{"id":3840,"date":"2023-02-24T17:16:57","date_gmt":"2023-02-24T17:16:57","guid":{"rendered":"https:\/\/www.webhi.com\/how-to\/?p=3840"},"modified":"2023-02-24T17:17:00","modified_gmt":"2023-02-24T17:17:00","slug":"how-to-install-and-configure-fail2ban","status":"publish","type":"post","link":"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/","title":{"rendered":"How to Install and Configure Fail2ban"},"content":{"rendered":"\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1200\" height=\"675\" src=\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/02\/fail2ban_install_en.jpg\" alt=\"setup and configure Fail2ban in ubuntu and centOS RHEL\" class=\"wp-image-3884\" srcset=\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/02\/fail2ban_install_en.jpg 1200w, https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/02\/fail2ban_install_en-300x169.jpg 300w, https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/02\/fail2ban_install_en-1024x576.jpg 1024w, https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/02\/fail2ban_install_en-768x432.jpg 768w, https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/02\/fail2ban_install_en-150x84.jpg 150w\" sizes=\"(max-width: 1200px) 100vw, 1200px\" \/><\/figure>\n\n\n\n<p>Fail2ban is an open-source tool that provides a simple way to protect your server from brute-force attacks. It does this by monitoring log files and banning any IP addresses that repeatedly fail authentication attempts. This article will guide you through the process of installing and configuring fail2ban on a Linux server on most known distributions (CentOS, Ubuntu, RedHat, &#8230;)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Install Fail2ban<\/h2>\n\n\n\n<p>The first step is to install fail2ban on your server. The installation process will vary depending on your Linux distribution. Here are the commands for a few popular distributions:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Debian\/Ubuntu:<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ sudo apt-get update\n$ sudo apt-get install fail2ban<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">CentOS\/RHEL:<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ sudo yum update\n$ sudo yum install epel-release\n$ sudo yum install fail2ban<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Configure Fail2ban<\/h2>\n\n\n\n<p>The fail2ban configuration files are located in the \/etc\/fail2ban\/ directory. The main configuration file is jail.conf, which contains the default configuration for all services that fail2ban can monitor. However, you should not modify this file directly. Instead, create a new configuration file in the \/etc\/fail2ban\/jail.d\/ directory to override the default settings.<\/p>\n\n\n\n<p>For example, let&#8217;s say you want to protect your SSH service. You can create a new configuration file called sshd.conf in the \/etc\/fail2ban\/jail.d\/ directory and add the following content:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"properties\" class=\"language-properties\">[sshd]\nenabled = true\nport = ssh\nfilter = sshd\nlogpath = \/var\/log\/auth.log\nmaxretry = 5\nbantime = 86400<\/code><\/pre>\n\n\n\n<p>Let&#8217;s break down the meaning of each line:<\/p>\n\n\n\n<ul>\n<li><strong>[sshd]:<\/strong>&nbsp;The name of the jail. This should match the name of the service you want to protect.<\/li>\n\n\n\n<li><strong>enabled = true:<\/strong>&nbsp;This enables the jail.<\/li>\n\n\n\n<li><strong>port = ssh:<\/strong>&nbsp;The port on which the service is running. In this case, it&#8217;s the SSH port.<\/li>\n\n\n\n<li><strong>filter = sshd:<\/strong>&nbsp;The name of the filter file, which contains the regular expressions used to detect failed login attempts.<\/li>\n\n\n\n<li><strong>logpath = \/var\/log\/auth.log:<\/strong>&nbsp;The path to the log file for the service.<\/li>\n\n\n\n<li><strong>maxretry = 5:<\/strong>&nbsp;The number of failed login attempts allowed before banning the IP address.<\/li>\n\n\n\n<li><strong>bantime = 86400:<\/strong>&nbsp;The amount of time (in seconds) the IP address should be banned.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Test Fail2ban<\/h2>\n\n\n\n<p>Once you have created your configuration file, you can test fail2ban by trying to log in to your server multiple times with the wrong credentials. After the specified number of failed attempts, your IP address should be banned for the specified amount of time. You can verify this by running the following command:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ sudo fail2ban-client status sshd<\/code><\/pre>\n\n\n\n<p>This will display the status of the sshd jail, including the banned IP addresses.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Monitor Fail2ban<\/h2>\n\n\n\n<p>Fail2ban will run automatically in the background, monitoring your log files for failed authentication attempts. However, it&#8217;s a good idea to monitor fail2ban to make sure it&#8217;s working correctly. You can use the following commands to view fail2ban logs:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ sudo journalctl -u fail2ban\n$ sudo tail -f \/var\/log\/fail2ban.log<\/code><\/pre>\n\n\n\n<p>The first command will display the systemd logs for fail2ban, while the second command will display the fail2ban log file in real-time.