Install and Configure Intrusion Detection (Fail2Ban)

Fail2Ban is a security tool that protects your Linux server from brute-force attacks by automatically blocking IP addresses after multiple failed login attempts. This prevents attackers from repeatedly trying different passwords to gain access.

How to Install and Configure Fail2Ban

1. Install Fail2Ban:

   sudo apt install fail2ban -y

   (For CentOS/RHEL, use sudo yum install fail2ban -y)

2. Edit the Fail2Ban configuration file:

   sudo nano /etc/fail2ban/jail.conf

   Look for the [sshd] section and modify the settings:

   [sshd]
   enabled = true
   maxretry = 5
   bantime = 3600

   • enabled = true → Activates Fail2Ban protection for SSH.

   • maxretry = 5 → Blocks an IP after 5 failed login attempts.

   • bantime = 3600 → Blocks the offending IP for one hour (3600 seconds).

3. Save the file and restart Fail2Ban:

   sudo systemctl restart fail2ban

4. Check Fail2Ban status and active bans:

   sudo fail2ban-client status sshd

   This will show currently banned IPs and active protection rules.

Best Practices for Fail2Ban:

✅ Adjust ban time and retry limits to fit your security needs (e.g., longer bans for persistent attackers).
✅ Monitor logs with sudo fail2ban-client status sshd to track failed login attempts.
✅ Enable email notifications to get alerts when an IP is blocked.

By setting up Fail2Ban, you automatically block malicious login attempts, protecting your server from unauthorized access attempts and brute-force attacks.