1. No category

8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
MENU
How To Protect SSH with fail2ban on Ubuntu 12.04
T AGGE D I N: LI NU X B ASI CS, U B U NT U , SE CU RI T Y
SHARE
AU T H OR: E T E L SVE RDLOV • PU B LI SH E D: JU N 14, 2012 • U PDAT E D: JU N 10,
2014
About Fail2Ban
Servers do not exist in isolation, and those virtual private servers with only the
most basic SSH configuration can be vulnerable to brute force attacks.
fail2ban provides a way to automatically protect virtual servers from malicious
behavior. The program works by scanning through log files and reacting to
offending actions such as repeated failed login attempts.
Step One—Install Fail2Ban
Use apt-get to install Fail2Ban
sudo apt-get install fail2ban
Step Two—Copy the Configuration File
The default fail2ban configuration file is location at /etc/fail2ban/jail.conf. The
configuration work should not be done in that file, however, and we should
instead make a local copy of it.
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
After the file is copied, you can make all of your changes within the new
jail.local file. Many of possible services that may need protection are in the file
already. Each is located in its own section, configured and turned off.
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
1/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
Step Three—Configure the Defaults in Jail.Local
Open up the the new fail2ban configuration file:
sudo nano /etc/fail2ban/jail.local
The first section of defaults covers the basic rules that fail2ban will follow. If
you want to set up more nuanced protection on your virtual server, you can
customize the details in each section.
You can see the default section below.
[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1/8
bantime = 600
maxretry = 3
# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto".
# yoh: For some reason Debian shipped python-gamin didn't work as expected
#
This issue left ToDo, so polling is default backend for now
backend = auto
#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = root@localhost
Write your personal IP address into the ignoreip line. You can separate each
address with a space. IgnoreIP allows you white list certain IP addresses and
make sure that they are not locked out. Including your address will guarantee
that you do not accidentally ban yourself from your own server.
The next step is to decide on a bantime, the number of seconds that a host
would be blocked from the VPS if they are found to be in violation of any of
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
2/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
the rules. This is especially useful in the case of bots, that once banned, will
simply move on to the next target. The default is set for 10 minutes—you may
raise this to an hour (or higher) if you like.
Maxretry is the amount of incorrect login attempts that a host may have
before they get banned for the length of the ban time.
You can leave the backend as auto.
Destemail is the email that alerts get sent to. If you have a mail server set up
on your droplet, Fail2Ban can email you when it bans an IP address.
Additional Details—Actions
The Actions section is located below the defaults. The beginning looks like
this:
#
# ACTIONS
#
# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define
# action_* variables. Can be overridden globally or per
# section within jail.local file
banaction = iptables-multiport
# email action. Since 0.8.1 upstream fail2ban uses sendmail
# MTA for the mailing. Change mta configuration parameter to mail
# if you want to revert to conventional 'mail'.
mta = sendmail
# Default protocol
protocol = tcp
[...]
Banaction describes the steps that fail2ban will take to ban a matching IP
address. This is a shorter version of the file extension where the config if is
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
3/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
located. The default ban action, "iptables-multiport", can be found at
/etc/fail2ban/action.d/iptables-multiport.conf
MTA refers to email program that fail2ban will use to send emails to call
attention to a malicious IP.
You can change the protocol from TCP to UDP in this line as well, depending
on which one you want fail2ban to monitor.
Step Four (Optional)—Configure the ssh-iptables Section in
Jail.Local
The SSH details section is just a little further down in the config, and it is
already set up and turned on. Although you should not be required to make
to make any changes within this section, you can find the details about each
line below.
[ssh]
enabled
port
filter
logpath
maxretry
=
=
=
=
=
true
ssh
sshd
/var/log/auth.log
6
Enabled simply refers to the fact that SSH protection is on. You can turn it off
with the word "false".
The port designates the port that fail2ban monitors. If you have set up your
virtual private server on a non-standard port, change the port to match the
one you are using:
eg. port=30000
The filter, set by default to sshd, refers to the config file containing the rules
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
4/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
that fail2ban uses to find matches. sshd refers to the
/etc/fail2ban/filter.d/sshd.conf.
log path refers to the log location that fail2ban will track.
The max retry line within the SSH section has the same definition as the
default option. However, if you have enabled multiple services and want to
have specific values for each one, you can set the new max retry amount for
SSH here.