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p>Fail2ban is a powerful tool that can help protect your server from brute-force attacks. By following the steps in this article, you can install and configure fail2ban on your Linux server. Remember to create a configuration file for each service you want to protect, and monitor fail2ban to make sure it&#8217;s working correctly.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Fail2ban is an open-source tool that provides a simple way to protect your server from brute-force attacks. It does this by monitoring log files and banning any IP addresses that repeatedly fail authentication attempts. This article will guide you through the process of installing and configuring fail2ban on a Linux server on most known distributions ..<\/p>\n<div class=\"clear-fix\"><\/div>\n<p><a href=\"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/\" title=\"read more...\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[69,3],"tags":[],"yoast_head":"\n<title>How to Install and Configure Fail2ban - WebHi Tutorials &amp; Documentations<\/title>\n<meta name=\"description\" content=\"Learn how to install and configure Fail2ban on your Linux server to enhance security. This powerful tool monitors log files for authentication failures and bans offending IP addresses. Follow our step-by-step guide to protect your server from brute-force attacks.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Install and Configure Fail2ban - WebHi Tutorials &amp; Documentations\" \/>\n<meta property=\"og:description\" content=\"Learn how to install and configure Fail2ban on your Linux server to enhance security. This powerful tool monitors log files for authentication failures and bans offending IP addresses. Follow our step-by-step guide to protect your server from brute-force attacks.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/\" \/>\n<meta property=\"og:site_name\" content=\"WebHi Tutorials &amp; Documentations\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/webhi.technology\" \/>\n<meta property=\"article:published_time\" content=\"2023-02-24T17:16:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-02-24T17:17:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/02\/fail2ban_install_en.jpg\" \/>\n<meta name=\"author\" content=\"webhi\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@WebHiTechnology\" \/>\n<meta name=\"twitter:site\" content=\"@WebHiTechnology\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"webhi\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/\"},\"author\":{\"name\":\"webhi\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/b31e76e2311cdc0bb90f5e2733059a54\"},\"headline\":\"How to Install and Configure Fail2ban\",\"datePublished\":\"2023-02-24T17:16:57+00:00\",\"dateModified\":\"2023-02-24T17:17:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/\"},\"wordCount\":517,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/#organization\"},\"articleSection\":[\"Linux system administration\",\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/\",\"url\":\"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/\",\"name\":\"How to Install and Configure Fail2ban - WebHi Tutorials &amp; Documentations\",\"isPartOf\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/#website\"},\"datePublished\":\"2023-02-24T17:16:57+00:00\",\"dateModified\":\"2023-02-24T17:17:00+00:00\",\"description\":\"Learn how to install and configure Fail2ban on your Linux server to enhance security. This powerful tool monitors log files for authentication failures and bans offending IP addresses. Follow our step-by-step guide to protect your server from brute-force attacks.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.webhi.com\/how-to\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Install and Configure Fail2ban\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#website\",\"url\":\"https:\/\/www.webhi.com\/how-to\/\",\"name\":\"WebHi Tutorials &amp; Documentations\",\"description\":\"System administration and knowledge base\",\"publisher\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.webhi.com\/how-to\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#organization\",\"name\":\"WebHi Technology\",\"url\":\"https:\/\/www.webhi.com\/how-to\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2022\/07\/logo.png\",\"contentUrl\":\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2022\/07\/logo.png\",\"width\":288,\"height\":95,\"caption\":\"WebHi Technology\"},\"image\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/webhi.technology\",\"https:\/\/twitter.com\/WebHiTechnology\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/b31e76e2311cdc0bb90f5e2733059a54\",\"name\":\"webhi\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.webhi.com\/how-to\/ahuphiph\/litespeed\/avatar\/e20da107d0f4c765ead2eef88ad019d8.jpg?ver=1784239260\",\"contentUrl\":\"https:\/\/www.webhi.com\/how-to\/ahuphiph\/litespeed\/avatar\/e20da107d0f4c765ead2eef88ad019d8.jpg?ver=1784239260\",\"caption\":\"webhi\"},\"sameAs\":[\"https:\/\/www.webhi.com\/how-to\"],\"url\":\"https:\/\/www.webhi.com\/how-to\/author\/webhi\/\"}]}<\/script>\n","yoast_head_json":{"title":"How to Install and Configure Fail2ban - WebHi Tutorials &amp; Documentations","description":"Learn how to install and configure Fail2ban on your Linux server to enhance security. This powerful tool monitors log files for authentication failures and bans offending IP addresses. Follow our step-by-step guide to protect your server from brute-force attacks.