SSH | Fail2Ban

Install Fail2Ban

1. Update & Install

sudo apt update && sudo apt install fail2ban -y

2. Create config (jail.local)

sudo nano /etc/fail2ban/jail.local

[DEFAULT]

# block 12 hours (43200 seconds)
bantime = 43200

#trial time window (10 minutes)
findtime = 600

# max retry
maxretry = 5

# backend log
backend = systemd

# ignore Self IP
ignoreip = 127.0.0.1/8 ::1


[sshd]

enabled = true
port = 22
filter = sshd
logpath = %(sshd_log)s
maxretry = 5
bantime = 43200

3. Restart fail2ban

sudo systemctl restart fail2ban

4. Enable auto start

sudo systemctl enable fail2ban

5. Check status ssh jail

sudo fail2ban-client status sshd