What Is Fail2Ban?
Fail2Ban is a Sicherheit tool designed to protect Linux-Server from brute-force attacks and other unauthorized access attempts. It continuously monitors system log files and automatically blocks IP addresses that generate suspicious activity, such as repeated failed login attempts.
Fail2Ban is commonly used to secure:
- SSH servers
- Webserver
- FTP services
- Mailserver
- Bedienfelder
- Benutzerdefinierte Anwendungen
When malicious activity exceeds predefined thresholds, Fail2Ban automatically creates temporary firewall rules that block the offending IP address for a specified period.
This automated response helps reduce the risk of successful brute-force attacks while minimizing administrative effort.
Why Use Fail2Ban on AlmaLinux?
Even a newly deployed server will often receive automated login attempts within minutes of being connected to the internet.
Common threats include:
WordPress-Webhosting
Ab 3,99 $/Monat
- SSH brute-force attacks
- Credential stuffing attempts
- Automated vulnerability scans
- Password guessing attacks
- Bot-driven login attempts
Fail2Ban provides an additional layer of protection by detecting these behaviors and responding automatically.
Zu den Vorteilen gehören::
- Reduzierte Angriffsfläche
- Automated threat mitigation
- Flexible ban policies
- Integration with Firewalld
- Lightweight resource usage
Voraussetzungen
Before installing Fail2Ban, Überprüfen Sie Folgendes:
Betriebssystem
Supported versions include:
- AlmaLinux 8
- AlmaLinux 9
Required Access
Sie werden brauchen:
- Root-Zugriff
oder
Günstiger VPS-Server
Ab 2,99 $/Monat
- Ein Benutzerkonto mit Sudo-Berechtigungen
Firewall Availability
Firewalld should be installed and operational before integrating Fail2Ban.
Schritt 1: Verify Firewalld Status
AlmaLinux includes Firewalld by default.
Check whether it is running:
sudo systemctl status firewalld
If Firewalld is not active, start it:
sudo systemctl start firewalld
Enable it during boot:
sudo systemctl enable firewalld
Verify status again:
Windows VPS-Hosting
Fernzugriff und vollständige Verwaltung
sudo systemctl status firewalld
You should see:
Active: active (running)
View Current Firewall Configuration
Display active Firewalld settings:
sudo firewall-cmd --list-all
This provides information about:
- Active zones
- Open services
- Open ports
- Netzwerkschnittstellen
- Existing rules
Schritt 2: Update AlmaLinux
Before installing new packages, update the system:
sudo dnf update -y
Keeping the operating system updated helps ensure compatibility and security.
Schritt 3: Installieren Sie das EPEL-Repository
Fail2Ban packages are provided through the Extra Packages for Enterprise Linux (WARM) Repository.
Install EPEL:
sudo dnf install epel-release -y
Einmal installiert, additional community-supported packages become available.
Schritt 4: Installieren Sie Fail2Ban
Install Fail2Ban and Firewalld integration:
sudo dnf install fail2ban fail2ban-firewalld -y
The installation process automatically installs required dependencies.
Start Fail2Ban
Start the service:
sudo systemctl start fail2ban
Aktivieren Sie den automatischen Start:
sudo systemctl enable fail2ban
Überprüfen Sie den Servicestatus:
sudo systemctl status fail2ban
Expected output includes:
Active: active (running)
If the service starts successfully, Fail2Ban is ready for configuration.
Schritt 5: Configure Fail2Ban
The primary Fail2Ban configuration file is:
/etc/fail2ban/jail.conf
Jedoch, this file should not be modified directly because package updates may overwrite it.
Stattdessen, create a custom configuration file:
sudo touch /etc/fail2ban/jail.local
Open the file:
sudo nano /etc/fail2ban/jail.local
Add the following configuration:
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
bantime = 1h
findtime = 1h
maxretry = 5
Save the file and exit the editor.
Understanding Important Fail2Ban Parameters
ignoreip
Der ignoreip setting defines IP addresses that should never be banned.
Beispiel:
ignoreip = 127.0.0.1/8 ::1
This excludes localhost addresses from Fail2Ban actions.
Additional trusted IPs can be added if required.
bantime
Der bantime parameter defines how long an IP remains blocked.
