Fail2ban is a security service that helps protect Linux servers from repeated unsuccessful login attempts and other suspicious activity. It monitors log files for failed authentication attempts and can temporarily ban the IP addresses responsible for those attempts.<\/p>\n\n\n\n
In this article, we will explain how to install and configure Fail2ban on a CentOS 7 server<\/strong> and enable protection for SSH login attempts.<\/p>\n\n\n\n Before proceeding, make sure you have:<\/p>\n\n\n\n Fail2ban is available through the EPEL (Extra Packages for Enterprise Linux)<\/strong> repository.<\/p>\n\n\n\n If EPEL is not already installed, install it using:<\/p>\n\n\n\n Update the package repository:<\/p>\n\n\n\n Install the Fail2ban package using Enable the Fail2ban service so that it starts automatically after a server reboot:<\/p>\n\n\n\n Create or edit the Add the following configuration:<\/p>\n\n\n\n [sshd]<\/p>\n\n\n\n enabled = true<\/p>\n\n\n\n In the above configuration:<\/p>\n\n\n\n Start the Fail2ban service:<\/p>\n\n\n\n You can also verify the service status using:<\/p>\n\n\n\n To view the currently configured Fail2ban jails, run:<\/p>\n\n\n\n The output should be similar to:<\/p>\n\n\n\n To get detailed information about the SSH jail, run:<\/p>\n\n\n\n This displays information such as the number of currently banned IP addresses and the total number of failed attempts detected.<\/p>\n\n\n\n In this article, we explained how to install and configure Fail2ban on CentOS 7<\/strong>. We configured Fail2ban to monitor SSH login attempts and temporarily ban IP addresses that make repeated unsuccessful authentication attempts.<\/p>\n\n\n\n Fail2ban provides an additional layer of protection against automated brute-force attacks on services such as SSH.<\/p>\n\n\n\n Fail2ban is a security tool that monitors system logs for repeated failed authentication attempts and can temporarily block the associated IP addresses.<\/p>\n\n\n\n Fail2ban is available through the EPEL repository<\/strong>. If EPEL is not installed, install the In this configuration, the ban time is set to 3600 seconds<\/strong>, which is one hour:<\/p>\n\n\n\n Run:<\/p>\n\n\n\n How to Install and Configure Fail2ban on Ubuntu 18.04 Server – Pheonix Solutions<\/a><\/p>\n\n\n\n Install-configure-fail2ban-ubuntu-16-04<\/a><\/p>\n\n\n\nPrerequisites<\/h2>\n\n\n\n
\n
Implementation<\/h2>\n\n\n\n
Step 1: Install the EPEL Repository<\/h3>\n\n\n\n
yum install epel-release<\/pre>\n\n\n\n
yum update<\/pre>\n\n\n\n
Step 2: Install Fail2ban<\/h3>\n\n\n\n
yum<\/code>:<\/p>\n\n\n\nyum -y install fail2ban<\/pre>\n\n\n\n
Step 3: Enable Fail2ban at Boot<\/h3>\n\n\n\n
systemctl enable fail2ban<\/pre>\n\n\n\n
Step 4: Configure Fail2ban<\/h3>\n\n\n\n
jail.local<\/code> configuration file:<\/p>\n\n\n\nvi \/etc\/fail2ban\/jail.local<\/pre>\n\n\n\n
[DEFAULT]\n\n# Ban hosts for one hour\nbantime = 3600\n\n# Use iptables for banning\nbanaction = iptables-multiport<\/pre>\n\n\n
\n
bantime = 3600<\/code> blocks an offending IP address for one hour.<\/li>\n\n\n\nbanaction<\/code> specifies the action used to block the IP address.<\/li>\n\n\n\n[sshd]<\/code> enables Fail2ban protection for SSH.<\/li>\n\n\n\nenabled = true<\/code> activates the SSH jail.<\/li>\n<\/ul>\n\n\n\nStep 5: Start Fail2ban<\/h3>\n\n\n\n
systemctl start fail2ban<\/pre>\n\n\n\n
systemctl status fail2ban<\/pre>\n\n\n\n
Step 6: Check the Fail2ban Jails<\/h3>\n\n\n\n
fail2ban-client status<\/pre>\n\n\n\n
Status\n|- Number of jail: 1\n`- Jail list: sshd<\/pre>\n\n\n\n
fail2ban-client status sshd<\/pre>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
FAQs<\/h2>\n\n\n\n
1. What is Fail2ban?<\/h3>\n\n\n\n
2. Where is Fail2ban available on CentOS 7?<\/h3>\n\n\n\n
epel-release<\/code> package first.<\/p>\n\n\n\n3. How long will an IP address be banned?<\/h3>\n\n\n\n
bantime = 3600<\/pre>\n\n\n\n
4. How can I check whether Fail2ban is running?<\/h3>\n\n\n\n
systemctl status fail2ban<\/pre>\n\n\n\n
Related Article<\/h2>\n\n\n\n
Talk to our experts<\/h2>\n\n\n\n