How To Install Fail2Ban on AlmaLinux 8

In this tutorial, we will show you how to install Fail2Ban on AlmaLinux 8. For those of you who didn’t know, Fail2ban is an open-source tool that helps protect your Linux machine from brute force and other automated attacks by monitoring the services logs for malicious activity. These apps run as a daemon that uses python scripts to parse log files for system intrusion attempts and adds custom rules to Iptables configuration files to ban access to certain IP addresses.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of Fail2Ban on an AlmaLinux 8. You can follow the same instructions for Rocky Linux.

Prerequisites

• A server running one of the following operating systems: AlmaLinux 8, CentOS, and Rocky Linux 8.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Fail2Ban on AlmaLinux 8

Step 1. First, let’s start by ensuring your system is up-to-date.

sudo dnf update
sudo dnf install epel-release

Step 2. Installing Fail2ban on AlmaLinux 8.

The Fail2ban package is included in the default AlmaLinux repositories. To install it, enter the following command below:

sudo dnf install fail2ban

We are going to start and enable fail2ban on boot. Usually, the service is not running upon installation:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

Step 3. Configure Fail2Ban.

For this tutorial, we will create a separate file called jail.local in the /etc/fail2ban/ directory as shown:

nano /etc/fail2ban/jail.local

[DEFAULT] 
ignoreip = 192.168.77.1/24
bantime  = 21600
findtime  = 300
maxretry = 3
banaction = iptables-multiport
backend = systemd

[sshd] 
enabled = true

We explain the options in the above configuration:

• ignoreip: specifies the list of IP addresses or hostnames not to ban.
• bantime: specify the number of seconds that a host is banned for (i.e effective ban duration).
• maxretry: specifies the number of failures before a host gets banned.
• findtime: fail2ban will ban a host if it has generated “maxretry” during the last “find time” seconds.
• banaction: banning action.
• backend: specifies the backend used to get log file modification.

Save and close the file, then restarting the Fail2Ban service to load new settings:

sudo systemctl restart fail2ban

Congratulations! You have successfully installed Fail2Ban. Thanks for using this tutorial for installing Fail2Ban on your AlmaLinux 8 system. For additional help or useful information, we recommend you check the official Fail2Ban website.