Beispiel:
bantime = 1h
In diesem Fall, banned IP addresses remain blocked for one hour.
findtime
Der findtime value defines the monitoring window.
Beispiel:
findtime = 1h
Fail2Ban counts failed attempts that occur during this period.
maxretry
Der maxretry parameter specifies how many failures are allowed before a ban occurs.
Beispiel:
maxretry = 5
An IP generating five failed attempts within one hour will be banned.
Schritt 6: Enable Firewalld Integration
Fail2Ban traditionally uses iptables, but AlmaLinux environments commonly use Firewalld.
Activate Firewalld integration:
sudo mv /etc/fail2ban/jail.d/00-firewalld.conf \
/etc/fail2ban/jail.d/00-firewalld.local
This enables Fail2Ban to communicate directly with Firewalld.
Restart Fail2Ban:
sudo systemctl restart fail2ban
Schritt 7: Protect SSH with Fail2Ban
Standardmäßig, Fail2Ban does not actively protect services until a jail is configured.
Create an SSH jail configuration:
sudo nano /etc/fail2ban/jail.d/sshd.local
Hinzufügen:
[sshd]
enabled = true
bantime = 3h
maxretry = 3
This configuration:
- Enables SSH protection
- Bans attackers for three hours
- Allows three failed login attempts
Save the file and restart Fail2Ban:
sudo systemctl restart fail2ban
Verify Active Jails
Display active jails:
sudo fail2ban-client status
Beispielausgabe:
Status
|- Number of jail: 1
`- Jail list: sshd
View SSH Jail Statistics
Check SSH protection details:
sudo fail2ban-client status sshd
Beispielausgabe:
Currently banned: 0
Total banned: 0
Banned IP list:
This command helps monitor ongoing activity and banned IP addresses.
Checking Jail Configuration Values
To confirm the configured retry limit:
sudo fail2ban-client get sshd maxretry
Erwartete Ausgabe:
3
The displayed value should match your SSH jail configuration.
Testing Fail2Ban
Testing ensures that Fail2Ban is functioning correctly.
From another system, attempt several failed SSH logins:
ssh username@server-ip
Enter an incorrect password repeatedly.
After exceeding the configured limit, Fail2Ban should block the source IP address.
Check the jail status:
sudo fail2ban-client status sshd
Beispiel:
Currently banned: 1
Banned IP list: 192.168.1.50
This confirms that the offending address has been blocked successfully.
Unbanning an IP Address
To manually remove a banned address:
sudo fail2ban-client unban 192.168.1.50
Verify the removal:
sudo fail2ban-client status sshd
The IP should no longer appear in the banned list.
Viewing Fail2Ban Logs
Fail2Ban activity can be reviewed through system logs.
View recent events:
sudo journalctl -u fail2ban
Or inspect the log file:
sudo tail -f /var/log/fail2ban.log
Logs help identify:
- Banned IP addresses
- Triggered jails
- Configuration issues
- Service errors
Best Practices for Fail2Ban
For improved server security:
Use SSH Keys
Disable password authentication whenever possible and use key-based authentication.
Adjust Retry Limits
Lower values reduce brute-force opportunities.
Beispiel:
maxretry = 3
Increase Ban Duration
Longer bans reduce repeated attacks.
Beispiel:
bantime = 24h
Whitelist Trusted Addresses
Prevent accidental lockouts by adding administrative IP addresses to:
ignoreip
Monitor Logs Regularly
Review Fail2Ban activity periodically to identify attack trends and verify protection effectiveness.
Removing Fail2Ban
If Fail2Ban is no longer required, remove it using:
sudo dnf remove fail2ban -y
After removal, delete configuration files:
sudo rm -rf /etc/fail2ban
Only remove configuration files if you no longer need any Fail2Ban settings or backups.
Strengthening AlmaLinux Server Security with Fail2Ban
Fail2Ban provides a simple yet highly effective way to protect AlmaLinux servers from brute-force attacks and unauthorized login attempts. By monitoring log files, automatically banning suspicious IP addresses, and integrating with Firewalld, it adds an important layer of security to internet-facing services. Properly configured SSH protection, reasonable ban policies, and ongoing monitoring can significantly reduce the risk of unauthorized access while maintaining reliable server operations.
