How to install and configure Fail2Ban on Ubuntu 20.04

Have you ever set up a web server, opened the terminal and noticed how many login attempts were made while you were offline? Attackers often use a method called brute forcing: a script tries password after password in the hope of eventually getting in.

To help prevent this, we use a tool called Fail2Ban. It's one of the steps we recommend in 5 great ways to secure your web server.

What is Fail2Ban?

Fail2Ban is open-source intrusion prevention software that protects servers from brute-force attacks. It's written in Python and watches your log files for repeated failed logins or other suspicious activity. When it spots an offending IP address, it blocks it using your server's firewall, such as iptables.

Installing Fail2Ban

In this guide, we'll install and configure Fail2Ban on an Ubuntu 20.04 web server.

Step 1: Update the system and install Fail2Ban

First, update your system:

sudo apt update && sudo apt upgrade -y

Now install Fail2Ban:

sudo apt install fail2ban

Fail2Ban should start automatically once it's installed. To make sure, check its status:

sudo systemctl status fail2ban

You should see:

Active: active (running)

Fail2Ban is now installed and running.

Step 2: Configure Fail2Ban

The installation creates two configuration files: /etc/fail2ban/jail.conf and /etc/fail2ban/jail.d/defaults-debian.conf. Don't edit these files directly, because package updates may overwrite your changes.

Fail2Ban reads its configuration files in the following order, and settings in .local files override those in .conf files:

/etc/fail2ban/jail.conf
/etc/fail2ban/jail.d/*.conf
/etc/fail2ban/jail.local
/etc/fail2ban/jail.d/*.local

The easiest way to configure Fail2Ban is to copy jail.conf to jail.local and then edit the local file.

Step 2.1: Create the local file

Copy jail.conf to jail.local:

sudo cp /etc/fail2ban/jail.{conf,local}

The command doesn't print anything; you'll simply get a new prompt.

Now open jail.local with nano or your favorite text editor:

sudo nano /etc/fail2ban/jail.local

You'll see comments describing what each setting does.

Step 2.2: Whitelist IP addresses

IP addresses, ranges and hosts that should never be banned go in the ignoreip directive. Find this line:

#ignoreip = 127.0.0.1/8 ::1

Uncomment it (remove the #) and add your own IP addresses, separated by spaces. For example:

ignoreip = 127.0.0.1/8 ::1 203.0.113.45

Step 2.3: Ban rule settings

A few lines below ignoreip, you'll find bantime, findtime and maxretry.

bantime is how long an IP address stays banned. The default is 10 minutes, but you'll most likely want something longer. To ban an IP permanently, use a negative number. If you don't add a suffix (for example, 10 instead of 10d), the value is in seconds. Set whatever duration you like; we'll use 10 days:

bantime = 10d

findtime is the time window in which the failed attempts are counted. If an IP reaches maxretry failures within findtime, it gets banned:

findtime = 5m

maxretry is the number of failed attempts allowed before the IP is banned. Again, set it to whatever suits you:

maxretry = 5

With these values, any IP address that fails to log in 5 times within 5 minutes is banned for 10 days.

Step 2.4: Email notifications

Fail2Ban can send you an email alert whenever it bans an IP address. Your server needs a working mail setup (such as Sendmail or Postfix) for this. First, change the action setting:

action = %(action_mw)s

This bans the IP and sends an email with a whois report. To include the relevant log lines in the email as well, use %(action_mwl)s instead.

You'll also need to set the receiving and sending email addresses so the alerts reach you:

destemail = [email protected]
sender = [email protected]

Step 2.5: Jails

In Fail2Ban, a jail combines a filter with one or more actions. The filter is a regular expression that matches failed login attempts or other suspicious activity in a log file, and the actions are the commands that run when the filter catches an abusive IP address, such as adding a firewall rule.

Fail2Ban comes with jails for many common services, and you can also create your own.

On Ubuntu, the SSH jail is enabled by default. To enable another jail, add enabled = true under its title. Using OpenWebMail as an example:

[openwebmail]
enabled = true
port    = http,https
logpath = /var/log/openwebmail.log

You can also set ban rules for an individual service in its own section. These override the global settings:

[sshd]
enabled  = true
maxretry = 5
findtime = 5m
bantime  = 10d
ignoreip = 127.0.0.1/8 ::1 203.0.113.45

Filters are stored in the /etc/fail2ban/filter.d directory if you need to edit them.

When you're done, save the file and exit (in nano, press Ctrl + O, Enter, then Ctrl + X).

Step 3: Restart Fail2Ban

Whenever you change the configuration, restart the service so the changes take effect:

sudo systemctl restart fail2ban

Step 4: Use the Fail2Ban command line

The fail2ban-client tool lets you manage Fail2Ban from the command line:

sudo fail2ban-client [command]

To see all available options, run:

sudo fail2ban-client -h

Here are a few handy commands:

Check a jail's status and see which IPs are currently banned:

sudo fail2ban-client status sshd

Unban an IP address:

sudo fail2ban-client set sshd unbanip 203.0.113.45

Ban an IP address:

sudo fail2ban-client set sshd banip 203.0.113.45

We hope this gives you a solid understanding of how Fail2Ban works and its basic functions. You can find more information and documentation on Fail2Ban's GitHub page.

If you have questions about any of our services, please contact us via email at [email protected] or by using our live chat at spinservers.com.

Spin Servers is a US-based provider of dedicated servers & affordable private cloud solutions. Our motto is to let you "spin up servers" fast, seamlessly, and affordably.