What Is Fail2Ban?
Fail2Ban is a security tool designed to protect Linux servers from brute-force attacks and other unauthorized access attempts. It continuously monitors system log files and automatically blocks IP addresses that generate suspicious activity, such as repeated failed login attempts.
Fail2Ban is commonly used to secure:
- SSH servers
- Web servers
- FTP services
- Mail servers
- Control panels
- Custom applications
When malicious activity exceeds predefined thresholds, Fail2Ban automatically creates temporary firewall rules that block the offending IP address for a specified period.
This automated response helps reduce the risk of successful brute-force attacks while minimizing administrative effort.
Why Use Fail2Ban on AlmaLinux?
Even a newly deployed server will often receive automated login attempts within minutes of being connected to the internet.
Common threats include:
WordPress Web Hosting
Starting From $3.99/Monthly
- SSH brute-force attacks
- Credential stuffing attempts
- Automated vulnerability scans
- Password guessing attacks
- Bot-driven login attempts
Fail2Ban provides an additional layer of protection by detecting these behaviors and responding automatically.
Benefits include:
- Reduced attack surface
- Automated threat mitigation
- Flexible ban policies
- Integration with Firewalld
- Lightweight resource usage
Prerequisites
Before installing Fail2Ban, verify the following:
Operating System
Supported versions include:
- AlmaLinux 8
- AlmaLinux 9
Required Access
You will need:
- Root access
or
Cheap VPS Server
Starting From $2.99/Monthly
- A user account with sudo privileges
Firewall Availability
Firewalld should be installed and operational before integrating Fail2Ban.
Step 1: Verify Firewalld Status
AlmaLinux includes Firewalld by default.
Check whether it is running:
sudo systemctl status firewalld
If Firewalld is not active, start it:
sudo systemctl start firewalld
Enable it during boot:
sudo systemctl enable firewalld
Verify status again:
Windows VPS Hosting
Remote Access & Full Admin
sudo systemctl status firewalld
You should see:
Active: active (running)
View Current Firewall Configuration
Display active Firewalld settings:
sudo firewall-cmd --list-all
This provides information about:
- Active zones
- Open services
- Open ports
- Network interfaces
- Existing rules
Step 2: Update AlmaLinux
Before installing new packages, update the system:
sudo dnf update -y
Keeping the operating system updated helps ensure compatibility and security.
Step 3: Install the EPEL Repository
Fail2Ban packages are provided through the Extra Packages for Enterprise Linux (EPEL) repository.
Install EPEL:
sudo dnf install epel-release -y
Once installed, additional community-supported packages become available.
Step 4: Install Fail2Ban
Install Fail2Ban and Firewalld integration:
sudo dnf install fail2ban fail2ban-firewalld -y
The installation process automatically installs required dependencies.
Start Fail2Ban
Start the service:
sudo systemctl start fail2ban
Enable automatic startup:
sudo systemctl enable fail2ban
Verify service status:
sudo systemctl status fail2ban
Expected output includes:
Active: active (running)
If the service starts successfully, Fail2Ban is ready for configuration.
Step 5: Configure Fail2Ban
The primary Fail2Ban configuration file is:
/etc/fail2ban/jail.conf
However, this file should not be modified directly because package updates may overwrite it.
Instead, create a custom configuration file:
sudo touch /etc/fail2ban/jail.local
Open the file:
sudo nano /etc/fail2ban/jail.local
Add the following configuration:
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
bantime = 1h
findtime = 1h
maxretry = 5
Save the file and exit the editor.
Understanding Important Fail2Ban Parameters
ignoreip
The ignoreip setting defines IP addresses that should never be banned.
Example:
ignoreip = 127.0.0.1/8 ::1
This excludes localhost addresses from Fail2Ban actions.
Additional trusted IPs can be added if required.
bantime
The bantime parameter defines how long an IP remains blocked.
Example:
bantime = 1h
In this case, banned IP addresses remain blocked for one hour.
findtime
The findtime value defines the monitoring window.
