{"id":1539,"date":"2018-11-30T00:18:26","date_gmt":"2018-11-29T21:18:26","guid":{"rendered":"http:\/\/kifarunix.com\/?p=1539"},"modified":"2024-03-11T20:20:26","modified_gmt":"2024-03-11T17:20:26","slug":"how-to-protect-ssh-server-authentication-with-fail2ban-on-ubuntu-18-04","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/how-to-protect-ssh-server-authentication-with-fail2ban-on-ubuntu-18-04\/","title":{"rendered":"How to Protect SSH Server Authentication with Fail2ban Ubuntu 18.04"},"content":{"rendered":"\n<p>Hello there. Welcome to our tutorial on how to protect SSH server authentication with fail2ban on Ubuntu 18.04.<\/p>\n\n\n\n<p><a href=\"http:\/\/www.fail2ban.org\/wiki\/index.php\/Main_Page\" target=\"_blank\" rel=\"noopener noreferrer\">Fail2ban<\/a> is intrusion prevention tool written in Python&nbsp;programming language to protect servers or any service that requires authentication from brute-force attacks. Fail2ban scans the server\/service logs for any abnormally and ban any malicious IP associated with it. For example multiple SSH failed login attempts.<\/p>\n\n\n\n<p>It achieves this by adjusting the firewall rules to reject any further attempt by the malicious host to authenticate to the same system or a service for a defined period of time. It can also be configure to sent notifications on the same.<\/p>\n\n\n\n<p>As much as fail2ban mitigates such malicious issues as brute-forcing, it doesn&#8217;t alleviate any susceptibility to risks posed to your server\/service by the weak authentication mechanisms. Therefore, ensure that you implement good authentication mechanisms for your systems\/services.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"install-fail2ban-on-ubuntu-14-04\">Install Fail2Ban on Ubuntu 18.04<\/h2>\n\n\n\n<p>Fail2ban is available on the default Ubuntu 18.04 repositories and can simply be installed by running the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo apt update\nsudo apt install fail2ban -y<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Configure fail2ban<\/h2>\n\n\n\n<p>The configuration files for fail2ban are located under <code>\/etc\/fail2ban<\/code> directory with <code>jail.conf<\/code> being the main configuration file.<\/p>\n\n\n\n<p>In order to configure fail2ban to protect specific services, copy the <code>jail.conf<\/code> to custom <code>jail.local<\/code> configuration file. Direct modification of&nbsp; <code>*.conf<\/code> files&nbsp; is not recommended since in case of an upgrade, they will be overwritten and changes made in them will be lost.<\/p>\n\n\n\n<p>Therefore, you can copy the main configuration file, <code>jail.conf<\/code> to <code>jail.local<\/code> and make your own customizations or you can simply create a new custom configuration and define only settings you wish to overwrite in the main <code>.conf<\/code>.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">vim \/etc\/fail2ban\/jail.local<\/pre>\n\n\n\n<p>You can however use the <code>jail.conf<\/code> to guide you on settings you would like to override.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Fail2ban Global Settings<\/h3>\n\n\n\n<p>The <code>[DEFAULT]<\/code> section of the configuration file defines settings that are applied to all the services that are protected by fail2ban. In this section, you may want to override settings like <code>ignoreip<\/code>, <code>bantime<\/code>, <code>findtime<\/code>, <code>maxretry<\/code> , <code>destemail<\/code>, <code>sender<\/code>, <code>mta<\/code>, <code>action<\/code> settings.<\/p>\n\n\n\n<p>To customize your <code>jail.local<\/code>, edit it and put the following contents<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">[DEFAULT]\nignoreip = 192.168.43.149\nbantime  = 1440m\nfindtime  = 5m\nmaxretry = 5\ndestemail = admin@example.com\nsender = fail2ban@&lt;fq-hostname&gt;\nmta = postfix<\/pre>\n\n\n\n<p>These parameters are described below;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>ignoreip<\/code> &#8211; This is used to define IP addresses that are exempted from being banned by fail2ban. Mulitple IP addresses can be defined using space separator. Fail2ban doesnt ban any host by default.<\/li>\n\n\n\n<li><code>bantime<\/code> &#8211; Defines how long a host is blocked when it fails to authenticate correctly to the server. It is usually 10 minutes by default.<\/li>\n\n\n\n<li><code>findtime<\/code> &#8211; Defines a time window period in which a host is blocked if it generates a specific number of authentication retries defined by <code>maxretry<\/code> parameter. It is usually 10 minutes by default.