A firewall is a great thing to have but it doesn't do much to protect services that are allowed. A firewall only goes as far as to allow or disallow access. But once access is allowed to a service, its security depends on its configuration and whether or not there are any security vulnerabilities. A service worth installing is fail2ban, which is a neat little tool that runs in the background and watches your logs for anything out of the ordinary, such as multiple failures to access a service. The most popular use of fail2ban
is to protect SSH from those attempting to brute force it. In a lot of ways, fail2ban
is the successor to denyhosts, which pretty much did the same thing. But fail2ban
is able to protect more services than just SSH, another example being Apache.
When fail2ban
sees that a source is attempting to access a service and is failing, it will set up a firewall rule on the fly to block that service from your server. To begin, install the fail2ban
package on your server. In Debian systems, this is available in the default repositories. CentOS systems will find this package in the epel
repository that we've set up in the past. Once installed, enable and start it with systemctl
if it isn't already using the following command:
# systemctl start fail2ban # systemctl enable fail2ban
Inside the /etc/fail2ban
directory, you should see the main configuration file, jail.conf
. It's a good idea to copy this configuration to a local copy, because if you edit jail.conf
, it's always possible a package upgrade could overwrite it. The fail2ban
service will read jail.local
if it finds it and will not overwrite it if it were to be upgraded:
# cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Now that we have a local copy, we can now configure it to protect our services. Let's start with SSH. To do so, open /etc/fail2ban/jail.local
in a text editor and look for the [ssh]
section. On my system, this section looks like this:
[ssh] enabled = true port = 65256 filter = sshd action = iptables[name=SSH, port=65256, protocol=tcp] logpath = /var/log/auth.log maxretry = 6
As you can see, the configuration is fairly self-explanatory. The first line enables the SSH jail, it filters for traffic using sshd
, and it looks in /var/log/auth.log
for messages related to SSH. Although you've probably already noticed, we need to call out the SSH port in this file. If you stick with port 22, you can leave the relevant portions of the file as they are in your configuration. But if you changed your SSH port to something else, be sure to adjust accordingly. There are two places to place the port for SSH, the first on line three and the second on line five.
Now that we have our configuration in place, we can restart fail2ban
in order to start securing SSH for us:
# systemctl restart fail2ban
Take a look at the configuration file for other services that we may want to enable. An example could be Apache for our web server or even NGINX if you have that set up. The default configuration file contains a great deal of examples you can use. To use one, simply change enabled = false
to enable = true
and then restart fail2ban
.