How To Install Fail2Ban on Fedora 42

Server security is a critical aspect of system administration that cannot be overlooked in today’s increasingly hostile digital landscape. With the rise in automated attacks targeting servers worldwide, implementing robust security measures has become essential rather than optional. Fail2Ban stands out as a powerful intrusion prevention tool that effectively mitigates brute-force attacks by monitoring system logs and automatically blocking suspicious IP addresses. This comprehensive guide will walk you through the complete process of installing and configuring Fail2Ban on Fedora 42, providing you with the knowledge to significantly enhance your server’s security posture.

Understanding Fail2Ban and Its Benefits

Fail2Ban is an open-source security framework written in Python that actively monitors server logs for suspicious activities. When it detects patterns matching potential intrusion attempts, it automatically creates firewall rules to block the offending IP addresses for a specified period. This dynamic approach to security makes it particularly effective against brute-force attacks, where attackers attempt to gain unauthorized access through repeated login attempts.

The architecture of Fail2Ban consists of a server daemon that runs in the background and client components for configuration and monitoring. On Fedora 42, it integrates seamlessly with FirewallD, the default firewall management tool, creating a robust security layer. This integration allows Fail2Ban to dynamically add and remove blocking rules without requiring manual firewall configuration.

Implementing Fail2Ban on your Fedora 42 server offers several significant benefits:

• Automated protection against brute-force attacks targeting SSH, web services, and other exposed services
• Reduced server load by blocking malicious traffic early in the connection process
• Detailed logging of intrusion attempts for security auditing purposes
• Customizable rules that can be tailored to your specific security requirements
• Real-time protection that adapts to emerging threats without administrator intervention

Real-world scenarios where Fail2Ban proves invaluable include protecting SSH servers from dictionary attacks, securing web applications from credential stuffing attempts, and preventing email server abuse. By implementing Fail2Ban, system administrators can dramatically reduce the attack surface of their servers while maintaining comprehensive logs of attempted intrusions.

Prerequisites

Before proceeding with the installation of Fail2Ban on your Fedora 42 system, ensure you meet the following requirements:

• A functioning Fedora 42 server with network connectivity
• Root or sudo privileges to execute administrative commands
• Basic understanding of Linux command-line operations
• FirewallD properly configured and running (the default on Fedora 42)
• Access to terminal either directly or via SSH

It’s also highly recommended to perform a system backup before making significant security changes. This ensures you can restore your system to a known good state if any issues arise during the installation or configuration process.

The hardware requirements for Fail2Ban are minimal, as it has a small footprint and consumes very little system resources. Any system capable of running Fedora 42 should be more than adequate for running Fail2Ban efficiently.

Step 1: Updating Your Fedora 42 System

Before installing any new software, it’s essential to ensure your system is fully updated with the latest security patches and package versions. This reduces the risk of compatibility issues and ensures you’re working with the most secure foundation possible.

Open your terminal and execute the following command to update all installed packages:

sudo dnf update -y

The -y flag automatically answers “yes” to any prompts, streamlining the update process. The system will fetch package information from the repositories, calculate dependencies, and install all available updates.

Wait for the update process to complete, which may take several minutes depending on your internet connection speed and the number of updates available. You’ll see output similar to:

Fedora 42 - x86_64 - Updates
Dependencies resolved.
...
Complete!

If the update includes kernel packages, consider rebooting your system to ensure all updates are properly applied:

sudo systemctl reboot

Once your system is updated, you’re ready to proceed with the installation of Fail2Ban.

Step 2: Installing Fail2Ban

Fail2Ban is available in the default Fedora repositories, making installation straightforward using the DNF package manager. Execute the following command to install Fail2Ban and its dependencies:

sudo dnf install fail2ban -y

This command will install the main fail2ban package along with fail2ban-server (the core component), fail2ban-firewalld (for FirewallD integration), and fail2ban-sendmail (for email notifications). If you don’t need email notifications, you can install just the essential components.