Step Five—Restart Fail2Ban
After making any changes to the fail2ban config, always be sure to restart
Fail2Ban:
sudo service fail2ban restart
You can see the rules that fail2ban puts in effect within the IP table:
sudo iptables -L
By Etel Sverdlov
Related Tutorials
How To Set Up a Firewall Using IP Tables on Ubuntu 12.04
How To Share PHP Sessions on Multiple Memcached Servers on Ubuntu 14.04
How To Install Nginx on CentOS 7
Initial Server Setup with CentOS 7
How To Create an ECC Certificate on Nginx for Debian 7
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
5/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
80 Comments
webadmin November 3, 2012
Cool article.
"If you have a mail server set up on your droplet" - How would we go about enabling this on
Ubuntu?
moisey November 3, 2012
Droplets are what we call virtual servers so it would be the same instructions for any
installation of Ubuntu.
joseph.bouchard November 27, 2012
"Write your personal IP address into the ignoreip line."
-- Are you saying the IP address of my server, or the IP address I am likely to be connecting
from?
Etel Sverdlov November 27, 2012
The IP that you will be connecting from.
naftoligug December 21, 2012
cp and nano commands need sudo.
Etel Sverdlov December 21, 2012
Updated. Thank you
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
6/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
dev December 25, 2012
Does Fail2Ban start automatically when the server reboots?
Etel Sverdlov December 26, 2012
Yes, it does start automatically.
sds357 January 1, 2013
This tutorial didn't work for me until I changed 'backend = auto' to 'backend = polling' on my
ubuntu 12.04 droplet.
langlaislaurent January 18, 2013
"iptables -L" should be "sudo iptables -L"
goyal.nikhil89 January 19, 2013
can fail2ban work with ufw?
ben January 19, 2013
Yes it should be possible.
Fail2ban Actions: The directory /etc/fail2ban/action.d contains different scripts defining
actions which will execute once a filter matches. Only one filter is allowed per service, but it
is possible to specify several actions, on separate lines.
I would start there, but the default is to use iptables and since fail2ban is an automated
solution you can easily use iptables without knowing how it works.
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
7/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
agentbullvi January 23, 2013
Goyal,
UFW and iptables-multiport are completely compatible, however UFW will not show you
banned IP addresses. You can still manage your basic firewall with UFW.
If you need to see banned IP addresses you have multiple options.
iptables --list -n | fgrep DROP
or
fail2ban-client status ssh
Either will show you currently banned IP addresses. the fail2ban-client will show you the IP
addresses it is managing (via bantime limits).
Hope that helps.
jcjeffcc January 26, 2013
Shouldn't you sudo mv the .local file to .conf afterwards?
digitalocean January 29, 2013
might want to edit the configs using sudoedit instead of nano, running sudo nano can set
the nano history file to be owned by root which makes for some fun error messages down
the road.
marius.butuc February 16, 2013
"Write your personal IP address into the ignoreip line."
-- any solution if you have dynamic IP, or does that simply defeat the purpose?
neilabatchelor February 25, 2013
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
8/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
+Marius If you use DynDNS (http://dyn.com/dns/) you can get a hostname allocated to your
dynamic address. Most routers have the functionality to update whenever the IP address
changes.
christian March 12, 2013
I just followed these instructions, now in /var/log/fail2ban.log I'm seeing the following lines
hundreds of times:
fail2ban.filter : WARNING Determined IP using DNS Reverse Lookup: na-200-38-7572.static.avantel.net.mx = ['200.38.75.72']
fail2ban.filter : WARNING Determined IP using DNS Reverse Lookup:
demodigitool.gsl.com.mx = ['200.38.75.72']
What does that mean? Is this normal? I don't recognize the IP address.
Thanks
rhetherpei March 22, 2013
Good Tutorial to get started securing my VM.
chris.febian April 21, 2013
is this compatible with nginx by default? or we need to modified it first? I've googling and
found several article about how to make file2ban works with nginx. I got several
configuration and modification that I can't understand >,<
Help me please..??
brandon.dawson May 6, 2013
For users on 12.10, it seems that fail2ban is now shipping with filters for most everything
already built in.
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
9/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
cowsun.tech May 24, 2013
I also have a dynamic ip, So I set up an acount with DynDNS..
But how can I now SSH to my droplet using my DynDNS host name - so I can whitelist it in
fail2ban?
I configured my router's DDNS settings successfully, however when I check my SSH access
log after logging in it still shows my dynnamic IP and not my DynDNS hostname.
Kamal Nasser May 24, 2013
@cowsun.tech the ignoreip directive accepts a DNS hostname therefore you can put your
DynDNS host in there.
cowsun.tech May 25, 2013
@Kamal Nasser : Yeah I don't know how to use the dyndns hostname I've setup to access
my droplet.
