Fail2ban scans log files (e.g.
/var/log/httpd/error_log) and bans IPs that show the malicious signs like too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured.
If you want Fail2ban to send an email when someone has been banned, you have to configure SSMTP (for example).
The fail2ban-client allows monitoring jails (reload, restart, status, etc.), to view all available commands:
To view all enabled jails:
# fail2ban-client status
To check the status of a jail, e.g. for sshd:
# fail2ban-client status sshd
Status for the jail: sshd |- Filter | |- Currently failed: 1 | |- Total failed: 9 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 0.0.0.0
Currently, fail2ban must be run as root. Therefore, you may wish to consider hardening the process with systemd.
Create a drop-in configuration file for
[Service] PrivateDevices=yes PrivateTmp=yes ProtectHome=read-only ProtectSystem=strict NoNewPrivileges=yes ReadWritePaths=-/var/run/fail2ban ReadWritePaths=-/var/lib/fail2ban ReadWritePaths=-/var/log/fail2ban ReadWritePaths=-/var/spool/postfix/maildrop CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW
CAP_DAC_READ_SEARCH will allow fail2ban full read access to every directory and file,
CAP_NET_RAW allow setting of firewall rules with iptables. See for more info.
ProtectSystem=strict the filesystem hierarchy will only be read-only,
ReadWritePaths allows fail2ban to have write access on required paths.
/etc/fail2ban/fail2ban.local with the correct
[Definition] logtarget = /var/log/fail2ban/fail2ban.log
Finally, reload systemd to apply the changes of the unit:
# systemctl daemon-reload
Due to the possibility of the
/etc/fail2ban/jail.conf file being overwritten or improved during a distribution update, it is recommended to Create
/etc/fail2ban/jail.local file. For example to change default ban time to 1 day:
[DEFAULT] bantime = 1d
Or create separate name.local files under the
/etc/fail2ban/jail.d directory, e.g.
fail2ban.service to apply the configuration changes.
[sshd] enabled = true
Firewall and services
Tips and tricks
Custom SSH jail
/etc/fail2ban/jail.d/sshd.local, add this section and update the list of trusted IP addresses in
If your firewall is iptables:
[sshd] enabled = true filter = sshd action = iptables backend = systemd maxretry = 5 findtime = 1d bantime = 2w ignoreip = 127.0.0.1/8
fail2ban has IPv6 support since version 0.10. Adapt your firewall accordingly, e.g. start and enable
shorewall. You can also set
/etc/shorewall/shorewall.conf, otherwise the rule added to ban an IP address will affect only new connections.
/etc/ssh/sshd_configto allow full fail2ban monitoring as otherwise password failures may not be logged correctly.