How To Install Fail2Ban on Ubuntu 22.04 LTS

In this tutorial, we will show you how to install Fail2Ban on Ubuntu 22.04 LTS. For those of you who didn’t know, Fail2ban works to prevent malicious and brute force login attacks and can be used to monitor protocols such as HTTP, SSH and FTP. Fail2ban also supports multiple firewall backend such as iptables, ufw, and firewalld. Also allows you to set up an email notification for every blocked login attempt.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Fail2Ban on Ubuntu 22.04 (Jammy Jellyfish). You can follow the same instructions for Ubuntu 22.04 and any other Debian-based distribution like Linux Mint, Elementary OS, Pop!_OS, and more as well.

Prerequisites

• A server running one of the following operating systems: Ubuntu 22.04, 20.04, and any other Debian-based distribution like Linux Mint.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Fail2Ban on Ubuntu 22.04 LTS Jammy Jellyfish

Step 1. First, make sure that all your system packages are up-to-date by running the following apt commands in the terminal.

sudo apt update
sudo apt upgrade

Step 2. Installing Fail2Ban on Ubuntu 22.04.

By default, the Fail2Ban is available on Ubuntu 22.04 base repository. Now run the following command below to install the latest version of Fail2Ban to your Ubuntu system:

sudo apt install fail2ban

After successfully installation, enable Fail2Ban (to start automatically upon system boot), start, and verify the status using the commands below:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban
sudo systemctl status fail2ban

Step 3. Configuration Fail2ban.

Now it’s time to set up and configure the Fail2ban:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Add the following file:

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1/8 ::1 123.123.123.123 192.168.1.0/24

# "bantime" is the number of seconds that a host is banned.
bantime = 1d

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 50
maxretry = 5

# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = admin@idroot.us
sender = root@idroot.us

Save and close the file, then restart the Fail2ban service and apply new changes to the jail.local configuration:

sudo systemctl restart fail2ban

You can read more about jails here.

Step 4. Monitoring Fail2Ban Logs.

Reviewing logs is essential, and the fail2ban log is in its default path /var/log/fail2ban.log. If you have a server receiving decent traffic, an excellent command to watch live to see any issues and keep an eye on it as you work on other servers is to use the tail -f command:

tail -f /var/log/fail2ban.log

Congratulations! You have successfully installed Fail2Ban. Thanks for using this tutorial for installing the Fail2Ban on Ubuntu 22.04 LTS Jammy Jellyfish system. For additional help or useful information, we recommend you check the official Fail2Ban website.