In the ssh access log it shows my same dynamic IP from my ISP not DynDNS's, and after
each subsequent login the welcome reads:
Welcome to Ubuntu 12.04 LTS (GNU/Linux 3.2.0-23-virtual x86_64)
* Documentation: https://help.ubuntu.com/
Last login: Sat May 25 12:13:09 2013 from 192-XX-XXX-XX.dynamic.myisp.com <-- not my
DynDNS hostname which is what I need to be showing up here?
Kamal Nasser May 25, 2013
@cowsun.tech that's because your IP rDNS resolves to your ISP.
cowsun.tech May 25, 2013
@Kamal Nasser : thanks for clearing this up, so the suggestion up a little higher in a previous
post was incorrect and there is no point of using DynDNS for the purpose of compensating
for a dynamic IP from your ISP http://www.dyncommunity.com/questions/6771/problem-with-nslookup.html
Maybe I can stop wasting my time?
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
10/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
Kamal Nasser May 25, 2013
@cowsun.tech you still need to have your DynDNS host there so fail2ban whitelists your IP
even if it's dynamic.
yangyun June 23, 2013
On restart the message is "Restarting authentication failure monitor fail2ban" , meaning
'Restart succeeded' (not authentication failed).
Kamal Nasser June 23, 2013
@yangyun That is correct. It's restarting fail2ban which is the authentication failure monitor.
:]
brut-net July 26, 2013
To enable the alertmail you not only need to set the destemail, but also change the line
action = %(action_)s
to either
action = %(action_mw)s #(for ban & send an e-mail with whois report to the destemail)
or
action = %(action_mwl)s #(for ban & send an e-mail with whois report and relevant log lines
to the destemail)
german July 27, 2013
Can I install fail2ban after I install iRedMail ? Will it have conflic between the two ?
Tks
Kamal Nasser July 27, 2013
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
11/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
@germanab7: You can follow this official iRedMail entry on installing fail2ban:
http://www.iredmail.org/wiki/index.php?title=Addition/Harden.iRedMail.with.Fail2ban
deekin August 8, 2013
I'm thinking of implementing, but the whitelisting gives me a bit of pause. I do use Dyn on
my laptop and on my main box which is fine, but what if i want to use SSH from my phone?
Since I installed OpenVPN on my server, I guess I could also whitelist my DO IP and just
make sure I am connected before trying SSH from a 3G connection. Thoughts on whether
this would work or not? I don't really feel like "experimenting" with this specific feature :) - I'd
rather know before I go.
Kamal Nasser August 8, 2013
@deekin: It would certainly work. Whitelist your VPN's public IP address and add it to
fail2ban's whitelist. Then you can login to the VPN and then SSH to your droplet.
deekin August 8, 2013
Thank you Kamal! GJ on the techcrunch piece BTW - my pal sent it to me. Don't spend it all
on one place hehe - oh, and bring back receipts please.
deekin August 9, 2013
Shouldn't you sudo mv the .local file to .conf afterwards?
Kamal Nasser August 9, 2013
@deekin: No. Per the manual:
Every .conf file can be overridden with a file named .local. The .conf file
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
12/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
kevin_thulin August 14, 2013
Does fail2ban and UFW start self after a server reboot, or do I need to enable them?
Also, could I check if their both running by:
sudo iptables -L
sudo ufw status
?
Kamal Nasser August 14, 2013
@kevin_thulin: Both of them should start automatically. You can check if they're running by
running
service ufw status
service fail2ban status
mats.gbproject August 20, 2013
Should "eg." be included in the "eg. port=30000"? And should this be written instead of
"port=ssh" or in addition to it?
Kamal Nasser August 21, 2013
@mats.gbproject: No, "e.g." means "for example". It is an abbreviation for the Latin phrase
exempli gratia.
kevin_thulin August 23, 2013
I did a shutdown -h now, to take a snapshot of my droplet.
After that I checked my fail2ban with sudo tail -f /var/log/fail2ban.log and fail2ban-client
status ssh,
Now it says I only have 1 IP adress banned, I used to have 22. And my bantime is "31536000"
So, does fail2ban clear the log file after a reboot?
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
13/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
Also got this message:
2013-08-23 21:25:33 fail2ban.server : INFO Exiting Fail2ban
2013-08-23 21:25:34 fail2ban.server : INFO Changed logging target to /var/log/fail2ban.log
for Fail2ban v0.8.6
2013-08-23 21:25:34 fail2ban.jail : INFO Creating new jail 'ssh'
2013-08-23 21:25:34 fail2ban.jail : INFO Jail 'ssh' uses Gamin
2013-08-23 21:25:34 fail2ban.filter : INFO Added logfile = /var/log/auth.log
ppacoi August 26, 2013
Perfect Thanks
weeleetan August 27, 2013
hi,
can i add the section for nginx website also ?
