How to Secure Your Ubuntu Server.
In this video, I will show you how to protect ubuntu server from brute force attack using “fail2ban”
Fail2ban is an open-source tool to prevent servers from brute force attacks. This tool will scan server log files and if found any suspicious attempts then it will block the particular IP for a specific time.
Step 1: Login to your server and install fail2ban using yum.
apt update
apt install fail2ban
Step 2: Start and enable the service.
systemctl start fail2ban
systemctl enable fail2ban
Step 3: Copy the default configuration file to create a new jail local config file.
cd /etc/fail2ban/
cp jail.conf jail.local
nano jail.local
Step 4: Configure jail file to prevent brute force attacks.
nano jail.local
[sshd]
port = ssh
logpath = %(sshd_log)s
banaction = iptables-multiport
maxretry = 3
findtime = 300
bantime = 600
enabled = true
filter = sshd
Save the file and restart the service.
systemctl restart fail2ban
Step 5: Check fail2ban client status using below command.
fail2ban-client status
You can also check the particular service ban configuration details by using this command.
fail2ban-client status sshd
If any IPs are banned then those IPs will show here in the above command output “Banned IP list:”
You can also ban/unban known blacklisted IP(s) manually using the below command.
fail2ban-client set sshd banip (IPAddress)
fail2ban-client set sshd unbanip (IPAddress)
END
Please watch our more upcoming videos and don't forget to LIKE, COMMENT, AND SUBSCRIBE.
Thank you!
MD
System Administrator