How To Install Fail2Ban on CentOS Stream 10

In this tutorial, we will show you how to install Fail2Ban on CentOS Stream 10. Before diving into the installation process, it’s crucial to understand what Fail2Ban is and how it operates. Fail2Ban is an open-source tool that monitors log files for signs of malicious activity. When it detects suspicious behavior, such as multiple failed login attempts, it can automatically update firewall rules to block the offending IP addresses for a specified period.

Fail2Ban works by scanning log files for patterns that indicate potential attacks. It uses regular expressions to match these patterns and can be configured to protect various services, including SSH, Apache, and FTP. By temporarily or permanently banning IP addresses that show signs of malicious intent, Fail2Ban significantly reduces the risk of successful brute-force attacks.

Prerequisites

Before proceeding with the installation of Fail2Ban on CentOS Stream 10, ensure that you meet the following requirements:

• A CentOS Stream 10 server with root or sudo privileges
• Basic knowledge of Linux command-line interface
• A stable internet connection for downloading packages
• Sufficient disk space for installation (approximately 20MB)

It’s also recommended to have a backup of your current system configuration, especially if you’re implementing Fail2Ban on a production server.

Installation Process

Let’s walk through the step-by-step process of installing Fail2Ban on your CentOS Stream 10 system.

Step 1: Update Your System

Before installing any new software, it’s always a good practice to update your system. This ensures that you have the latest security patches and package information. Open your terminal and run the following command:

sudo dnf update -y

This command will update all installed packages to their latest versions.

Step 2: Install EPEL Repository

Fail2Ban is not available in the default CentOS repositories. Therefore, we need to enable the EPEL (Extra Packages for Enterprise Linux) repository. EPEL is a volunteer-based community effort from the Fedora project to create a repository of high-quality add-on packages for Red Hat Enterprise Linux (RHEL) and its compatible spinoffs like CentOS.

To install the EPEL repository, execute the following command:

sudo dnf install epel-release -y

Step 3: Install Fail2Ban

With the EPEL repository enabled, we can now install Fail2Ban. Run the following command:

sudo dnf install fail2ban -y

This command will download and install Fail2Ban along with its dependencies.

Step 4: Start and Enable Fail2Ban Service

After the installation is complete, we need to start the Fail2Ban service and enable it to start automatically on system boot. Use these commands:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

To verify that Fail2Ban is running, you can check its status:

sudo systemctl status fail2ban

You should see output indicating that the service is active and running.

Basic Configuration

Now that Fail2Ban is installed and running, let’s configure it to protect your system effectively.

Creating a Local Configuration File

Fail2Ban uses a configuration file called `jail.conf`. However, it’s recommended to create a local configuration file named `jail.local` to override the default settings. This approach ensures that your custom configurations are not overwritten during system updates.

Create the `jail.local` file using your preferred text editor:

sudo nano /etc/fail2ban/jail.local

Configuring Basic Parameters

In the `jail.local` file, you can set various parameters to customize Fail2Ban’s behavior. Here’s a basic configuration to get you started:

[DEFAULT]
bantime = 10m
findtime = 10m
maxretry = 5

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/secure
maxretry = 3
bantime = 1h

Let’s break down these parameters:

• bantime: The duration for which an IP is banned (10m = 10 minutes)
• findtime: The time frame in which Fail2Ban looks for repeated offenses
• maxretry: The number of failures before a ban is imposed
• enabled: Activates the jail for the specified service (in this case, SSH)
• port: The port number the service uses
• filter: The filter used to detect authentication failures
• logpath: The location of the log file to monitor

Save the file and exit the text editor.

Restarting Fail2Ban

After making changes to the configuration, restart Fail2Ban to apply the new settings:

sudo systemctl restart fail2ban

Advanced Configuration

For more advanced users, Fail2Ban offers extensive customization options to tailor its behavior to your specific needs.

Custom Jail Creation

You can create custom jails to protect additional services. For example, to create a jail for Apache web server:

[apache-auth]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/httpd/error_log
maxretry = 6
bantime = 1h

Email Notifications

To receive email notifications when Fail2Ban takes action, you can configure the `action` parameter in your jail configuration:

action = %(action_mwl)s

This action sends an email with a WhoIs report and relevant log lines. Ensure you have a working mail transfer agent (MTA) like Postfix installed and configured on your system.

Whitelist Configuration

To prevent Fail2Ban from banning certain IP addresses, you can add them to the `ignoreip` parameter in the `[DEFAULT]` section:

ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24

This example whitelists localhost and the 192.168.1.0/24 subnet.

Management and Monitoring

Effective management and monitoring of Fail2Ban are crucial for maintaining your server’s security posture.

Checking Fail2Ban Status

To view the status of all Fail2Ban jails:

sudo fail2ban-client status

For a specific jail (e.g., sshd):

sudo fail2ban-client status sshd

Viewing Banned IPs

To see a list of currently banned IP addresses for a specific jail:

sudo fail2ban-client get sshd banip

Manually Banning or Unbanning IPs

To manually ban an IP address:

sudo fail2ban-client set sshd banip 192.168.1.100

To unban an IP address:

sudo fail2ban-client set sshd unbanip 192.168.1.100

Troubleshooting Guide

Even with careful configuration, you may encounter issues with Fail2Ban. Here are some common problems and their solutions:

Fail2Ban Not Starting

If Fail2Ban fails to start, check the system logs:

sudo journalctl -u fail2ban

Look for error messages that might indicate configuration issues or conflicts with other services.

Incorrect Log Paths

Ensure that the `logpath` specified in your jail configurations is correct. You can verify log file locations using:

sudo ls /var/log

Firewall Conflicts

If you’re using a firewall like firewalld, make sure it’s not interfering with Fail2Ban’s rules. You may need to add Fail2Ban to the trusted applications:

sudo firewall-cmd --permanent --add-service=fail2ban
sudo firewall-cmd --reload

Best Practices and Security Tips

To maximize the effectiveness of Fail2Ban and enhance your overall server security, consider these best practices:

• Regularly update Fail2Ban and your system packages to patch known vulnerabilities.
• Use strong, unique passwords for all services and consider implementing two-factor authentication where possible.
• Monitor your Fail2Ban logs regularly for any unusual activity or false positives.
• Implement a comprehensive security strategy that includes Fail2Ban as just one component.
• Keep your `jail.local` configuration file backed up and version-controlled.

Congratulations! You have successfully installed Fail2Ban. Thanks for using this tutorial for installing the Fail2Ban on CentOS Stream 10 system. For additional help or useful information, we recommend you check the official Fail2Ban website.