && systemctl start fail2ban

Now fail2ban.service has been enabled and started, the configuration file is located /etc/fail2ban/jail.conf, we shouldn’t make any configuration in this file; because this file can be changed by Package upgrade, therefore, we will create jail.local. jail.local will override the configuration in jail.conf

# cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Now, open jail.local file, with any text editor

# vi /etc/fail2ban/jail.local
# nano /etc/fail2ban/jail.local

Our Configuration will start, from [DEFAULT] line:


# "bantime" is the number of seconds that a host is banned.
bantime  = 600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 5

By default, Fail2ban, will black list / ban any illegitimate connection after 5 tries for 10 Minutes (600 Seconds). We can change to whatever value your Business requires.

Now, save you changes, and restart faile2ban service:

# systemctl restart fail2ban.service

Then, we need to add jail file to protect our SSH, we create new file with text editor:

# vi /etc/fail2ban/jail.d/sshd.local
# nano /etc/fail2ban/jail.d/sshd.local

Then, we add the following parameters:

enabled = true
port = ssh
#action = firewallcmd-ipset
logpath = %(sshd_log)s
maxretry = 5
bantime = 86400
  • Parameter enabled is set to true, in order to provide protection to SSH.
  • Port parameter can be left as it is (22), but if we changed the port we need to define the new Port.
  • Logpath provides the path where the log file is stored. This log file is scanned by Fail2Ban.
  • Maxretry is used to set the maximum limit for failed login entries.
  • Bantime parameter is used to set the duration of seconds for which a host needs to be banned.

After that, we need to restart Fail2ban service:

# systemctl restart fail2ban.service

To track / check the failed attempts to login:

# cat /var/log/secure | grep 'Failed password'
May 15 16:32:34 c498cf0 sshd[34695]: Failed password for invalid user oracle from port 55742 ssh2
May 15 16:32:49 c498cf0 sshd[34714]: Failed password for invalid user service from port 33146 ssh2
May 15 16:33:00 c498cf0 sshd[34716]: Failed password for invalid user gn from port 43755 ssh2
May 15 16:33:21 c498cf0 sshd[34718]: Failed password for invalid user srvadmin from port 54904 ssh2
May 15 16:33:58 c498cf0 sshd[34720]: Failed password for invalid user lv from port 45506 ssh2
May 15 16:34:00 c498cf0 sshd[34722]: Failed password for invalid user mai from port 49708 ssh2
May 15 16:34:16 c498cf0 sshd[34724]: Failed password for invalid user cs from port 40409 ssh2
May 15 16:34:24 c498cf0 sshd[34726]: Failed password for invalid user admin from port 42092 ssh2
May 15 16:34:32 c498cf0 sshd[34728]: Failed password for invalid user nelson from port 59786 ssh2
May 15 16:35:16 c498cf0 sshd[34731]: Failed password for invalid user jian from port 54734 ssh2

To check Fail2ban status:

# fail2ban-client status
|- Number of jail:      1
`- Jail list:   sshd

To check the sshd jail, here we will see all banned / black listed IPs:

# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     11
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
   |- Currently banned: 17
   |- Total banned:     17
   `- Banned IP list:

In order to remove any IP address from the banned list:

# fail2ban-client set sshd unbanip <IPADDRESS>

Now our Server is Secure by Fail2ban.

Mohammed has written 27 articles

One thought on “Installing & Configuring Fail2ban to Secure your Server

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>