published priority 16 20 min. 30 XP.

fail2ban. Automatic Banning of Brute-Force IPs

fail2ban is the single easiest way to shut down SSH brute-force attacks during NCAE. Install enable done. This lesson covers the three config files you care about, the one crucial whitelist entry (scoring engine), and how to unban when you accidentally lock someone out.

Prerequisites

Linux Service Management. systemctl, journalctl, sysvinit

DCWF roles: IT-451 System Administrator CS-511 Cyber Defense Analyst CS-521 Cyber Defense Infrastructure Support Specialist Services: SSH LoginWWW Port 80

Objectives

Install fail2ban on Debian/Ubuntu
Understand the three-level config: fail2ban.conf jail.conf jail.local
Enable the sshd jail
Whitelist an IP range with `ignoreip`
Check jail status with `fail2ban-client`
Unban an IP manually

Quick reference

Command	Purpose
apt-get install -y fail2ban	Install
systemctl enable --now fail2ban	Start + enable on boot
fail2ban-client status	Which jails are active?
fail2ban-client status sshd	Currently banned IPs for a jail
fail2ban-client unban <IP>	Remove ban manually
fail2ban-client reload	Apply config changes
tail -f /var/log/fail2ban.log	Live view

Common pitfalls

Editing `/etc/fail2ban/jail.conf` directly. gets overwritten on package upgrade. Always use `jail.local`
Forgetting to whitelist the scoring engine. gets banned after 5 rapid checks, service goes red
Setting `bantime = -1` (permanent) during practice. locks yourself out forever
Default `backend = auto` sometimes fails to detect systemd journal. explicit `backend = systemd` is safer
Config change without reload. `fail2ban-client reload`

How it works (walkthrough)

# /etc/fail2ban/jail.local  (NEVER edit jail.conf. always the .local override)
[DEFAULT]
bantime  = 10m
findtime = 10m
maxretry = 5
# Whitelist scoring engine + localhost so they're never banned:
ignoreip = 127.0.0.1/8 ::1 <SCORING_ENGINE_IP>/32

[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
backend = systemd

[apache-auth]
enabled = true
port    = http,https
logpath = %(apache_error_log)s

Skill drills