Example:
findtime = 1h
Fail2Ban counts failed attempts that occur during this period.
maxretry
The maxretry parameter specifies how many failures are allowed before a ban occurs.
Example:
maxretry = 5
An IP generating five failed attempts within one hour will be banned.
Step 6: Enable Firewalld Integration
Fail2Ban traditionally uses iptables, but AlmaLinux environments commonly use Firewalld.
Activate Firewalld integration:
sudo mv /etc/fail2ban/jail.d/00-firewalld.conf \
/etc/fail2ban/jail.d/00-firewalld.local
This enables Fail2Ban to communicate directly with Firewalld.
Restart Fail2Ban:
sudo systemctl restart fail2ban
Step 7: Protect SSH with Fail2Ban
By default, Fail2Ban does not actively protect services until a jail is configured.
Create an SSH jail configuration:
sudo nano /etc/fail2ban/jail.d/sshd.local
Add:
[sshd]
enabled = true
bantime = 3h
maxretry = 3
This configuration:
- Enables SSH protection
- Bans attackers for three hours
- Allows three failed login attempts
Save the file and restart Fail2Ban:
sudo systemctl restart fail2ban
Verify Active Jails
Display active jails:
sudo fail2ban-client status
Example output:
Status
|- Number of jail: 1
`- Jail list: sshd
View SSH Jail Statistics
Check SSH protection details:
sudo fail2ban-client status sshd
Example output:
Currently banned: 0
Total banned: 0
Banned IP list:
This command helps monitor ongoing activity and banned IP addresses.
Checking Jail Configuration Values
To confirm the configured retry limit:
sudo fail2ban-client get sshd maxretry
Expected output:
3
The displayed value should match your SSH jail configuration.
Testing Fail2Ban
Testing ensures that Fail2Ban is functioning correctly.
From another system, attempt several failed SSH logins:
ssh username@server-ip
Enter an incorrect password repeatedly.
After exceeding the configured limit, Fail2Ban should block the source IP address.
Check the jail status:
sudo fail2ban-client status sshd
Example:
Currently banned: 1
Banned IP list: 192.168.1.50
This confirms that the offending address has been blocked successfully.
Unbanning an IP Address
To manually remove a banned address:
sudo fail2ban-client unban 192.168.1.50
Verify the removal:
sudo fail2ban-client status sshd
The IP should no longer appear in the banned list.
Viewing Fail2Ban Logs
Fail2Ban activity can be reviewed through system logs.
View recent events:
sudo journalctl -u fail2ban
Or inspect the log file:
sudo tail -f /var/log/fail2ban.log
Logs help identify:
- Banned IP addresses
- Triggered jails
- Configuration issues
- Service errors
Best Practices for Fail2Ban
For improved server security:
Use SSH Keys
Disable password authentication whenever possible and use key-based authentication.
Adjust Retry Limits
Lower values reduce brute-force opportunities.
Example:
maxretry = 3
Increase Ban Duration
Longer bans reduce repeated attacks.
Example:
bantime = 24h
Whitelist Trusted Addresses
Prevent accidental lockouts by adding administrative IP addresses to:
ignoreip
Monitor Logs Regularly
Review Fail2Ban activity periodically to identify attack trends and verify protection effectiveness.
Removing Fail2Ban
If Fail2Ban is no longer required, remove it using:
sudo dnf remove fail2ban -y
After removal, delete configuration files:
sudo rm -rf /etc/fail2ban
Only remove configuration files if you no longer need any Fail2Ban settings or backups.
Strengthening AlmaLinux Server Security with Fail2Ban
Fail2Ban provides a simple yet highly effective way to protect AlmaLinux servers from brute-force attacks and unauthorized login attempts. By monitoring log files, automatically banning suspicious IP addresses, and integrating with Firewalld, it adds an important layer of security to internet-facing services. Properly configured SSH protection, reasonable ban policies, and ongoing monitoring can significantly reduce the risk of unauthorized access while maintaining reliable server operations.
