Fail2ban
fail2ban scans log files (e.g. /var/log/auth.log) and bans IPs that show the malicious signs like too many authentication attempts, scanning for vulnerabilities, etc.
Install
sudo apt update && sudo apt install fail2ban -yVerify fail2ban active.
sudo fail2ban-client status
sudo fail2ban-client status sshdConfigure
Create a file /etc/fail2ban/jail.local to override the default settings like this,
sudo nano /etc/fail2ban/jail.local/etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 192.168.0.0/16
bantime = 1d
maxretry = 5
findtime = 1d
bantime.increment = true
bantime.factor = 2
bantime.maxtime = 16d
[sshd]
enabled = true
backend = systemd
port = sshAfter file save, reload the settings
sudo fail2ban-client reloadManagement
How is fail2ban doing
sudo fail2ban-client status
sudo fail2ban-client status sshdYou can see the log from the sshd service as a reference (started from the most recent events)
sudo journalctl -ru ssh.service | grep 'Failed password' | lessUnban an address
Unban one IP address
sudo fail2ban-client set sshd unbanip 198.51.100.24Unban all
sudo fail2ban-client unban --allSources
Last updated on