Linux Labs
Linux Labs
EN

Server security / Stage 5 of 10

Password brute force and fail2ban

Not running Starting usually ~20 s
Leave the lesson

Step 7 of 7 · summary · 3 min

Summary

  • fail2ban reads a service's log, catches refusals with a filter and bans the address through the firewall; the bundle "source → filter → action" is a jail.
  • The source is set by backend (systemd — the journald journal, logpath — a file), and journalmatch narrows the journal to the right unit.
  • maxretry, findtime and bantime set the threshold, the window and the ban duration; ignoreip protects your own addresses; the settings live in jail.local.
  • The state is seen with fail2ban-client status sshd, and the ban is a rule in nftables (nft list ruleset, the f2b-table table), see nftables rules.
  • At the start of the lesson the brute force was going on, and the jail showed 0 bans: it read another service's journal. You aimed it at lab-sshd, and the ban appeared.

Found an inaccuracy? Report an error in the lesson

Reference for this lesson

Articles

  • journalctl — reading the systemd journal — Command for reading the systemd journal with service, time, and other filters.
  • sshd — the SSH server — The OpenSSH server; edit the config with a second session open — a mistake in PermitRootLogin locks you out immediately.
  • fail2ban — Log-based banning — protecting SSH and services from brute force; jails, status, unban.
  • systemd — System and service manager that manages units and their dependencies.
Ubuntu 24.04
Loading…