One of the important task for Linux administrator is to protect server against illegitimate attack or access. By default Linux system comes with well-configured firewall such as Iptables, Uncomplicated Firewall (UFW), ConfigServer Security Firewall (CSF), etc, which will prevent many kinds of attacks.
Any machine which is connected to the internet is a potential target for malicious attacks. There is a tool called fail2ban is available to mitigate illegitimate access on server.
### What Is Fail2ban?
[Fail2ban][1] is an intrusion prevention software, framework which protect server against brute force attacks. It's Written in Python programming language. Fail2ban work based on auth log files, by default it will scan the auth log files such as `/var/log/auth.log`, `/var/log/apache/access.log`, etc.. and bans IPs that show the malicious signs, too many password failures, seeking for exploits, etc.
Generally fail2Ban is used to update firewall rules to reject the IP addresses for a specified amount of time. Also it will send mail notification too. Fail2Ban comes with many filters for various services such as ssh, apache, nginx, squid, named, mysql, nagios, etc,.
Fail2Ban is able to reduce the rate of incorrect authentications attempts however it cannot eliminate the risk that weak authentication presents. this is one of the security for server which will prevent brute force attacks.
### How to Install Fail2ban In Linux
Fail2ban is already packaged with most of the Linux distribution so, just use you distribution package manager to install it.
For **`Debian/Ubuntu`** , use [APT-GET Command][2] or [APT Command][3] to install tilda.
```
$ sudo apt install fail2ban
```
For **`Fedora`** , use [DNF Command][4] to install tilda.
```
$ sudo dnf install fail2ban
```
For **`CentOS/RHEL`** systems, enable [EPEL Repository][5] or [RPMForge Repository][6] and use [YUM Command][7] to install Terminator.
```
$ sudo yum install fail2ban
```
For **`Arch Linux`** , use [Pacman Command][8] to install tilda.
```
$ sudo pacman -S fail2ban
```
For **`openSUSE`** , use [Zypper Command][9] to install tilda.
```
$ sudo zypper in fail2ban
```
### How To Configure Fail2ban
By default Fail2ban keeps all the configuration files in `/etc/fail2ban/` directory. The main configuration file is `jail.conf`, it contains a set of pre-defined filters. So, don't edit the file and it's not advisable because whenever new update comes the configuration get reset to default.
Just create a new configuration file called `jail.local` in the same directory and modify as per your wish.
By default most of the option was configured perfectly and if you want to enable access to any particular IP then you can add the IP address into `ignoreip` area, for more then one IP give a speace between the IP address.
The `DEFAULT` section contains the basic set of rules that Fail2Ban follow and you can adjust any parameter as per your wish.
```
# nano /etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1/8 192.168.1.100/24
bantime = 600
findtime = 600
maxretry = 3
destemail = 2daygeek@gmail.com
```
* **ignoreip :** This section allow us to whitelist the list of IP address and Fail2ban will not ban a host which matches an address in this list
* **bantime :** The number of seconds that a host is banned
* **findtime :** A host is banned if it has generated "maxretry" during the last "findtime" seconds
* **maxretry :** "maxretry" is the number of failures before a host get banned.
### How To Configure Service
Fail2ban comes with set of pre-defined filters for various servicess such as ssh, apache, nginx, squid, named, mysql, nagios, etc,. We don't want to make any changes on configuration file and just add following line `enabled = true` in the service area to enable jail to any services. To disable make the line to `false` instead of ture.
```
# SSH servers
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
```
* **enabled :** Determines whether the service is turned on or off.
* **port :** It's refering to the particular service. If using the default port, then the service name can be placed here. If using a non-traditional port, this should be the port number.
* **logpath :** Gives the location of the service's logs./li>
* **backend :** "backend" specifies the backend used to get files modification.
### Restart Fail2Ban
After making changes restart Fail2Ban to take effect.
```
[For SysVinit Systems]
# service fail2ban restart
[For systemd Systems]
# systemctl restart fail2ban.service
```
### Verify Fail2Ban iptables rules
You can confirm whether Fail2Ban iptables rules are added into firewall using below command.
