How to Protect SSH with Fail2Ban on Ubuntu

Securing your server’s SSH access is crucial in protecting it from unauthorized login attempts and potential attacks. One effective way to bolster your server’s defenses is by using Fail2Ban, a powerful intrusion prevention software that monitors log files and bans IPs showing malicious signs, such as too many password failures or seeking for exploits. By configuring Fail2Ban on your Ubuntu server, you can significantly reduce the risk of brute-force attacks and enhance the overall security of your SSH service.

This article is part of Rackset’s Server Security guides — browse the rest of the category for more in-depth tutorials on this topic.

This article provides a step-by-step guide on how to install and configure Fail2Ban to protect your SSH service on an Ubuntu server. We will cover everything from the initial installation to setting up custom rules and monitoring the service’s activity. By the end of this tutorial, you’ll have a robust security mechanism in place to automatically detect and block suspicious login attempts, ensuring your server remains safe and secure.

Understanding Fail2Ban and SSH Security

Securing your server is crucial, especially when it comes to SSH access, which is often targeted by malicious actors. Fail2Ban is a powerful tool that helps protect your server from unauthorized access attempts by monitoring log files and banning IPs that show malicious signs.

What is Fail2Ban?

Fail2Ban is an open-source intrusion prevention software that helps secure your server by monitoring log files for specific patterns and taking action when a potential threat is detected. It can automatically update firewall rules to block malicious IP addresses, providing an additional layer of security.

• Monitors log files for failed login attempts and other suspicious activities.
• Can be configured to protect various services, including SSH, HTTP, and more.
• Automatically bans IP addresses after a specified number of failed attempts.

Why Secure SSH?

SSH (Secure Shell) is a protocol used to securely connect to a server. It is a common target for brute force attacks, where attackers attempt to gain unauthorized access by trying numerous username and password combinations. Securing SSH is essential to prevent such attacks and protect sensitive data.

• SSH provides encrypted communication, ensuring data confidentiality.
• It is often the primary method for remote server management.
• Unauthorized SSH access can lead to data breaches and server compromise.

How Fail2Ban Enhances SSH Security

Fail2Ban enhances SSH security by dynamically banning IP addresses that exhibit suspicious behavior. This reduces the risk of a successful brute force attack and helps maintain the integrity and availability of your server.

1. Monitors failed SSH login attempts through log files.
2. Configures customizable jail settings to determine when to ban an IP.
3. Automatically updates firewall rules to block malicious IPs temporarily.

By utilizing Fail2Ban, you can significantly improve the security of your SSH service, ensuring that only authorized users have access to your server.

Installing Fail2Ban on Ubuntu

Fail2Ban is a security tool that helps protect your server from unauthorized access by monitoring log files and banning malicious IP addresses. To protect SSH with Fail2Ban on Ubuntu, you first need to install it. Follow these steps to install Fail2Ban on your Ubuntu system:

Step 1: Update System Packages

Before installing any new software, it’s a good practice to update your system packages to ensure you have the latest versions. Use the following command to update your package index:

sudo apt-get update

Step 2: Install Fail2Ban

Once your package index is updated, you can proceed to install Fail2Ban. Execute the following command:

sudo apt-get install fail2ban

This command will download and install Fail2Ban along with any necessary dependencies.

Step 3: Verify the Installation

After the installation is complete, it’s important to verify that Fail2Ban has been installed correctly. You can do this by checking its version with the following command:

Read more: How to Set Up SSH Keys and Connect to Your VPS (Linux, macOS & Windows)

If you want VPS power without managing the server yourself, a managed VPS plan hands the setup, security patching and monitoring to Rackset’s team so you can focus on your project.

fail2ban-client --version

If the installation was successful, you should see the version number of Fail2Ban displayed.

Step 4: Start and Enable the Fail2Ban Service

To ensure that Fail2Ban starts automatically at boot and is running, use the following commands:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

These commands will start the Fail2Ban service immediately and enable it to start at boot time.

Conclusion

With Fail2Ban installed and running on your Ubuntu system, you are now ready to configure it to protect your SSH service from unauthorized access. The next step involves configuring Fail2Ban to monitor and ban suspicious activities related to SSH.