Once the installation completes, you can verify it was successful by checking the installed version:

fail2ban-client --version

The output should display the version number of the installed Fail2Ban package, confirming that the installation was successful.

The installation process places configuration files in the /etc/fail2ban/ directory and creates the necessary systemd service files for managing the Fail2Ban service. These files include:

• /etc/fail2ban/fail2ban.conf – Main configuration file
• /etc/fail2ban/jail.conf – Default jail configurations
• /etc/fail2ban/action.d/ – Directory containing action definitions
• /etc/fail2ban/filter.d/ – Directory containing filter patterns

Understanding the location and purpose of these files will be valuable as we proceed to the configuration phase.

Step 3: Understanding Fail2Ban Configuration Files

Fail2Ban’s configuration follows a hierarchical structure that allows for flexible customization while preserving default settings. The main configuration is spread across several files and directories within the /etc/fail2ban/ directory.

The primary configuration files include:

• fail2ban.conf: Contains global settings for the Fail2Ban server process
• jail.conf: Defines the default jails and their settings
• filter.d/: Directory containing filter definitions that determine what patterns to look for in log files
• action.d/: Directory containing action definitions that specify what to do when a rule is triggered

It’s important to note that you should never directly edit the *.conf files as they may be overwritten during system updates. Instead, Fail2Ban follows the convention of using *.local files that override the settings in the corresponding *.conf files.

For customizing jail configurations, you can create either:

• /etc/fail2ban/jail.local – A single file containing all your custom jail settings
• Files in the /etc/fail2ban/jail.d/ directory with .local or .conf extensions

The settings in these files override the defaults in the following order of precedence (highest to lowest):

1. /etc/fail2ban/jail.d/*.local
2. /etc/fail2ban/jail.local
3. /etc/fail2ban/jail.d/*.conf
4. /etc/fail2ban/jail.conf

This inheritance system allows you to customize only what you need while inheriting all other default settings, making maintenance much more manageable.

Step 4: Basic Fail2Ban Configuration

Now that we understand the configuration structure, let’s create a basic configuration that protects your SSH service while providing reasonable defaults for other services.

Create a new file called jail.local in the /etc/fail2ban/ directory:

sudo nano /etc/fail2ban/jail.local

Add the following basic configuration:

[DEFAULT]
# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
# will not ban a host which matches an address in this list.
ignoreip = 127.0.0.1/8 ::1

# "bantime" is the number of seconds that a host is banned
bantime = 3600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 600
maxretry = 3

# "backend" specifies the backend used to get files modification.
backend = systemd

# Ban action using FirewallD
banaction = firewallcmd-ipset

# Enable email notifications with logs and whois information
#sender = fail2ban@example.com
#destemail = root@example.com
#action = %(action_mwl)s

[sshd]
enabled = true

Save and close the file (in nano, press Ctrl+X, then Y, then Enter).

This configuration defines several important parameters:

• ignoreip: IP addresses that should never be banned, typically including localhost
• bantime: Duration in seconds for which an IP will be banned (3600 = 1 hour)
• findtime: Time window in seconds during which Fail2Ban counts failed attempts (600 = 10 minutes)
• maxretry: Number of failures allowed within the findtime before an IP is banned (3 attempts)
• backend: System used to monitor log files (systemd is appropriate for Fedora 42)
• banaction: Method used to ban IPs (firewallcmd-ipset for FirewallD integration)
• [sshd]: A specific jail for the SSH service, which is enabled by default

The commented email notification lines can be uncommented and configured if you want to receive alerts when Fail2Ban takes action. This requires a properly configured mail transfer agent like Postfix or Sendmail on your system.

Step 5: Configuring SSH Protection

SSH is one of the most commonly targeted services for brute-force attacks due to its critical role in providing remote access to servers. Let’s enhance the SSH-specific configuration to provide robust protection.