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/","og_locale":"en_US","og_type":"article","og_title":"How to Install and Configure Fail2ban - WebHi Tutorials &amp; Documentations","og_description":"Learn how to install and configure Fail2ban on your Linux server to enhance security. This powerful tool monitors log files for authentication failures and bans offending IP addresses. Follow our step-by-step guide to protect your server from brute-force attacks.","og_url":"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/","og_site_name":"WebHi Tutorials &amp; Documentations","article_publisher":"https:\/\/www.facebook.com\/webhi.technology","article_published_time":"2023-02-24T17:16:57+00:00","article_modified_time":"2023-02-24T17:17:00+00:00","og_image":[{"url":"https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/02\/fail2ban_install_en.jpg"}],"author":"webhi","twitter_card":"summary_large_image","twitter_creator":"@WebHiTechnology","twitter_site":"@WebHiTechnology","twitter_misc":{"Written by":"webhi","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/#article","isPartOf":{"@id":"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/"},"author":{"name":"webhi","@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/b31e76e2311cdc0bb90f5e2733059a54"},"headline":"How to Install and Configure Fail2ban","datePublished":"2023-02-24T17:16:57+00:00","dateModified":"2023-02-24T17:17:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/"},"wordCount":517,"commentCount":0,"publisher":{"@id":"https:\/\/www.webhi.com\/how-to\/#organization"},"articleSection":["Linux system administration","Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/","url":"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/","name":"How to Install and Configure Fail2ban - WebHi Tutorials &amp; Documentations","isPartOf":{"@id":"https:\/\/www.webhi.com\/how-to\/#website"},"datePublished":"2023-02-24T17:16:57+00:00","dateModified":"2023-02-24T17:17:00+00:00","description":"Learn how to install and configure Fail2ban on your Linux server to enhance security. This powerful tool monitors log files for authentication failures and bans offending IP addresses. Follow our step-by-step guide to protect your server from brute-force attacks.","breadcrumb":{"@id":"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.webhi.com\/how-to\/how-to-install-and-configure-fail2ban\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.webhi.com\/how-to\/"},{"@type":"ListItem","position":2,"name":"How to Install and Configure Fail2ban"}]},{"@type":"WebSite","@id":"https:\/\/www.webhi.com\/how-to\/#website","url":"https:\/\/www.webhi.com\/how-to\/","name":"WebHi Tutorials &amp; Documentations","description":"System administration and knowledge base","publisher":{"@id":"https:\/\/www.webhi.com\/how-to\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.webhi.com\/how-to\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.webhi.com\/how-to\/#organization","name":"WebHi Technology","url":"https:\/\/www.webhi.com\/how-to\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/logo\/image\/","url":"https:\/\/www.webhi.com\/how-to\/gilrogre\/2022\/07\/logo.png","contentUrl":"https:\/\/www.webhi.com\/how-to\/gilrogre\/2022\/07\/logo.png","width":288,"height":95,"caption":"WebHi Technology"},"image":{"@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/webhi.technology","https:\/\/twitter.com\/WebHiTechnology"]},{"@type":"Person","@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/b31e76e2311cdc0bb90f5e2733059a54","name":"webhi","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/image\/","url":"https:\/\/www.webhi.com\/how-to\/ahuphiph\/litespeed\/avatar\/e20da107d0f4c765ead2eef88ad019d8.jpg?ver=1784239260","contentUrl":"https:\/\/www.webhi.com\/how-to\/ahuphiph\/litespeed\/avatar\/e20da107d0f4c765ead2eef88ad019d8.jpg?ver=1784239260","caption":"webhi"},"sameAs":["https:\/\/www.webhi.com\/how-to"],"url":"https:\/\/www.webhi.com\/how-to\/author\/webhi\/"}]}},"_links":{"self":[{"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/posts\/3840"}],"collection":[{"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/comments?post=3840"}],"version-history":[{"count":4,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/posts\/3840\/revisions"}],"predecessor-version":[{"id":3895,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/posts\/3840\/revisions\/3895"}],"wp:attachment":[{"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/media?parent=3840"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/categories?post=3840"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/tags?post=3840"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}