How To Install Fail2Ban on openSUSE

In this tutorial, we will show you how to install Fail2Ban on openSUSE. Fail2Ban is open-source software that scans log files for potential security breaches and bans IP addresses that cause too many password failures. It updates firewall rules to reject the IP address, effectively protecting your server from brute force, dictionary, DDoS, and DOS attacks. Fail2Ban works by reading SSH, ProFTP, Apache logs, and more, using iptables profiles to block brute-force attempts.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Fail2Ban on openSUSE.

Prerequisites

• A server running one of the following operating systems: openSUSE.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• You will need access to the terminal to execute commands. openSUSE provides the Terminal application for this purpose. It can be found in your Applications menu.
• You’ll need an active internet connection to download Fail2Ban and its dependencies.
• You’ll need administrative (root) access or a user account with sudo privileges.

Install Fail2Ban on openSUSE

Step 1. Starting with an updated system is a best practice in Linux administration. It ensures that all software packages are up-to-date, minimizing potential security vulnerabilities. To update your openSUSE system, open the terminal and execute the following commands:

sudo zypper refresh
sudo zypper update

Step 2. Installing Fail2Ban on openSUSE.

Before we dive into the configuration details, let’s first install Fail2Ban on your openSUSE system. To do this, you’ll need to use the zypper package manager, which is the default package manager for openSUSE. Run the following command to install Fail2Ban:

sudo zypper in fail2ban

Step 3. Configuring Fail2Ban.

Once Fail2Ban is installed, the next step is to configure it. Fail2Ban’s configuration files are located in the /etc/fail2ban/ directory. The main configuration file is jail.conf, which contains a set of pre-defined filters. However, it’s not advisable to edit this file directly, as it may be overwritten during updates. Instead, make a copy of this file named jail.local and make your changes there.

To create a copy of jail.conf and name it jail.local, use the following command:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Now, you can open jail.local in a text editor to make your changes. This file contains several sections, each corresponding to a different service that Fail2Ban can monitor, such as SSH or Apache. Each section contains settings that define how Fail2Ban should behave when it detects a potential attack on that service.

Fail2Ban’s configuration files are written in INI format, with each section representing a “jail” for a specific service. Each jail has several options that control Fail2Ban’s behavior:

• enabled: Whether the jail is active. Set this to true to activate the jail.
• filter: The name of the filter to use. This corresponds to a file in the /etc/fail2ban/filter.d/ directory that defines the patterns to look for in the log files.
• logpath: The path to the log file to monitor.
• maxretry: The number of failures to allow from a single IP address before it is banned.
• bantime: The length of time (in seconds) to ban an IP address after it exceeds the maxretry limit.

Here’s an example of what a jail configuration might look like:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
findtime = 600
bantime = 1800

Save the file and exit, then restart the Fail2Ban service:

sudo systemctl restart fail2ban

Then, make sure everything is OK with the service:

sudo systemctl status fail2ban

In this example, the sshd jail is enabled, monitoring the /var/log/auth.log file for patterns defined in the sshd filter. If an IP address fails to authenticate more than three times in a ten-minute period (findtime), it will be banned for half an hour (bantime).

Step 4. Testing Fail2Ban.

After configuring Fail2Ban, it’s important to test it to ensure it’s working correctly. One way to do this is to intentionally generate failed login attempts and then check the Fail2Ban log file to see if the offending IP address was banned. The Fail2Ban log file is located at /var/log/fail2ban.log and contains entries for each action taken by Fail2Ban.

Congratulations! You have successfully installed Fail2Ban. Thanks for using this tutorial for installing the Fail2Ban on your openSUSE system. For additional or useful information, we recommend you check the official Fail2Ban website.