How to Install and Configure Fail2ban on Ubuntu 20.04 for Server Security
Fail2ban is a powerful security tool designed to protect your server by monitoring open ports and running services for suspicious activity. It actively scans log files for repeated failed login attempts or other malicious behavior and automatically blocks the offending IP addresses by updating firewall rules for a specified period. This automated protection significantly reduces the risk of brute force attacks, unauthorized access, and other automated hacking attempts. In this tutorial, we will guide you step-by-step through the installation and configuration of Fail2ban on Ubuntu 20.04, helping you enhance your server’s security by customizing rules, managing jail configurations, and using the fail2ban-client utility.
Fail2ban installation
To install Fail2ban use this command:
apt install fail2banIt starts automatically after installation. To check the service status use this command:
systemctl status fail2banFail2ban configuration
To change the default ban settings for all services, make a copy of the jail.conf file.
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.localOpen the jail.local file and go to the [DEFAULT] section. For example, let's set the ban time to 3600 minutes.
bantime = 3600mTo see all the available rules, go to the JAILS section. For example:
[nginx-http-auth]After changing the file, restart the service.
systemctl restart fail2banAdding and configuring rules
There is a /etc/fail2ban/jail.d/ folder for managing active rules. You can create a separate file for each of them. For example, nginx-http-auth.conf. The second way is to insert configuration into the existing defaults-debian.conf file. Simply add these lines there:
[nginx-http-auth]
enabled = trueYou can add individual parameters for each rule here.
Let's set the IP address to ignore in the ignoreip parameter, the time for the ban is 2400 minutes, and the number of failed authorization attempts is 10.
ignoreip = 10.10.10.5
bantime = 2400m
maxretry = 10Save and close the file and restart the service.
systemctl restart fail2banUsing fail2ban-client
There is a Fail2ban client for managing its rules. Keep in mind that all changes made here will be reset after the system reboot or service restart. To view active rules use this command:
fail2ban-client statusTo see jail statistics use this command with the name you need instead of sshd:
fail2ban-client status sshdTo activate a rule, use its name from the configuration file and the command:
fail2ban-client add nginx-http-authThen start it.
fail2ban-client start nginx-http-authTo view all available commands:
fail2ban-client -hConclusion
Fail2ban is an essential security tool that helps protect your Ubuntu 20.04 server from brute force attacks, unauthorized access, and other malicious activities by monitoring logs and dynamically updating firewall rules. By following this step-by-step tutorial, you have learned how to install Fail2ban, configure ban policies, customize jail rules, and manage the service using the fail2ban-client utility. Implementing Fail2ban strengthens your server’s defense by automating the blocking of suspicious IP addresses, thereby improving overall security and reducing manual intervention.
FAQ
- Q1: Is Fail2ban installed by default on Ubuntu 20.04?
Fail2ban is not installed by default but can be easily installed using the command apt install fail2ban. - Q2: How can I check if Fail2ban is running?
Use systemctl status fail2ban to verify the service status. - Q3: Where are Fail2ban configuration files located?
The main configuration files are in /etc/fail2ban/, including jail.conf and jail.local. Custom rules can also be placed in /etc/fail2ban/jail.d/. - Q4: How do I customize ban time and retry limits?
Edit the [DEFAULT] section in jail.local or individual jail files to adjust parameters like bantime, maxretry, and ignoreip. - Q5: What is the purpose of fail2ban-client?
fail2ban-client is a command-line tool to manage Fail2ban rules dynamically, check status, and control jails without editing config files directly. - Q6: Will changes made via fail2ban-client persist after reboot?
No, changes applied via fail2ban-client are temporary and reset after service restart or system reboot. Permanent changes should be made in configuration files. - Q7: Can I create custom filters for other services?
Yes, Fail2ban supports custom filters and jails to protect various services beyond SSH and Nginx, such as FTP, mail servers, and more.
700
300
700
300
700
300
700
300