Create a dedicated configuration file for the SSH jail:

sudo nano /etc/fail2ban/jail.d/sshd.local

Add the following content to the file:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/secure
maxretry = 3
bantime = 3600
findtime = 600

Save and close the file.

This configuration:

• Explicitly enables SSH protection
• Sets the port to monitor (the default SSH port)
• Specifies the filter to use (predefined SSH filter)
• Defines the log file to monitor (may vary depending on your system)
• Sets the maximum number of retries, ban time, and finding window specifically for SSH

For added security, consider increasing the bantime for SSH to a longer period, such as 86400 (24 hours), especially if your server is exposed to the internet. You can also decrease the maxretry value to 2 for even stricter protection against brute-force attempts.

Step 6: Starting and Enabling Fail2Ban Service

With the configuration in place, it’s time to start the Fail2Ban service and configure it to launch automatically at system startup.

Start the Fail2Ban service with the following command:

sudo systemctl start fail2ban

To ensure Fail2Ban starts automatically whenever your system boots, enable it with:

sudo systemctl enable fail2ban

You should see output similar to:

Created symlink /etc/systemd/system/multi-user.target.wants/fail2ban.service → /usr/lib/systemd/system/fail2ban.service.

This confirms that the service is configured to start automatically at boot time.

To verify that Fail2Ban is running correctly, check its status:

sudo systemctl status fail2ban

You should see output indicating that the service is active (running), with no errors:

● fail2ban.service - Fail2Ban Service
     Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled; vendor preset: disabled)
     Active: active (running) since Thu 2025-05-01 07:15:20 WIB; 30s ago
       Docs: man:fail2ban(1)
   Main PID: 12345 (fail2ban-server)
      Tasks: 5 (limit: 9497)
     Memory: 11.4M
        CPU: 257ms
     CGroup: /system.slice/fail2ban.service
             └─12345 /usr/bin/python3 -s /usr/bin/fail2ban-server -xf start

If the service fails to start, check the system journal for error messages:

sudo journalctl -u fail2ban.service --since today

This will help identify any configuration issues that need to be addressed.

Step 7: Integration with FirewallD

Fail2Ban works by implementing firewall rules to block malicious IP addresses. On Fedora 42, it integrates seamlessly with FirewallD, which is the default firewall management tool.

The fail2ban-firewalld package, which was installed as a dependency, has already configured Fail2Ban to use FirewallD for blocking IPs. This is implemented through the firewallcmd-ipset action, which was specified in our configuration.

To verify that Fail2Ban is properly integrated with FirewallD, check the status of the Fail2Ban jails:

sudo fail2ban-client status

This should show a list of the active jails:

Status
|- Number of jail:      1
`- Jail list:           sshd

You can also check the FirewallD configuration to see the Fail2Ban-specific elements:

sudo firewall-cmd --list-all

For optimal performance, ensure that FirewallD is configured to allow legitimate traffic to your services. You can add services to the allowed list with:

sudo firewall-cmd --permanent --add-service=<service-name>
sudo firewall-cmd --reload

Replace <service-name> with services like http, https, or any other services your server provides.

Monitoring and Managing Fail2Ban

Once Fail2Ban is up and running, it’s important to know how to monitor its activity and manage banned IP addresses.

To view the status of a specific jail (such as SSH), use:

sudo fail2ban-client status sshd

This will show information about the jail, including:

Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

To manually ban an IP address:

sudo fail2ban-client set sshd banip <IP_ADDRESS>

To manually unban an IP address:

sudo fail2ban-client set sshd unbanip <IP_ADDRESS>

Replace <IP_ADDRESS> with the actual IP address you want to ban or unban.

You can also analyze the Fail2Ban log to see recent activity:

sudo tail -f /var/log/fail2ban.log

For a summary of banned IPs grouped by service:

sudo grep "Ban " /var/log/fail2ban.log | awk -F[\ \:] '{print $19,$17}' | sort | uniq -c | sort -n

This command shows which services each IP address has been trying to access or exploit.

