Install & Configure Fail2Ban on Ubuntu 22.04 (Apache2)

Fail2ban is an intrusion prevention system written in Python that runs on all POSIX operating systems that have a tamperable packet filtering system or firewall (e.g. iptables on Linux).

The main purpose of fail2ban is to determine and block specific IP addresses that are likely to belong to attackers who want to gain access to the system. fail2ban identifies IP addresses from log files that try to log in with incorrect passwords or perform other dangerous or senseless actions more often in a time frame set by the administrator. Usually, fail2ban is configured to unblock blocked addresses after a certain amount of time so as not to block legitimate connection attempts (for example, if the attacker IP is dynamically allocated to another host). A blocking time of a few minutes is considered helpful to stop flooding the server with malicious connection attempts (brute force).

Fail2ban is capable of performing various actions when a likely malicious IP has been detected, such as blocking that IP with a rule in iptables or the one belonging to TCP wrappers to reject subsequent attacks, email notifications, or any custom action that can be performed with Python.

The default configuration includes filters for Apache, Lighttpd, sshd, vsftpd, qmail, and Postfix Server. Filters are defined by regular expressions that can be easily customized by the administrator. The combination of filter and action is called jail and is capable of blocking malicious hosts. A jail can be created for any software that creates log files that can be evaluated with regular expressions.

It is easy to install and configure fail2ban, at least for the basic purpose. SSH to your server and run the following commands:

Restart fail2ban :

Run iptables -L to list current rules:

If firewall rules are not present then you can run :

iptables rules are optional when you are using fail2ban for virtual servers and dedicated servers with a webhost-provided firewall. You can see the available filters here:

These filters can be enabled from:

The steps we have performed should reduce 80% of attacks. From this file, you can change the findtime, bantime etc. By default, they are set to a lower value for testing purposes. If you can increase the bantime to 1 day or more after testing for a few days. Of course, you must enable PEM certificate-based SSH login.

For WordPress, you need a WordPress plugin named Fail2Ban Redux:

Upload and activate the plugin through the ‘Plugins’ menu in WordPress.
Copy the config/filters/wordpress-hard.conf and config/filters/wordpress-soft.conf files to your Fail2Ban filters directory /etc/fail2ban/filters.d.

If my public directory (where WordPress is installed) is /var/www/html/, then wordpress-hard.conf and wordpress-soft.conf will be located at :

We need to copy these files (one or both) to:

Run these commands:

This is the configuration file:

This is the content of the file:

Open:

Add the above stanza. Restart fail2ban:

Check whether we did correct or not:

You will get output like :

It is an optional step. Open logrotate.conf :

Add this stanza :

It is to set the maximum size of the file, permissions of the file, and the number of weeks (4 in the above example) that the file will not become /var/log/auth.log.1. It is an auto-cleaning system in GNU/Linux preserving the record in different files. You can cat on these files :

This command is very useful for checking Fail2Ban every day, it is divided into number, possible hostname and IP addresses:

Example output:

Now, you can install libapache2-mod-geoip module to get the country names. For nginx, you had to fight to get it configured. We have a guide for compiling GeoIP with Nginx. For Apache2, it is few steps:

geoip.conf should look like this:

Enable the module and restart Apache2 after a successful config test:

Now, if you run this command, you’ll get attackers by country:

Like this:

You’ll get more commands on our earlier guide on fail2ban. You can setup Fail2Ban Log Analytics Graph With badips.com.