215 lines
3.8 KiB
Markdown
215 lines
3.8 KiB
Markdown
---
|
|
title: "Set Up Fail2ban for SSH Brute-Force Protection"
|
|
description: "Protect your Arcline VPS from SSH brute-force attacks with fail2ban."
|
|
section: vps
|
|
order: 7
|
|
---
|
|
|
|
# Set Up Fail2ban for SSH Brute-Force Protection
|
|
|
|
Fail2ban monitors system logs for repeated failed login attempts and temporarily bans the offending IP addresses using the firewall. It's essential for any internet-facing server.
|
|
|
|
---
|
|
|
|
## Prerequisites
|
|
|
|
- A VPS with SSH access and sudo privileges
|
|
- UFW or iptables already installed (see [Initial VPS Setup](/vps/initial-setup/))
|
|
|
|
---
|
|
|
|
## Step 1 — Install fail2ban
|
|
|
|
```bash
|
|
sudo apt update
|
|
sudo apt install fail2ban -y
|
|
```
|
|
|
|
---
|
|
|
|
## Step 2 — Configure fail2ban for SSH
|
|
|
|
The default configuration file is `/etc/fail2ban/jail.conf`. Don't edit it directly — it gets overwritten on updates. Instead, create a local override:
|
|
|
|
```bash
|
|
sudo nano /etc/fail2ban/jail.local
|
|
```
|
|
|
|
```ini
|
|
[DEFAULT]
|
|
# Ban IPs for 1 hour after 5 failed attempts within 10 minutes
|
|
bantime = 3600
|
|
findtime = 600
|
|
maxretry = 5
|
|
|
|
# Send email alerts (optional)
|
|
# destemail = you@example.com
|
|
# action = %(action_mwl)s
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
logpath = %(sshd_log)s
|
|
```
|
|
|
|
If you changed your SSH port, specify it:
|
|
|
|
```ini
|
|
[sshd]
|
|
enabled = true
|
|
port = 2222
|
|
logpath = %(sshd_log)s
|
|
```
|
|
|
|
---
|
|
|
|
## Step 3 — Start fail2ban
|
|
|
|
```bash
|
|
sudo systemctl enable fail2ban
|
|
sudo systemctl start fail2ban
|
|
```
|
|
|
|
Check the status:
|
|
|
|
```bash
|
|
sudo systemctl status fail2ban
|
|
```
|
|
|
|
---
|
|
|
|
## Step 4 — Monitor banned IPs
|
|
|
|
View the SSH jail status:
|
|
|
|
```bash
|
|
sudo fail2ban-client status sshd
|
|
```
|
|
|
|
This shows the total bans and currently active bans.
|
|
|
|
View the ban log:
|
|
|
|
```bash
|
|
sudo tail -f /var/log/fail2ban.log
|
|
```
|
|
|
|
---
|
|
|
|
## Step 5 — Unban an IP
|
|
|
|
If you accidentally lock yourself out (you should have tested SSH key access before enabling, but just in case):
|
|
|
|
```bash
|
|
sudo fail2ban-client set sshd unbanip 203.0.113.42
|
|
```
|
|
|
|
Or from the console (if you still have a root session open):
|
|
|
|
```bash
|
|
sudo iptables -D f2b-sshd -s 203.0.113.42 -j DROP
|
|
```
|
|
|
|
---
|
|
|
|
## Step 6 — Additional jails (optional)
|
|
|
|
### Nginx
|
|
|
|
```ini
|
|
[nginx-http-auth]
|
|
enabled = true
|
|
logpath = /var/log/nginx/error.log
|
|
```
|
|
|
|
### Nginx bot protection (repeat offenders)
|
|
|
|
```ini
|
|
[nginx-botsearch]
|
|
enabled = true
|
|
logpath = /var/log/nginx/access.log
|
|
maxretry = 2
|
|
findtime = 86400
|
|
bantime = 86400
|
|
```
|
|
|
|
This bans IPs that hit common admin paths (wp-admin, etc.) that don't exist on your server.
|
|
|
|
### Wordpress
|
|
|
|
```ini
|
|
[wordpress]
|
|
enabled = true
|
|
filter = wordpress
|
|
logpath = /var/log/auth.log
|
|
```
|
|
|
|
You may need to create a custom filter for your specific application logs.
|
|
|
|
---
|
|
|
|
## Step 7 — Whitelist IPs
|
|
|
|
To exclude trusted IPs from bans (your office IP, for example):
|
|
|
|
```ini
|
|
[DEFAULT]
|
|
ignoreip = 127.0.0.1/8 ::1 203.0.113.100
|
|
```
|
|
|
|
---
|
|
|
|
## Permanent bans with recidive jail
|
|
|
|
Habitual offenders get progressively longer bans:
|
|
|
|
```ini
|
|
[recidive]
|
|
enabled = true
|
|
logpath = /var/log/fail2ban.log
|
|
maxretry = 3
|
|
findtime = 604800 # 1 week
|
|
bantime = 604800 # 1 week
|
|
```
|
|
|
|
An IP that triggers bans 3 times in a week gets banned for a week.
|
|
|
|
---
|
|
|
|
## Testing fail2ban
|
|
|
|
From a different machine (or after whitelisting your IP), intentionally fail SSH login a few times:
|
|
|
|
```bash
|
|
ssh nonexistent@your.vps.ip.address
|
|
```
|
|
|
|
After 5 failures, further attempts should hang or be refused. Check with:
|
|
|
|
```bash
|
|
sudo fail2ban-client status sshd
|
|
```
|
|
|
|
---
|
|
|
|
## Performance notes
|
|
|
|
Fail2ban uses minimal resources — typically under 50MB of RAM with a few jails enabled. It reads log files using Python's `pyinotify` (if available) or polls every second.
|
|
|
|
If you have high-traffic sites with aggressive bots, increase `findtime` and lower `maxretry` to catch them sooner:
|
|
|
|
```ini
|
|
[nginx-botsearch]
|
|
maxretry = 2
|
|
findtime = 3600
|
|
bantime = 86400
|
|
```
|
|
|
|
---
|
|
|
|
## What's next
|
|
|
|
- [Deploy a Go binary](/vps/go-systemd/) as a systemd service
|
|
- [Set up automated backups](/vps/automated-backups/) with restic
|
|
|