<html>
<p>Fail2Ban is a free and open source intrusion prevention software tool written in the Python programming language that can be used to protects servers from different kinds of attacks. Fail2Ban works by continuosly monitoring various logs files (Apache, SSH) and running scripts based on them. Mostly it is used to block IP addresses that are trying to breach the system’s security. It can be used to block any IP address that are trying to make many illegitimate login attempts. Fail2Ban is set up to block malicious IP address within a time limit defined by administrator. Fail2Ban can be configured to send email notifications when someone’s attacking your server. Main purpose of Fail2ban is to scans log files for various services, such as SSH, FTP, SMTP, Apache and block the IP address that makes too many password failures.Here, we will learn how to install and configure Fail2ban to protect SSH and Apache service from brute force login attacks.</p>
<h2>System Requirements</h2>
<ul>
<li>Newly deployed Ubuntu 16.04 server.</li>
<li>Apache server with basic password authentication configured on your server.</li>
<li>A static IP address 192.168.15.189 is configured on your server.</li>
</ul>
<h2>Prepare the System for Deployment</h2>
<p>Before starting with the Fail2Ban, your system should be up to date and all installed software is running the latest version.First, log in to root user and update your system by running the following command:</p>
<pre><code>apt-get update -y</code></pre>
<pre><code>apt-get upgrade -y</code></pre>
<p><strong>Install Fail2Ban</strong></p>
<p>By default Fail2ban is available in Ubuntu 16.04 default package repository. So you can easily install it by just running the following command:</p>
<pre><code>sudo apt-get install fail2ban</code></pre>
<p>Once installation is complete, you can proceed to configuring Fail2ban.</p>
<h2>Configure Fail2Ban</h2>
<p>By default Fail2ban keeps all the configuration files in <code>/etc/fail2ban/</code> directory. The main configuration file is <code>jail.conf</code>, it contains a set of pre-defined filters. It is recommended that you should not modify <code>jail.conf</code> itself, but override it by creating a new configuration file <code>jail.local</code> inside <code>/etc/fail2ban/</code> directory.So let’s create a new <code>jail.local</code> file for Apache and SSH:</p>
<pre><code>sudo nano /etc/fail2ban/jail.local</code></pre>
<p>Add the following lines:<br>
</p>
<p>https://cdn.steemitimages.com/DQmXagLaquh46d6aSJSxBxDPMQsBA1eFRNQQKSeqbfqut4s/Screenshot-2018-6-18%20How%20To%20Protect%20SSH%20and%20Apache%20Using%20Fail2Ban%20on%20Ubuntu%20Linux.png</p>
<p>Save the file when you are finished.<br>
Next, you will also need to create the filter file <code>/etc/fail2ban/filters.d/http-get-dos.conf</code>.</p>
<p><code>sudo nano /etc/fail2ban/filters.d/http-get-dos.conf</code></p>
<p>Add the following contents:</p>
<p>https://cdn.steemitimages.com/DQmZ5WexuJQHmBVfEHsL1ka5gZ2cD72GPfCQ4vdc6hRbxpy/Screenshot-2018-6-18%20How%20To%20Protect%20SSH%20and%20Apache%20Using%20Fail2Ban%20on%20Ubuntu%20Linux.png</p>
<p>Save the file and restart the fail2ban service:</p>
<p><code>sudo systemctl restart fail2ban</code></p>
<p>Brief description of each configuration options are here:</p>
<p><strong>logpath :</strong>Name of the logfile that fail2ban checks for failed login attempts.</p>
<p><strong>maxretry :</strong>Maximum number of failed login attempts before a host is blocked by fail2ban.</p>
<p><strong>bantime :</strong>Specifies the number of seconds that a remote host will be blocked by Fail2ban.</p>
<p><strong>findtime :</strong>The time period in seconds in which we’re counting “retries”.</p>
<p><strong>ignoreip :</strong>This is the list of IP addresses that can not be blocked by Fail2ban.</p>
<p><br></p>
<p>You can view the rules added by Fail2Ban using the following command:</p>
<p><code>sudo iptables -L</code></p>
<p>You should see all the rules as below:</p>
<p>https://cdn.steemitimages.com/DQmd9MfyPkwzVZLvUBpeS8F5m6Nv4TyaHe6QxNGKoTLVidq/Screenshot-2018-6-18%20How%20To%20Protect%20SSH%20and%20Apache%20Using%20Fail2Ban%20on%20Ubuntu%20Linux.png</p>
