Blocking Unwanted IP Addresses on Linux Server (Fail2Ban Installation)

Getting Rid of Brute Force Attacks

As soon as you buy a Linux-based virtual server, thousands of malicious bots on the internet will try to infiltrate your server by trying random passwords over your SSH port (port 22). In fact, these attempts can become so intense that your server's processor can swell. Here, Fail2Ban is an amazing software that detects these harmful IP addresses from log files and automatically blocks them in the Firewall.

1. Fail2Ban Installation

Connect to your server with root privileges. For Ubuntu and Debian:

sudo apt update
sudo apt install fail2ban -y

For AlmaLinux and CentOS, you must first add the EPEL repository:

sudo dnf install epel-release -y
sudo dnf install fail2ban -y

2. Jail Configuration

After Fail2Ban is installed, we must create a special configuration for ourselves (jail.local) by copying the default configuration file (jail.conf):

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Open the file with the nano /etc/fail2ban/jail.local command and find the following basic protection settings:

• bantime = 10m: Specifies the duration for which the malicious IP address will be blocked. (If you write "1h" it will be blocked for 1 hour, "1d" for 1 day.)
• findtime = 10m: Specifies the duration of unsuccessful login attempts to be remembered.
• maxretry = 5: Determines how many times an IP address will be blocked after entering the wrong password. Changing this to "3" increases security.

3. Starting the Service and Status Check

After saving the settings, activate Fail2Ban and ensure it runs automatically even when the server restarts:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

If you want to see which IP addresses have been blocked during the SSH connection, you can use the sudo fail2ban-client status sshd command. If you intend to keep your business-critical data completely safe, take advantage of the professional level İyibirNet VDS Server privileges with hardware protection now.