Configuring the SSH Jail in Fail2Ban

To enhance the security of your SSH service using Fail2Ban, you need to configure the SSH jail. This setup will allow Fail2Ban to monitor SSH login attempts and ban IP addresses that exhibit suspicious behavior. Follow the steps below to configure the SSH jail in Fail2Ban on Ubuntu.

Step 1: Open the Jail Configuration File

Begin by accessing the Fail2Ban configuration directory and open the SSH jail configuration file using your preferred text editor. The file is typically named jail.local or jail.conf.

sudo nano /etc/fail2ban/jail.local

Step 2: Locate the SSH Jail Section

In the configuration file, locate the section dedicated to the SSH jail. It usually starts with [sshd]. If it doesn’t exist, you can create it manually.

Step 3: Configure SSH Jail Settings

Modify or add the following settings under the [sshd] section to customize how Fail2Ban handles SSH connections:

• enabled = true – Ensures the SSH jail is active.
• port = ssh – Specifies the port to monitor. By default, SSH uses port 22.
• filter = sshd – Indicates the filter to use for SSH.
• logpath = /var/log/auth.log – Defines the path to the SSH log file.
• maxretry = 5 – Sets the number of allowed failed attempts before banning an IP.
• bantime = 600 – Specifies the duration (in seconds) an IP is banned.

Step 4: Save and Close the File

After configuring the settings, save the changes and close the file. If you are using Nano, press CTRL + X, then Y, and hit Enter to save and exit.

Step 5: Restart Fail2Ban

For the changes to take effect, restart the Fail2Ban service using the following command:

sudo systemctl restart fail2ban

With these configurations, Fail2Ban will now actively monitor SSH login attempts and protect your system from unauthorized access.

Read more: Troubleshoot SSH Connection Refused Errors

If you need this service, Rackset’s team provides professional server management with full support so you can rely on the quality and get set up quickly.

Tuning Bantime, Findtime, and Maxretry

Fail2Ban is a powerful tool for securing your SSH service on Ubuntu by banning IP addresses that show malicious signs. To fine-tune its effectiveness, it’s essential to understand and adjust the parameters bantime, findtime, and maxretry. These settings determine how long an IP is banned, the time window for detecting failed login attempts, and how many failures trigger a ban.

Bantime

The bantime parameter specifies the duration for which an IP address remains banned after exceeding the maximum allowed failed login attempts. By default, this is set to 10 minutes (600 seconds), but you may want to adjust it based on your security needs.

• Shorter bantime can help if you expect legitimate users might accidentally be banned.
• Longer bantime can deter persistent attackers more effectively.

Findtime

The findtime parameter defines the time frame during which the failed login attempts are counted. If the number of failed attempts exceeds maxretry within this period, the IP address is banned.

• Default is usually set to 10 minutes, but increasing this can help catch slow, persistent attacks.
• Consider your server’s typical usage patterns to set an appropriate findtime.

Maxretry

The maxretry parameter controls the number of failed login attempts allowed before an IP is banned. It is crucial to balance between security and user convenience.

• A lower maxretry value increases security but may lead to false positives.
• A higher value offers more leeway for legitimate users but may let attackers attempt more guesses.

To adjust these settings, edit the /etc/fail2ban/jail.local file and set the desired values for bantime, findtime, and maxretry. Save your changes and restart Fail2Ban for them to take effect.

Whitelisting Your IP Address

When using Fail2Ban to protect SSH on your Ubuntu server, you may want to ensure that your own IP address is not mistakenly banned. Whitelisting your IP address can help maintain uninterrupted access to your server. Here’s how you can add your IP address to the whitelist.

Step 1: Edit the Jail Configuration

Fail2Ban uses jail configurations to define its rules and settings. You’ll need to modify the SSH jail configuration to include your IP address in the whitelist.

1. Open the SSH jail configuration file by entering the following command in your terminal:

   sudo nano /etc/fail2ban/jail.local

2. Look for the section labeled [sshd]. If it does not exist, you may need to create it.

Step 2: Add Your IP Address to the Whitelist

Within the [sshd] section, you will add your IP address to the ignoreip parameter. This parameter allows you to specify IP addresses that Fail2Ban should ignore.

