How To Install Fail2Ban on Debian 10

In this tutorial, we will show you how to install Fail2Ban on Debian 10. For those of you who didn’t know, Fail2Ban is a utility that is used to detect and prevent brute force intrusion. By scanning logs for certain actions, such as repeated failed login attempts, Fail2Ban is able to alter firewall configurations to halt further events.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you through the step-by-step installation of Fail2Ban on a Debian 10 (Buster).

Prerequisites

• A server running one of the following operating systems: Debian 10 (Buster).
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Fail2Ban on Debian 10 Buster

Step 1. Before we install any software, it’s important to make sure your system is up to date by running the following apt commands in the terminal:

sudo apt update
sudo apt upgrade

Step 2. Installing Fail2Ban on Debian 10.

Run the following command to install Fail2Ban:

sudo apt install fail2ban

Step 3. Configure Fail2Ban.

On Debian, the default Fail2ban filter settings will be stored in both the /etc/fail2ban/jail.conf file and the /etc/fail2ban/jail.d/defaults-debian.conf file. You can read more about jails here. Remember that settings in the latter file will override corresponding settings in the former one:

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

After the file is copied, you can make all of your changes within the new jail.local file. Many possible services that may need protection are in the file already. Each one is located in its own section, configured and turned off:

nano /etc/fail2ban/jail.local

You can see the default section below:

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1

# "bantime" is the number of seconds that a host is banned.
bantime  = 800

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 800

# "maxretry" is the number of failures before a host get banned.
maxretry = 3

After any changes you need always to restart Fail2Ban:

sudo systemctl restart fail2ban

We can check the status of the service using systemctl, too:

sudo systemctl status fail2ban

Congratulations! You have successfully installed Fail2Ban. Thanks for using this tutorial for installing Fail2Ban on Debian 10 Buster. For additional help or useful information, we recommend you check the official Fail2Ban website.