Kamal Nasser August 28, 2013
@weeleetan: What would fail2ban protect you from if you configure it to work with nginx?
weeleetan August 29, 2013
i not sure, i am new and i wish to protect my VPS. Do you have any tips?
Kamal Nasser August 29, 2013
@weeleetan: Setting up fail2ban to work with nginx is redundant and not needed at all. You
should also firewall your droplet:
https://www.digitalocean.com/community/articles/how-to-setup-a-firewall-with-ufw-on-anhttps://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
14/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
ubuntu-and-debian-cloud-server
alex August 29, 2013
this instruction is missing the point that you need to whitelist your IP addresses in order not
to lock yourself out. So how does one do this?
asterixzzz October 11, 2013
If I have fail2ban installed is there any point to move ssh on another port than 22 or use SSH
key pair instead of password. I mean, how big is the probability that anyone would pass the
fail2ban protection anyway?
Kamal Nasser October 12, 2013
@Asterix: Anyone could just scan your droplet for open ports so you should install fail2ban
and change the SSH port.
nimopress October 29, 2013
I'd like to set fail2ban up. I'm concerned that I will be connecting from behind a proxy (it's
my ISP). I now connect via SSH Keys.
My questions is if I leave as-is 'ignoreip = 127.0.0.1/8' and not add more IP addresses, will I
risk being locked out?
My proxy IP could be xxx.xxx.xxx.24 now. and when i try ogging in again later, it could
change to xxx.xxx.xxx.250. That's quite a big range?
daniel.subs October 29, 2013
@JC - no. jail.local is meant to contain all local changes (ONLY) and is read by fail2ban
@Kamal note the bit you quoted " a .local file doesn't have to include everything in the
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
15/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
corresponding .conf file" and abide by this in the instructions. It will save confusion like
what you created for @germanab7
Step 2: you shouldn't copy jail.conf to jail.local - this means any updates to jail.conf are no
enforced. Create a new jail.local with only the bits required.
Step 3: just override bits you need like:
[DEFAULT]
destemail = ....
You probably never want to change the default to UDP. Set per jail if required
action = iptables[name=SSH, port=ssh, protocol=tcp]
Step 4: you only need to overwrite changes so here it could just be:
[ssh]
enabled = true
Kamal Nasser October 31, 2013
@Nicholas:
My questions is if I leave as-is 'ignoreip = 127.0.0.1/8' and not add more IP
addresses, will I risk being locked out?
Yes. But as long as you remember to not enter an incorrect password/use an invalid ssh key,
you won't be locked out.
nimopress November 3, 2013
@Kamal, yup makes sense to me. ;)
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
16/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
f1dc16eda41571f12bf5d14705a5aef0 December 5, 2013
Hi, I am not too sure what my port should be. It is currently at default 'port= ssh'.
My port number for my droplet is not 22, I have changed it to a different number. I am also
using SSH key. So should i still leave it as 'port=ssh'? Or should i change it to something
else? If so, what should it be? I'm really confused.
many thanks! :)
Kamal Nasser December 5, 2013
@hopefloatt: I believe you can simply replace 'ssh' with e.g. 1234 where 1234 is your SSH
port and it would work fine.
alexc December 6, 2013
Kamal, I just want to make sure that I understand this correctly. If I install fail2ban and I make
no modifications at all to the config files, I can still SSH into my server from any arbitrary IP
address, as long as I can log in successfully within three attempts? Is that right?
gagnon.pierluc December 6, 2013
Yes alexc, that's right!
acastella December 11, 2013
Hi!
The correct instruction is "sudo service fail2ban status"
Cheers!
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
17/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
anshar_amin December 31, 2013
My Fail2ban status:
*status of authentication failure monitor
* /var/run/fail2ban.sock not readable, status of fail2ban is unknown.
Is it not working?
Kamal Nasser January 1, 2014
@anshar_amin: I believe that means fail2ban is not running, try starting it:
sudo service fail2ban start
kevin.thornton12 January 5, 2014
Hi there does anyone know why my fail2ban keeps doing a log rotation once a week
dropping all my banned ips when i have the default bann time set to 1 year?
Kamal Nasser January 6, 2014
@scene4life21: Did you reboot your droplet? fail2ban clears the rules once the server is
rebooted.
kevin.thornton12 January 6, 2014
@Kamal Nasser
No.
Thats the weird thing about this is i dont reboot or update and upgrade at all cause there is
not much need to. I have the default ban time in the fail2ban.local file set to 1 year, yet once
a week in rotates the logs.
