Home › Root servers › fail2ban against brute force

fail2ban against brute force

Automatically block IP addresses after repeated failed logins.

Automated programs constantly try passwords on open SSH ports. fail2ban reads the log entries of the SSH service and temporarily blocks an address if it fails to log in too often. The block is enforced by the firewall, so the attacker no longer reaches the server at all.

How the settings work

maxretry = 5: blocking starts after five failed attempts.
findtime = 10m: the failed attempts must happen within ten minutes to count.
bantime = 1h: the block lasts one hour, after which the address is released automatically.
ignoreip: addresses that are never blocked. Localhost is always included. You can add your own fixed IP so you do not lock yourself out.

Why jail.local instead of jail.conf

The file /etc/fail2ban/jail.conf contains the default values and is overwritten during package updates. Your own values therefore go into jail.local. This file takes precedence, even if it only contains the differences.

Install fail2ban:
```
sudo apt install -y fail2ban
```
Create the local configuration:
```
sudo nano /etc/fail2ban/jail.local
```
Enter the content:
```
[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5
ignoreip = 127.0.0.1/8 ::1
[sshd]
enabled = true
```
[sshd] enables the protection for SSH. Other services such as web servers or mail are disabled by default and can get their own sections if needed.
Start the service and check its status:
```
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd
```
The output shows the number of failed attempts and the currently blocked addresses.

Unblock an IP address

If you have accidentally blocked yourself, release the address like this:

sudo fail2ban-client set sshd unbanip IP-ADDRESS

Only add your own IP to ignoreip if it is fixed. If the address changes, the exception no longer applies.

Working together with key login

With key login and password login switched off (see SSH keys and Secure SSH), nobody can guess a password. fail2ban is still useful: it keeps the log entries clear and slows down scanners that constantly knock on the door.