Configuring Additional Service Protections

While SSH protection is crucial, Fail2Ban can protect various other services running on your server. Let’s configure protection for some common services.

Protecting Web Servers (Apache/Nginx)

To protect Apache from authentication failures, create a file at /etc/fail2ban/jail.d/apache-auth.local:

sudo nano /etc/fail2ban/jail.d/apache-auth.local

Add the following content:

[apache-auth]
enabled = true
port     = http,https
filter   = apache-auth
logpath  = /var/log/httpd/error_log
maxretry = 3

For Nginx, create /etc/fail2ban/jail.d/nginx-auth.local:

[nginx-auth]
enabled = true
port     = http,https
filter   = nginx-auth
logpath  = /var/log/nginx/error.log
maxretry = 3

Protecting Mail Services

To protect Postfix from authentication failures:

sudo nano /etc/fail2ban/jail.d/postfix.local

Add:

[postfix]
enabled  = true
port     = smtp,465,submission
filter   = postfix
logpath  = /var/log/maillog
maxretry = 3

After adding new jail configurations, restart Fail2Ban to apply the changes:

sudo systemctl restart fail2ban

Verify that the new jails are active:

sudo fail2ban-client status

This should now show the additional jails in the list.

Troubleshooting Common Issues

Even with careful configuration, you might encounter issues with Fail2Ban. Here are solutions to common problems:

Fail2Ban Service Fails to Start

If the service doesn’t start, check the logs:

sudo journalctl -u fail2ban.service -n 50

Common issues include:

• Syntax errors in configuration files
• Incorrect paths to log files
• Permissions issues

Correct the identified issues and try restarting the service.

False Positives (Legitimate Users Getting Banned)

If legitimate users are being banned, increase the maxretry value or add their IP addresses to the ignoreip list:

sudo nano /etc/fail2ban/jail.local

Update the ignoreip line to include their IPs:

ignoreip = 127.0.0.1/8 ::1 192.168.1.100

Then restart Fail2Ban:

sudo systemctl restart fail2ban

Fail2Ban Not Banning Attackers

If attackers aren’t being banned, verify:

1. The correct log file is being monitored
2. The regex patterns in the filter correctly match attack patterns
3. FirewallD is running and properly integrated

Check a specific jail’s filter status:

sudo fail2ban-client get sshd failregex

This will show the regex patterns being used to identify attacks.

Advanced Fail2Ban Usage

For advanced users, Fail2Ban offers powerful customization options.

Creating Custom Filters

To create a custom filter for a specific application, create a new file in /etc/fail2ban/filter.d/:

sudo nano /etc/fail2ban/filter.d/myapp.conf

Add content that defines the failregex pattern:

[Definition]
failregex = ^%(__prefix_line)sAuthentication failure for .* from <HOST>
            ^%(__prefix_line)sInvalid login attempt from <HOST>
ignoreregex =

Then create a corresponding jail:

sudo nano /etc/fail2ban/jail.d/myapp.local

[myapp]
enabled = true
port    = http,https
filter  = myapp
logpath = /var/log/myapp/access.log
maxretry = 3

Customizing Actions

To create a custom action, create a new file in /etc/fail2ban/action.d/:

sudo nano /etc/fail2ban/action.d/custom-action.conf

[Definition]
actionstart = 
actionstop = 
actioncheck = 
actionban = /usr/local/bin/custom-ban-script.sh <ip>
actionunban = /usr/local/bin/custom-unban-script.sh <ip>

Then update your jail to use this action:

[sshd]
enabled = true
action = custom-action

This allows integration with custom scripts, notification systems, or third-party security tools.

Congratulations! You have successfully installed Fail2Ban. Thanks for using this tutorial for installing the Fail2Ban on the Fedora 42 Linux system. For additional help or useful information, we recommend you check the official Fail2Ban website.