<\/li>\n\n\n\n<li><code>maxretry<\/code>&nbsp; &#8211; Defines a maximum number of failures before a host is blocked. The default is 3.<\/li>\n\n\n\n<li><code>destemail<\/code> &#8211; It specifies an email address to sent notifications to in case you want to be notified whenever a host is banned.<\/li>\n\n\n\n<li><code>sender<\/code> &#8211; This parameter defines the value of the &#8220;From&#8221; field in the email sent.<\/li>\n\n\n\n<li><code>mta<\/code> &#8211; Specifies the mail transfer agent for mailing.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Configure SSH Jail Settings<\/h3>\n\n\n\n<p>In order to define settings that applies only to a specific service for example SSH, you need to create a section for that service. By default, the SSH service is enabled while all other services are disabled. To block the failed login attempts on the SSH server, create a jail like as shown below.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"># SSH Jail to block multiple failed login attempts\n<\/pre>\n\n\n<p>[ssh]<\/p>\n\n\n\n<p> \nenabled = true \nport = ssh \nfilter = sshd \nlogpath = \/var\/log\/auth.log\n<\/p>\n\n\n\n<p>The parameters used are described below;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>enabled<\/code> : This option turns on SSH server protection.<\/li>\n\n\n\n<li><code>port<\/code> : Defines the service that fail2ban is set to monitor<\/li>\n\n\n\n<li><code>filter<\/code> : Defines the configuration file located in the&nbsp;<code>\/etc\/fail2ban\/filter.d\/<\/code> directory that fail2ban uses to find matches and in this case, <code>\/etc\/fail2ban\/filter.d\/<span id=\"crayon-5c002031c60b7841685287\" class=\"crayon-syntax crayon-syntax-inline crayon-theme-github crayon-theme-github-inline crayon-font-monaco\"><span class=\"crayon-pre crayon-code\"><span class=\"crayon-v\">sshd<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">conf<\/span><\/span><\/span><\/code>.<span id=\"crayon-5c002031c60b7841685287\" class=\"crayon-syntax crayon-syntax-inline crayon-theme-github crayon-theme-github-inline crayon-font-monaco\"><\/span><\/li>\n\n\n\n<li><code>logpath<\/code> : This parameter specifies the location service log file.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"starting-fail-ban\">Starting fail2ban<\/h2>\n\n\n\n<p>Once you are done with configurations , save the configuration file and start and enable fail2ban to run on system boot.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">systemctl start fail2ban\nsystemctl enable fail2ban<\/pre>\n\n\n\n<p>As you can see under ACTIONS, fail2ban uses <code>iptables<\/code> to block or ban any source IP that may be involved in suspicious authentication attempts.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>...<\/strong>\n# Default banning action (e.g. iptables, iptables-new,\n# iptables-multiport, shorewall, etc) It is used to define\n# action_* variables. Can be overridden globally or per\n# section within jail.local file\n<strong>banaction = iptables-multiport<\/strong>\n<strong>banaction_allports = iptables-allports\n...\n<\/strong><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Check Ban Status<\/h3>\n\n\n\n<p>Fail2ban operates in a client-server model. The server program <code>fail2ban-server<\/code> is responsible for monitoring log files and issuing ban\/unban commands whereas the <code>fail2ban-client<\/code> reads the configuration files and issue corresponding configuration commands to the server.<\/p>\n\n\n\n<p>To check for banning status, run the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>fail2ban-client status<\/strong>\nStatus\n|- Number of jail:\t1\n`- Jail list:\tsshd<\/pre>\n\n\n\n<p>This will show you the jails that have been activated. In this case, <strong>sshd<\/strong>.<\/p>\n\n\n\n<p>Banning can also be done manually using the <code>fail2ban-client<\/code> command. For example, to ban a specific IP, run the command;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>fail2ban-client set sshd banip 192.168.43.220<\/strong>\n192.168.43.220<\/pre>\n\n\n\n<p>If you can check the status of the jail now, you will find out a list of banned IPs.