Installing Fail2ban on Ubuntu 14.04 : Nginx, HP Cloud

Here is Guide With Steps on Installing Fail2ban on Ubuntu 14.04 on Server Running Nginx on HP Cloud. It adds a layer of security to SSH. HP Cloud has key based login and excellent virtual router where we can control the ingress-egress policies. We have shown before how to add port knocking to hide the SSH daemon. Fail2ban is another way to add security. This guide is intended for the advanced users.

 

Installing Fail2ban on Ubuntu 14.04 : Preface

 

Fail2ban is an intrusion prevention software to protect the servers from brute-force attacks. Fail2ban is written in the Python. Fail2ban monitors the log files for selected entries and run scripts. Most commonly this is used to block selected IP addresses which may breach the security. It can ban any IP that makes too many login attempts or performs any other action within a time frame defined by the sysadmin. The standard configuration ships with filters for Apache, Lighttpd etc. Filters are defined by Python regexes.

Fail2ban automatically alter the iptables firewall configuration, this is how the server to respond to illegitimate attempts in an automated way. We talked about jailed shell before.

 

Installing Fail2ban on Ubuntu 14.04 : Nginx, HP Cloud

 

We will suggest to take a snapshot of the running server if it is a live website as described in Disaster Mananagement using OpenStack Raksha and Floating IP.

First run update and then install Fail2ban :

You can run cat on this file :

to check the contents. We need to copy it to /etc/fail2ban/jail.local and edit it :

Find the section named [DEFAULT] and localhost should not be banned :

The [DEFAULT] section, excluding the commented out lines looks like this :

There are three parameters you must about – bantime, maxretry and findtime.

bantime parameter sets the length of time that a client will be banned failing to authenticate. By default, this is set to 600 seconds. maxretry sets the number of tries a client can do within timeframe defined by findtime before getting banned. By default, fail2ban service will ban client attempts to log in 3 times within a 10 minute timeframe.

There will be a section named [SSH]. It must be enabled :

Before going to Nginx related settings, we are mentioning once – /etc/fail2ban/filter.d directory keeps the filters. There should be section named [nginx-http-auth] in /etc/fail2ban/jail.local, it should look like this :

where /var/log/nginx/error.log is the real log of Nginx. To force the automation at firewall, we need to install :

We are providing a set of commands for basic security :

Stop the service and start it :

check the iptables rules :

You can check this file by running cat :

It is beyond our scope to highly customize Fail2ban for your need, you should look at the official website and read the manual of Fail2ban. For example, we have not talked about :

 

Hello! I Want To Use Fail2ban With ufw

 

As Fail2ban uses iptables and inserts rules first in the INPUT chain, if there is ufw running, it might not get integrated. To fully integrate Fail2ban to use ufw rather then iptables you will need to edit :

the [ssh] section should look like this :

then :