In this tutorial, we will show you how to install Fail2ban on Ubuntu 20.04 LTS. For those of you who didn’t know, Fail2Ban is a utility that is used to detect and prevent brute force intrusion. By scanning logs for certain actions, such as repeated failed login attempts, Fail2Ban is able to alter firewall configurations to halt further events.
This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of Fail2ban on an Ubuntu 20.04 Focal Fossa server. You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian-based distribution like Linux Mint.
Prerequisites
- A server running one of the following operating systems: Ubuntu 20.04, 18.04, and any other Debian-based distribution like Linux Mint or elementary OS.
- It’s recommended that you use a fresh OS install to prevent any potential issues.
- A
non-root sudo useror access to theroot user. We recommend acting as anon-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.
Install Fail2ban on Ubuntu 20.04 LTS Focal Fossa
Step 1. First, make sure that all your system packages are up-to-date by running the following apt commands in the terminal.
sudo apt update sudo apt upgrade
Step 2. Installing Fail2ban on Ubuntu 20.04.
Run the following command to install Fail2ban:
sudo apt install fail2ban
Once done, the Fail2ban service will start automatically. You can verify Fail2ban using the following command:
sudo systemctl status fail2ban
Step 3. Fail2ban Configuration.
The default Fail2ban installation comes with two configuration files, /etc/fail2ban/jail.conf and /etc/fail2ban/jail.d/defaults-debian.conf You can read more about jails here. To start configuring the Fail2ban server open, the jail.local file with nano editor :
[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1/8 ::1 123.123.123.123 192.168.1.0/24
# "bantime" is the number of seconds that a host is banned.
bantime = 2d
# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 600
maxretry = 5
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = admin@idroot.us
sender = root@idroot.us
Restart the Fail2ban service for changes to take effect:
sudo systemctl restart fail2ban
Congratulations! You have successfully installed Fail2Ban. Thanks for using this tutorial for installing Fail2Ban on the Linux Ubuntu system. For additional help or useful information, we recommend you check the official Fail2Ban website.
