Fail2ban Configuration: Ways to Strengthen Security

What Is Fail2ban and Why Is It Used?

Fail2ban is a security tool used to protect your servers against brute-force attacks and other malicious login attempts. It primarily detects unauthorized access attempts on common services such as SSH, FTP, and HTTP, and automatically blocks such attacks. Fail2ban analyzes log files and, when it detects a certain number of failed login attempts within a specific time period, temporarily blocks the attacker’s IP address.

The main advantage of this tool is that it enhances your server’s security without significantly impacting network traffic. Additionally, you can strengthen your security policies by writing customized rules for different services. Fail2ban is written in Python and features an extensible architecture.

Fail2ban Installation

Installation Based on Your Linux Distribution

Fail2ban is available in package managers for most Linux distributions. For example, on Debian-based systems (Ubuntu, Mint, etc.), you can use the following command to install Fail2ban:

sudo apt-get update
sudo apt-get install fail2ban

On Red Hat-based systems (CentOS, Fedora, etc.):

sudo yum install fail2ban

After installation, you must start the Fail2ban service and ensure it starts automatically at system boot:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

Basic Fail2ban Configuration

Configuration Files

Fail2ban’s configuration is typically located in the /etc/fail2ban/ directory. The main file here is jail.conf file. However, instead of editing this file directly, it is recommended that you make customizations by creating a file named jail.local .

An example jail.local file might look like this:

[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5

[sshd]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log

Here, the bantime parameter specifies how many seconds the IP address will be blocked. findtime The parameter determines whether the IP will be blocked if a certain number of failed attempts occur within the specified time period. maxretry specifies the number of allowed failed attempts.

Creating Custom Filters

Structure of Filter Files

Fail2ban uses the files in the /etc/fail2ban/filter.d/ directory for the filtering process. Each filter file contains regular expressions to detect failed login attempts in a specific service’s log file.

For example, to create a custom HTTP brute-force attack filter, apache-bruteforce.conf you can create a file named:

[Definition]
failregex = ^ - - \[.*\] "POST /wp-login\.php HTTP/.*" 401
ignoreregex =

In this example, failregex the expression detects failed POST requests to the WordPress login page. The `` tag represents the attacker’s IP address.

Fail2ban Advanced Configuration

IP Whitelisting and Blacklisting

With Fail2ban, you can prevent certain IP addresses from being blocked by whitelisting them, or block them immediately by blacklisting them. To whitelist an IP address, ignoreip parameter:

[DEFAULT]
ignoreip = 127.0.0.1/8 192.168.1.0/24

This setting ensures that IP addresses on your local network are never blocked.

Defining Custom Actions

By default, Fail2ban blocks IP addresses using iptables. However, you can define custom actions to implement different security measures. For example, you can define an action to send an automatic email notification for a blocked IP:

action = %(action_mwl)s

In this example, action_mwlis a set of actions that includes email notifications.

Common Fail2ban Errors and Solutions

Error 1: Incorrect Log Path

Specifying the wrong log file path can prevent Fail2ban from working effectively. Incorrect Example:

logpath = /var/log/incorrect.log

In this case, it is important to specify the correct log file path. Correct Example:

logpath = /var/log/auth.log

Be sure to check the correct log file path for each service.

Error 2: Incorrect Use of Regular Expressions

Errors in regular expressions can result in unwanted IP addresses being blocked. Incorrect Example:

failregex = ^.*"GET /admin">

This expression may block all /admin requests. Correct Example:

failregex = ^.*"GET /admin" 403

This correction targets only requests that return a 403 response code.

Conclusion and Recommendations

Fail2ban is an excellent tool for protecting your server against external threats. With the right configuration, you can significantly enhance your security. In this article, we covered the installation of Fail2ban, basic and advanced configurations, and how to fix common mistakes. Now, you can create your own security policies and make your server more secure. For those new to Fail2ban, it is important to have a good understanding of regular expressions, to correctly identify log files, and to carefully define actions.