1. Find the line that begins with ignoreip. If it’s not present, add it yourself.
2. Add your IP address to the list, separating multiple IPs with spaces. For example:

   ignoreip = 127.0.0.1/8 ::1 192.168.1.100

3. Save the changes and exit the editor. In Nano, you can do this by pressing CTRL + X, then Y, and finally Enter.

Step 3: Restart Fail2Ban

After updating the configuration, you need to restart the Fail2Ban service to apply the changes.

sudo systemctl restart fail2ban

By following these steps, your IP address will be whitelisted, ensuring that you maintain access to your server even if incorrect login attempts are detected.

Read more: Installing Apache on Ubuntu 22.04: A Step-by-Step Guide

Extending Fail2Ban Protection to Nginx

While Fail2Ban is commonly used to secure SSH, it can also be configured to protect other services such as Nginx. This is particularly beneficial for those using Rackset’s hosting services that include Nginx for web serving.

Step 1: Install Fail2Ban

Before extending protection to Nginx, ensure that Fail2Ban is installed and running on your Ubuntu server. If it’s not already installed, use the following command:

For projects that need guaranteed resources and full root control, a VPS is the right step up from shared hosting. With VPS hosting you get dedicated CPU/RAM, NVMe storage, a dedicated IP and high uptime, deployed in minutes.

sudo apt-get install fail2ban

Step 2: Configure a New Jail for Nginx

Fail2Ban uses “jails” to specify which services to monitor. You can create a new jail for Nginx by editing the Fail2Ban configuration file:

sudo nano /etc/fail2ban/jail.local

Add the following configuration to the file:

[nginx-http-auth]
enabled  = true
filter   = nginx-http-auth
port     = http,https
logpath  = /var/log/nginx/error.log
maxretry = 3

Step 3: Create the Nginx Filter

Next, create a filter for Nginx by making a new file:

sudo nano /etc/fail2ban/filter.d/nginx-http-auth.conf

Add the following filter configuration:

[Definition]
failregex = ^ -.*"(GET|POST).+HTTP/1.[01]" 401
ignoreregex =

Step 4: Restart Fail2Ban

After configuring the jail and filter, restart the Fail2Ban service to apply the changes:

sudo systemctl restart fail2ban

Step 5: Verify Fail2Ban is Protecting Nginx

To ensure that Fail2Ban is actively protecting Nginx, check the status of Fail2Ban and its jails:

sudo fail2ban-client status

This command should list the active jails, including the newly created Nginx jail.

By following these steps, you can extend Fail2Ban’s protection to Nginx, enhancing the security of your web server environment on Rackset’s robust hosting platform.

Conclusion

Securing your SSH service is a critical step in protecting your server from unauthorized access. By implementing Fail2Ban on Ubuntu, you can effectively guard against brute force attacks and enhance your security posture. The steps outlined in this guide provide a practical approach to configuring Fail2Ban, ensuring that your SSH service is well-protected with minimal effort.

As you continue to prioritize the security of your server, consider Rackset for your hosting needs. With robust infrastructure and reliable support, Rackset provides a secure and efficient environment for all your web hosting requirements. Let us help you build a safer online presence.

Frequently Asked Questions

What is Fail2Ban and how does it protect SSH?

Fail2Ban is a security tool that helps protect services like SSH by monitoring log files and banning IP addresses that show signs of malicious activity. It automatically updates firewall rules to block these IPs, effectively preventing brute-force attacks.

How do I install Fail2Ban on Ubuntu?

You can install Fail2Ban on Ubuntu using the package manager by running the command ‘sudo apt-get install fail2ban’. This will download and install the necessary packages from the official Ubuntu repositories.

How can I configure Fail2Ban to protect SSH on Ubuntu?

To configure Fail2Ban for SSH, edit the jail.local file usually located in /etc/fail2ban/. Add or modify the SSH section to enable it and set parameters like ‘maxretry’ and ‘bantime’ to suit your security needs.

What are some common Fail2Ban configuration settings for SSH?

Common settings include ‘maxretry’, which defines the number of failed login attempts before a ban is enacted, and ‘bantime’, which sets the duration of the ban. You can also specify ‘ignoreip’ to whitelist certain IP addresses.

How do I verify that Fail2Ban is working correctly on my Ubuntu system?

You can verify Fail2Ban’s operation by checking its status with the command ‘sudo fail2ban-client status’. This will show you active jails and any banned IPs, confirming that it is monitoring and protecting your SSH service.