<p>You can also list out all the activated jails by running the following command:</p>
<p><code>sudo fail2ban-client status</code></p>
<p>You should see the following output:</p>
<p><code>Status<br>
|- Number of jail: 5</code></p>
<p><code>`- Jail list: apache, apache-overflows, apache-badbots, apache-noscript, http-get-dos, ssh</code></p>
<h2><strong>Test Fail2Ban</strong></h2>
<p>Once everything is set up properly, it’s time to test Fail2Ban.<strong>Test Fail2Ban for Apache Failed Login Attempts</strong>On the remote machine, open your web browser and type the URL <code>http://your-apacheserver-ip</code>, you should be asked for authentication. Enter the wrong username and password repeatedly. Once you have reached the failed login limit, you should be blocked and unable to access the Apache web server for <code>600</code>seconds.On the Fail2Ban server machine, check the banning status of Fail2Ban with the following command:</p>
<p><code>sudo fail2ban-client status apache</code></p>
<p>You should see your remote host IP address being blocked by Fail2Ban:</p>
<p>https://cdn.steemitimages.com/DQmY7rUVWzoyeSPwnuU2d41NRdMkTap6aK7mZ6BgQ1MvshE/Screenshot-2018-6-18%20How%20To%20Protect%20SSH%20and%20Apache%20Using%20Fail2Ban%20on%20Ubuntu%20Linux.png</p>
<p><strong>Test Fail2Ban for Apache DOS Attack</strong></p>
<p>You can use ab (Apache Bench-mark tool) to test if it’s really working.<br>
On the remote machine, open your terminal and run the following command:</p>
<p><code>ab -n 1000 -c 20 http://192.168.15.189/</code></p>
<p>The above command will send 1000 page-loads in 20 concurrent connections against your web server. When you have reached the limit, you should be blocked for 200 seconds.</p>
<p>On the Fail2Ban server machine, take a look in your <code>/var/log/fail2ban.log</code>file you should see the following output:</p>
<p><code>tail -f /var/log/fail2ban.log</code></p>
<p>Output:</p>
<p><code> 2017-01-31 20:51:08,417 fail2ban.actions: WARNING [http-get-dos] Ban 192.168.15.196</code></p>
<p>You can also verify fail2ban banning status with the following command:</p>
<p><code>sudo fail2ban-client status http-get-dos</code></p>
<p>You should see that your remote host IP address being blocked by Fail2Ban:</p>
<p>https://cdn.steemitimages.com/DQmYT2aTjFYmK7QeKFo65a7o9pdwFbiT9bdpNdcNZ1RC4xB/Screenshot-2018-6-18%20How%20To%20Protect%20SSH%20and%20Apache%20Using%20Fail2Ban%20on%20Ubuntu%20Linux.png</p>
<p><strong>Test Fail2Ban for SSH Failed Login Attempts</strong></p>
<p>On the remote machine, open your command line interface and try to ssh to the server IP address:</p>
<p><code>ssh 192.168.15.189</code></p>
<p>You should be asked to enter password. Enter the wrong password repeatedly. Once you have reached the failed login limit, you should be blocked for <code>600</code>seconds.</p>
<p>https://cdn.steemitimages.com/DQmbEsnHXz16iE3Xw3XSaJfYaNkb5rzGCbKgA5EQ4aM7ED5/Screenshot-2018-6-18%20How%20To%20Protect%20SSH%20and%20Apache%20Using%20Fail2Ban%20on%20Ubuntu%20Linux.png</p>
<p>On the Fail2Ban server machine, check the banning status of Fail2Ban with the following command:</p>
<p><code>sudo fail2ban-client status ssh</code></p>
<p>You should see that your remote host IP address being blocked by Fail2Ban:</p>
<p>https://cdn.steemitimages.com/DQmQwtB4BSif6rk9z5y6UUCuo4A31GvAPv69YZFdsiPMiDa/Screenshot-2018-6-18%20How%20To%20Protect%20SSH%20and%20Apache%20Using%20Fail2Ban%20on%20Ubuntu%20Linux.png</p>
<p>If you want to unban the IP address of the remote host before the banning time limit expires, then run the following command on the server machine:</p>
<p><code>sudo fail2ban-client set ssh unbanip 192.168.15.196 </code></p>
<p><code>sudo fail2ban-client set apache unbanip 192.168.15.196</code></p>
<p><br></p>
<p>Where, <code>192.168.15.196</code>is the IP address of the remote machine.</p>
<p><br></p>
<p>a perfect explanation . fails2ban is easy to install but I find the explanation with d-dos attack perfect</p>
<p>thanks to the author <a href="https://blog.rapid7.com/author/rapid7/"><code>Rapid7</code></a></p>
<p>source of the contribution : https://blog.rapid7.com/2017/02/13/how-to-protect-ssh-and-apache-using-fail2ban-on-ubuntu-linux/</p>
<p><br></p>
</html>