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
18/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
Kamal Nasser January 7, 2014
@scene4life21: Hmm. Can you paste fail2ban's logrotate config?
Kamal Nasser January 7, 2014
(Use http://pastebin.com/).
jb5531 January 8, 2014
Just reading through these comments and I'm a bit confused due to one from @weeleetan
about using Nginx. I'm new to setting up a VPS and currently have the LAMP stack installed
-- however, I will probably try using WordPress with Nginx in the near future, so I'd be
installing Nginx on my current setup, so the question:
Fail2Ban is independent of Apache, Nginx, etc, right; as in it works for all/any of them? If
not, then is there a similar program that one should use to protect Nginx? Sorry for the
newbie question but I want to make sure I get this right, thanks!
jb5531 January 8, 2014
Also, just checking that running `sudo service fail2ban restart` is suppose to product the
message -- Restarting authentication failure monitor fail2ban as it's the monitoring program?
This also happens when I try to run `service fail2ban status` and I want to make sure it's
working.
Kamal Nasser January 9, 2014
@Jason: Check out http://codepoets.co.uk/2013/fail2ban-filter-for-wordpress/. (Use
/etc/fail2ban/local.conf instead of jail.conf). Make sure you set logpath to nginx's access
log.
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
19/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
jb5531 January 22, 2014
OK - I guess after reading more my question is a bit confusing. I'm looking to use fail2ban to
protect my SSH (just like this article is going through) except that instead of using Apache,
I'm using nginx... so what are the differences, just the logpath? Is the nginx default logpath I
should be using /var/log/syslog?
I'm new at this so I have no idea what the "correct" way of doing this is.
danko.nakic February 17, 2014
The situation has changed a bit for us with dynamic IP's: http://dyn.com/dns/ is no longer
free. Is there a reliable free alternative available?
me March 15, 2014
IMPORTANT: As sds357 mentioned before, on Ubuntu LTS 12.04, leaving the "backend =
auto" doesn't work and fail2ban won't protect you from anything. You have to change it to
"backend = polling".
boy April 12, 2014
since I am in dynamic IP and do not want to pay for dyns, how do i uninstall this FAIL2BAN?
what is the Command Line?
Kamal Nasser April 12, 2014
@boy: You can uninstall fail2ban by running:
sudo apt-get remove fail2ban
.
vbamba May 30, 2014
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
20/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
Hi Kamal,
Quikc question. I am running SearchBlox an intranet search software using Java and it uses
port 8080. Am also running wordpress. Tried CSF but got website locked. Also I am getting
Ddos attacks. Will Fail2ban help me here. Also would I need to specify somewhere to allow
ports 80,8080,3306(Mysql), 3389(terminal services), 20,21(FTP) etc?
Thanks
Andrew SB May 30, 2014
@vbamba: Fail2ban protects against brute force attacks trying to access your server via ssh,
so it isn't much help for a DDOS attack. As for firewalling, iptables can do what you want. If
you're on Ubuntu or Debian, you can use ufw as a frontend for iptables. It really simplifies
things. Checkout:
https://www.digitalocean.com/community/articles/how-to-setup-a-firewall-with-ufw-on-anubuntu-and-debian-cloud-server
freaky_irish June 9, 2014
Can I access SSH if I leave ignoreip as is? (suppose I will NEVER supply wrong password)
Andrew SB June 10, 2014
@freaky_irish: Yes. As long as you don't hit the needed number of failed access attempts,
you don't need to add your IP to ignoreip
florian June 17, 2014
I'm having an issue where the field in the action.d files for Apache-related bans resolves to
my VPS's own IP, not the attacker's. Any idea why that could be the case? It works fine for
SSH (i.e. placeholder get's replaced by the attacker's IP...). Thanks!
Andrew SB June 18, 2014
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
21/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
@florian: You add you IP to the list of ignore IPs in /etc/fail2ban/jail.conf Which
Apache filters did you enable?
Log In to comment
Leave a comment...
SUBMIT COMME NT
This work is licensed under a Creative
Commons Attribution-NonCommercialShareAlike 4.0 International License.
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
22/23
8/2/2014
How To Protect SSH with fail2ban on Ubuntu 12.04 | DigitalOcean
Copyright © 2014
DigitalOcean ™ Inc.
Proudly Made in NY
Terms, Privacy, & Copyright
Security
C OMMUNITY
Dashboard
Overview
Tutorials
Questions
Projects
Tutorial Suggestions
Get Paid to Write
2 , 2 2 4 , 9 5 5 D ROPL E T S L AU N CH E D
https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-12-04
23/23