Fail2ban

To Unban ---> fail2ban-client set JAIL_NAME unbanip

Installing fail2ban

Installing fail2ban is simple on all the distributions we used to research this article. On Ubuntu 20.04, the command is as follows:

On Fedora 32, type:

On Manjaro 20.0.1, we used pacman:

Configuring fail2ban

The fail2ban installation contains a default configuration file called jail.conf. This file is overwritten when fail2ban is upgraded, so we’ll lose our changes if we make customizations to this file.

Instead, we’ll copy the jail.conf file to one called jail.local. By putting our configuration changes in jail.local, they’ll persist across upgrades. Both files are automatically read by fail2ban.

This is how to copy the file:

You’ll find the [DEFAULT] section somewhere around line 40. It’s a long section with a lot of comments and explanations.

Scroll down to around line 90, and you’ll find the following four settings you need to know about:

• • ignoreip: A whitelist of IP addresses that will never be banned. They have a permanent Get Out of Jail Free card. The localhost IP address (127.0.0.1) is in the list by default, along with its IPv6 equivalent (::1). If there are other IP addresses you know should never be banned, add them to this list and leave a space between each one.

  • bantime: The duration for which an IP address is banned (the “m” stands for minutes). If you type a value without an “m” or “h” (for hours) it will be treated as seconds. A value of -1 will permanently ban an IP address. Be very careful not to permanently lock yourself out.

  • findtime: The amount of time within which too many failed connection attempts will result in an IP address being banned.

  • maxretry: The value for “too many failed attempts.”

If a connection from the same IP address makes maxretry failed connection attempts within the findtime period, they’re banned for the duration of the bantime. The only exceptions are the IP addresses in the ignoreip list.

fail2ban puts the IP addresses in jail for a set period of time. fail2ban supports many different jails, and each one represents holds the settings apply to a single connection type. This allows you to have different settings for various connection types. Or you can have fail2ban monitor only a chosen set of connection types.

You might have guessed it from the [DEFAULT] section name, but the settings we’ve looked at are the defaults. Now, let’s look at the settings for the SSH jail.

RELATED: How to Edit Text Files Graphically on Linux With gedit

Configuring a Jail

Jails let you move connection types in and out of fail2ban's monitoring. If the default settings don’t match those you want applied to the jail, you can set specific values for bantime, findtime, and maxretry.

Scroll down to about line 280, and you’ll see the [sshd] section.

We can check the status of the service using systemctl, too:

Everything looks good—we’ve got the green light, so all is well.

Let’s see if fail2ban agrees:

This reflects what we set up. We’ve enabled a single jail, named [sshd]. If we include the name of the jail with our previous command, we can take a deeper look at it:

This lists the number of failures and banned IP addresses. Of course, all the statistics are zero at the moment.

Testing Our Jail

On another computer, we’ll make an SSH connection request to our test machine and purposefully mistype the password. You get three attempts to get the password right on each connection attempt.

The maxretry value will trigger after three failed connection attempts, not three failed password attempts. So, we have to type an incorrect password three times to fail connection attempt one.

We’ll then make another connection attempt and type the password incorrectly another three times. The first incorrect password attempt of the third connection request should trigger fail2ban.

After the first incorrect password on the third connection request, we don’t get a response from the remote machine. We don’t get any explanation; we just get the cold shoulder.

You must press Ctrl+C to return to the command prompt. If we try once more, we’ll get a different response:

Previously, the error message was “Permission denied.” This time, the connection is outright refused. We’re persona non grata. We’ve been banned.

Let’s look at the details of the [sshd] jail again:

There were three failures, and one IP address (192.168.4.25) was banned.

As we mentioned previously, fail2ban enforces bans by adding rules to the firewall ruleset. Let’s take another look at the ruleset (it was empty before):

A rule has been added to the INPUT policy, sending SSH traffic to the f2b-sshd chain. The rule in the f2b-sshd chain rejects SSH connections from 192.168.4.25. We didn’t alter the default setting for bantime, so, in 10 minutes, that IP address will be unbanned and can make fresh connection requests.

If you set a longer ban duration (like several hours), but want to allow an IP address to make another connection request sooner, you can parole it early.

We type the following to do this:

On our remote computer, if we make another SSH connection request and type the correct password, we’ll be allowed to connect: