SSH bruteforce protection

Description

In this guide, you will learn how to install and configure Fail2Ban to protect your VPS against repeated failed authentication attempts and other malicious activity.

We are using the Linux operating system Ubuntu 24.04.

What you’ll learn
  • Install and enable Fail2Ban.
  • Configure ban times and retry limits.
  • Test the Fail2Ban configuration.
  • Configure the Fail2Ban log level.
Step by step guide
Bash
# Step 1: Install and enable Fail2Ban
apt install fail2ban -y
systemctl enable --now fail2ban # autostart

# Step 2: Configure Fail2Ban
# .local is used by default. .conf is only an example file.
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local 
# in jail.local use this configurations: 
# ignoreip = 127.0.0.1/8 ::1"
# in jail.local use this configurations: bantime  = 1h"
# findtime = 10m"
# maxretry = 3"
# bantime.increment = true"
# bantime.maxtime = 604800"
# bantime.factor = 1"

# Check if the sshd-jail is enabled in the .local file: 
#[sshd]
#enabled = true

# Step 3: Reload Fail2Ban
systemctl reload fail2ban
systemctl restart fail2ban

# Step 4: Test if Fail2Ban is working correctly
sudo fail2ban-client -t

# Step 5: Adjust the Fail2Ban log level
cd /etc/fail2ban/
cp fail2ban.conf fail2ban.local
nano fail2ban.local # --> set logLevel to WARNING
systemctl reload fail2ban
systemctl restart fail2ban
Next steps
Next →