How To Install Fail2ban on Rocky Linux 9

In this tutorial, we will show you how to install Fail2ban on Rocky Linux 9. For those of you who didn’t know, Fail2ban is software to prevent brute-force attacks. This software, written in Python, enables it to run on POSIX Fail2ban systems that have a locally installed user interface or firewall. This service will help prevent unwanted logins by banning nefarious IP addresses from gaining access to your server.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Fail2ban on Rocky Linux. 9.

Prerequisites

• A server running one of the following operating systems: Rocky Linux 9.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Fail2ban on Rocky Linux 9

Step 1. The first step is to update your system to the latest version of the package list. To do so, run the following commands:

sudo dnf check-update
sudo dnf install dnf-utils
sudo dnf install epel-release

Step 2. Installing Fail2ban on Rocky Linux 9.

By default, Fail2ban is not available on Rocky Linux 9 base repository. Now run the following command below to install the latest version of Fail2ban to your Rocky Linux system:

sudo dnf install fail2ban fail2ban-firewalld

When the installation is complete, start the Fail2ban service using the command below:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

Step 3. Configure Fail2Ban.

Once Fail2Ban is installed, you will need to configure it to work with your server. To do this, you will need to edit the /etc/fail2ban/jail.conf file:

sudo nano /etc/fail2ban/jail.conf

Under the “[DEFAULT]” section, check the configurations below:

[DEFAULT]
....
bantime = 2h
findtime = 2h
maxretry = 6

Let us define the attributes:

• The bantime directive specifies the duration of time that a client will be banned following failed authentication attempts.
• The findtime directive is the duration or period within which fail2ban will consider when considering repeated incorrect password attempts.
• The maxretry parameter is the maximum number of incorrect password attempts before the remote client is blocked from accessing the server. Here, the client will be locked out after 5 authentication failures.

When you are finished, save the file and exit the text editor and restart the Fail2ban service to apply new configurations:

sudo systemctl restart fail2ban

Next, we need to allow fail2ban to work with firewalld (instead of iptables) with the command:

sudo mv /etc/fail2ban/jail.d/00-firewalld.conf /etc/fail2ban/jail.d/00-firewalld.local

Step 4. How to Use Fail2ban on Rocky Linux 9.

First, check the status of Fail2Ban, run the following command:

sudo fail2ban-client status

• View Banned IP Addresses

To view the list of banned IP addresses, run the following command:

sudo fail2ban-client status [jail name]

Replace [jail name] with the name of the jail, you want to view. For example, to view the banned IP addresses for the sshd jail, you would run the following command:

sudo fail2ban-client status sshd

• Unban an IP Address

To unban an IP address, run the following command:

sudo fail2ban-client set [jail name] unbanip [IP address]

Replace [jail name] with the name of the jail and [IP address] with the IP address, you want to unban. For example, to unban the IP address 192.168.77.20 from the sshd jail, you would run the following command:

sudo fail2ban-client set sshd unbanip 192.168.77.20

Congratulations! You have successfully installed Fail2ban. Thanks for using this tutorial for installing the Fail2ban on your Rocky Linux 9 system. For additional help or useful information, we recommend you check the official Fail2ban website.