The Threat of SSH Brute Force Attacks
If you expose an SSH server to the public internet, it is only a matter of hours (sometimes minutes) before automated botnets begin attempting to brute-force their way into your system. These bots systematically try thousands of common usernames and passwords (like root, admin, and password123). Even if you have disabled password authentication in favor of SSH keys—which you absolutely should—the sheer volume of login attempts can clutter your authentication logs and waste server resources.
Fail2Ban is an intrusion prevention software framework that solves this problem. It monitors system logs for malicious activity, such as repeated failed login attempts, and automatically updates your firewall rules to temporarily or permanently ban the offending IP addresses.
How Fail2Ban Works
Fail2Ban operates using “jails.” A jail is a combination of a filter (a set of regular expressions that look for specific error messages in a log file, like “Failed password”) and an action (a command executed when the filter matches too many times, like adding an iptables rule).
Step-by-Step: Installing and Configuring Fail2Ban
Step 1: Install Fail2Ban
On Debian/Ubuntu-based systems, installation is straightforward:
sudo apt update
sudo apt install fail2ban
For RHEL/CentOS/Rocky Linux systems, you first need the EPEL repository:
sudo dnf install epel-release
sudo dnf install fail2ban
Step 2: Create a Local Configuration File
Fail2Ban’s default configuration is stored in /etc/fail2ban/jail.conf. However, you should never edit this file directly because package updates will overwrite it. Instead, create a local copy called jail.local.
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.localStep 3: Configure the Default Settings
Open /etc/fail2ban/jail.local in your preferred text editor (like nano or vim):
sudo nano /etc/fail2ban/jail.localFind the [DEFAULT] section. Here are the most critical parameters to adjust:
ignoreip: Add your own static IP address here (e.g.,127.0.0.1/8 ::1 192.168.1.100) so you don’t accidentally lock yourself out.bantime: How long an IP remains banned. The default is usually 10m (10 minutes). For SSH,1h(1 hour) or1d(1 day) is more appropriate.findtime: The window of time during which failures are counted. (e.g.,10m).maxretry: The number of failures allowed within thefindtimebefore a ban is triggered. Setting this to3or5is typical.
Step 4: Enable the SSHd Jail
Scroll down through jail.local until you find the [sshd] section. By default, it might be disabled. To enable it and override the default settings specifically for SSH, configure it like this:
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 1d
Note: On RHEL-based systems, the logpath might need to be /var/log/secure or you can configure it to use systemd’s journal.
Step 5: Start and Enable the Service
Once you’ve saved the file, start the Fail2Ban service and enable it to start on boot:
sudo systemctl start fail2ban
sudo systemctl enable fail2ban
Monitoring and Unbanning IPs
To check the overall status of Fail2Ban and see which jails are active, use the client tool:
sudo fail2ban-client statusTo see detailed information about the SSH jail, including the currently banned IP addresses, run:
sudo fail2ban-client status sshdIf you accidentally banned a legitimate user, you can manually unban their IP address:
sudo fail2ban-client set sshd unbanip 192.168.1.50Conclusion
Configuring Fail2Ban is a mandatory security practice for any Linux server exposed to the internet. While it does not replace the necessity of disabling root login and using SSH keys, it provides a critical layer of active defense that keeps your server’s authentication logs clean and your CPU resources free from automated botnet traffic.