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>fail2ban-client status sshd<\/strong>\nStatus for the jail: sshd\n|- Filter\n|  |- Currently failed:\t0\n|  |- Total failed:\t1\n|  `- File list:\t\/var\/log\/auth.log\n`- Actions\n   |- Currently banned:\t1\n   |- Total banned:\t1\n   `- Banned IP list:\t192.168.43.220<\/pre>\n\n\n\n<p>To unblock the IP,<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">fail2ban-client set sshd unbanip 192.168.43.220<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Test SSH Banning<\/h3>\n\n\n\n<p>Before you can conclude that fail2ban is actually working, you need to test it out. Therefore, based on our defined settings above, for an IP to be banned, it has to try at least 5 failed login attempts in five mins. Therefore, you can try to failed ssh logins to your server and check the status of the jail.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">fail2ban-client status sshd\nStatus for the jail: sshd\n|- Filter\n|  |- Currently failed:\t1\n|  |- <strong>Total failed:\t7<\/strong>\n|  `- File list:\t\/var\/log\/auth.log\n`- Actions\n   |- Currently banned:\t1\n   |- Total banned:\t2\n   `- <strong>Banned IP list:\t192.168.43.69<\/strong><\/pre>\n\n\n\n<p>You can also check the fail2ban log entry;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>tail -f \/var\/log\/fail2ban.log<\/strong>\n2018-11-30 00:04:21,048 fail2ban.filter         [4125]: INFO    [ssh] Found 192.168.43.69 - 2018-11-30 00:00:25\n2018-11-30 00:04:21,048 fail2ban.filter         [4125]: INFO    [ssh] Found 192.168.43.69 - 2018-11-30 00:00:27\n2018-11-30 00:04:21,049 fail2ban.filter         [4125]: INFO    [ssh] Found 192.168.43.69 - 2018-11-30 00:01:21\n2018-11-30 00:04:21,050 fail2ban.filter         [4125]: INFO    [ssh] Found 192.168.43.69 - 2018-11-30 00:01:26\n2018-11-30 00:04:21,050 fail2ban.filter         [4125]: INFO    [ssh] Found 192.168.43.69 - 2018-11-30 00:01:29\n2018-11-30 00:04:21,051 fail2ban.filter         [4125]: INFO    [ssh] Found 192.168.43.69 - 2018-11-30 00:01:38\n2018-11-30 00:04:21,052 fail2ban.filter         [4125]: INFO    [ssh] Found 192.168.43.69 - 2018-11-30 00:01:40\n2018-11-30 00:04:21,358 fail2ban.actions        [4125]: NOTICE  [ssh] Ban 192.168.43.69<\/pre>\n\n\n\n<p>Once you have been blocked and try to ssh again,<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ssh amos@192.168.43.154\nssh: connect to host 192.168.43.154 port 22: Connection refused<\/pre>\n\n\n\n<p>Well, from the output above, you can see that fail2ban works fine. Feel free to explore more about this beautiful tool. That is all it takes to protect your SSH server with Fail2ban. In our next article, we will see how to protect other services in the same way. Thanks for reading. We hope this was informative.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Other Tutorials<\/h3>\n\n\n\n<p><a title=\"Install and Configure Snort 3 NIDS on Ubuntu 20.04\" href=\"https:\/\/kifarunix.com\/install-and-configure-snort-3-nids-on-ubuntu-20-04\/\" target=\"_blank\" rel=\"bookmark noopener noreferrer\">Install and Configure Snort 3 NIDS on Ubuntu 20.04<\/a><\/p>\n\n\n\n<p><a title=\"Install and Configure AIDE on Ubuntu 20.04\" href=\"https:\/\/kifarunix.com\/install-and-configure-aide-on-ubuntu-20-04\/\" target=\"_blank\" rel=\"bookmark noopener noreferrer\">Install and Configure AIDE on Ubuntu 20.04<\/a><\/p>\n\n\n\n<p><a title=\"Install and Configure Tripwire Security Monitoring tool on CentOS 8\" href=\"https:\/\/kifarunix.com\/install-and-configure-tripwire-security-monitoring-tool-on-centos-8\/\" target=\"_blank\" rel=\"bookmark noopener noreferrer\">Install and Configure Tripwire Security Monitoring tool on CentOS 8<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hello there. Welcome to our tutorial on how to protect SSH server authentication with fail2ban on Ubuntu 18.04. Fail2ban is intrusion prevention tool written in<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,34],"tags":[1937,266,1938,1936,71,67],"class_list":["post-1539","post","type-post","status-publish","format-standard","hentry","category-howtos","category-security","tag-configure-fail2ban-on-ubuntu-18-04","tag-fail2ban","tag-fail2ban-ubuntu-18-04","tag-install-fail2ban-on-ubuntu-18-04","tag-ssh","tag-ubuntu-18-04","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/1539"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=1539"}],"version-history":[{"count":8,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/1539\/revisions"}],"predecessor-version":[{"id":21045,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/1539\/revisions\/21045"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=1539"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=1539"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=1539"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}