Enhancing Ubuntu 22.04 Security with Fail2ban: Automated Protection Against Cyber Threats
Fail2ban is an essential open-source security tool designed to enhance the protection of Ubuntu systems by actively monitoring log files for suspicious activities and taking automated actions to thwart potential threats. It operates through customizable filters, which allow administrators to define patterns indicative of malicious behavior, such as repeated failed login attempts or unusual access patterns. Upon detection, Fail2ban can dynamically update firewall rules to block the offending IP address, send notifications to system administrators, or execute other predefined actions. With its ability to adapt to evolving threats and its seamless integration with Ubuntu environments, Fail2ban serves as a vital component in maintaining the integrity and security of Ubuntu systems against various cyber threats.
Steps to Install Fail2Ban on UBUNTU 22.04
To secure your server, take these steps to set up and configure Fail2Ban:
- Using ssh, connect to your UBUNTU 22.04 server.
- Update your system:
sudo apt-get update -yFail2Ban is included by default in the official Ubuntu package repository. The command to install Fail2Ban is:
sudo apt-get install fail2ban -yThe following command to clear your repository cache:
sudo apt-get cleanRun the following command to enable the Fail2Ban protection service at startup time, using the systemctl command:
sudo systemctl enable fail2banFail2Ban should now be installed.
Configure Fail2Ban settings!
Open the Fail2Ban configuration file, with your favorite text editor.
sudo nano /etc/fail2ban/jail.localUpdate/append as follows:
[DEFAULT]
# Ban IP/hosts for 24 hour ( 24h*3600s = 86400s):
bantime = 86400
# An ip address/host is banned if it has generated "maxretry" during the last "findtime" seconds.
findtime = 600
maxretry = 3
# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
# will not ban a host which matches an address in this list. Several addresses
# can be defined using space (and/or comma) separator. For example, add your
# static IP address that you always use for login such as 103.1.2.3
#ignoreip = 127.0.0.1/8 ::1 103.1.2.3
# Call iptables to ban IP address
banaction = iptables-multiport
# Enable sshd protection
[sshd]
enabled = true
Save and close the file. After that, start or restart the service.
sudo systemctl restart fail2ban Fail2Ban filters
In /etc/fail2ban/filter.d/, you’ll discover a number of filters/jails for Fail2Ban. You can take a look using a command like:
You will see an overview. Choose a name for the authentication filter, such as sshd.conf
Open the jail file with your favorite text editor:
sudo nano /etc/fail2ban/filter.d/sshd.confYou may now use the following syntax to add the jail filter:
[jailname]
enabled = true
filter = jailname
logpath = /var/log/yourlogfile
Jailname: Replace this name with one of your choosing so that you can readily recognize it while checking Fail2ban's status.
enabled: This value must always be true or else, your jail will be deactivated.
filter: In this field, type the name of the jail you want to visit. If you choose sshd.conf in step 1, for example, type sshd here.
logpath: This is where you inform Fail2ban which file to scan for assaults on your server.
What are the steps to start, stop, and restart the Fail2Ban service?
You can use the following systemctl commands to interact with the Fail2Ban service:
sudo systemctl start fail2ban
sudo systemctl stop fail2ban
sudo systemctl restart fail2ban
sudo systemctl status fail2ban
Finding status of failed and banned IP address
The current state of the log file containing the password failure report.
sudo fail2ban-client status
sudo fail2ban-client status sshd