![\"How](\"https:\/\/unihost.com\/help\/minio.php?.\/New-Project-2.png\" "\\"How")
<\/p>\n <\/p>\n
In this guide, we’ll cover how to install and use Fail2ban.<\/span><\/p>\n Fail2Ban is a free and open source intrusion prevention software tool written in the Python programming language that can be used to protects servers from different kinds of attacks. Fail2Ban works by continuously monitoring various logs files (Apache, SSH) and running scripts based on them. Mostly it is used to block IP addresses that are trying to breach the system\u2019s security. It can be used to block any IP address that are trying to make many illegitimate login attempts. Fail2Ban is set up to block malicious IP address within a time limit defined by administrator. Fail2Ban can be configured to send email notifications when someone\u2019s attacking your server. Main purpose of Fail2ban is to scans log files for various services, such as SSH, FTP, SMTP, Apache and block the IP address that makes too many password failures.<\/span><\/p>\n # apt-get update && apt-get upgrade -y<\/span><\/em><\/p>\n By default Fail2ban keeps all the configuration files in \/etc\/fail2ban\/ directory. The main configuration file is jail.conf, it contains a set of pre-defined filters. It is recommended that you should not modify jail.conf itself, but override it by creating a new configuration file jail.local inside \/etc\/fail2ban\/ directory.<\/span><\/p>\n To enable the SSH daemon jail, uncomment the following lines:<\/span><\/p>\n To ignore specific IPs, add them to the ignoreip line. By default, this command will not ban the localhost.<\/span><\/p>\n bantime<\/em>: The length of time in seconds for which an IP is banned. If set to a negative number, the ban will be permanent. The default value of 600 is set to ban an IP for a 10-minute duration.<\/span><\/p>\n findtime<\/em>: The length of time between login attempts before a ban is set. For example, if Fail2ban is set to ban an IP after five (5) failed log-in attempts, those 5 attempts must occur within the set 10-minute findtime limit. The findtime value should be a set number of seconds.<\/span><\/p>\n maxretry<\/em>: How many attempts can be made to access the server from a single IP before a ban is imposed. The default is set to 3.<\/span><\/p>\n As you can see, this method will work for any server you have in front of your real web server, or to the actual web server itself, actually this will mainly protect your port 80.<\/span><\/p>\n Edit your \/etc\/fail2ban\/jail.conf file and add this section:<\/span><\/p>\n Now we need to create the filter, to do that, create the file \/etc\/fail2ban\/filter.d\/http-get-dos.conf and copy the text below in it:<\/span><\/p>\n Save the file and restart the fail2ban service:<\/span><\/p>\n You can view the rules added by Fail2Ban using the following command: You should now be able to configure some basic banning policies for your services. Fail2ban is very easy to set up, and is a great way to protect any kind of service that uses authentication.<\/span><\/p>\n <\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" In this guide, we’ll cover how to install and use Fail2ban.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[158],"tags":[123,58,499,95,87],"class_list":["post-7226","post","type-post","status-publish","format-standard","hentry","category-dedicated-servers","tag-apache","tag-centos","tag-fail2ban","tag-nginx","tag-ssh"],"yoast_head":"\nInstall Fail2ban on <\/span>CentOS 7<\/span><\/h3>\n
# yum update && yum install epel-release
<\/span># yum install fail2ban<\/span><\/em>
# systemctl enable fail2ban<\/span><\/em><\/pre>\nInstall Fail2ban on <\/span>Debian\/Ubuntu<\/span><\/h3>\n
# apt-get install fail2ban<\/span><\/em><\/pre>\nConfiguring Fail2ban for SSH<\/span><\/h3>\n
# nano \/etc\/fail2ban\/jail.local <\/span><\/em>
[sshd]\nenabled = true<\/span><\/em><\/pre>\n# nano \/etc\/fail2ban\/jail.conf<\/span><\/em>
[DEFAULT] <\/span><\/em>
ignoreip = 127.0.0.1\/8 123.45.67.89<\/span><\/em>
bantime = 600\nfindtime = 600\nmaxretry = 3<\/span><\/em><\/pre>\nFail2Ban for Apache\/Nginx Web Server<\/span><\/h3>\n
# nano \/etc\/fail2ban\/jail.conf
[http-get-dos]\nenabled = true\nport = http,https\nfilter = http-get-dos\nlogpath = \/var\/log\/*web_server*\/*access.log\nmaxretry = 300\nfindtime = 300\n#ban for 5 minutes\nbantime = 600\naction = iptables[name=HTTP, port=http, protocol=tcp]<\/span><\/em><\/pre>\n# nano \/etc\/fail2ban\/filter.d\/http-get-dos.conf
# Fail2Ban configuration file \n [Definition]\n# Option: failregex \n# Note: This regex will match any GET entry in your logs, so basically all valid and not valid entries are a match. \n# You should set up in the jail.conf file, the maxretry and findtime carefully in order to avoid false positives. \nfailregex = ^<HOST> -.*\"(GET|POST).* \n# Option: ignoreregex \nignoreregex =<\/span><\/em><\/pre>\n# systemctl restart fail2ban<\/span><\/pre>\n
<\/span><\/p>\n# iptables -L<\/span><\/pre>\n<\/code><\/p>\n\n\n