Knowledgebase

How to Install Fail2Ban on AnonVM: A Step-by-Step Guide

Fail2Ban is a powerful security tool that helps protect your server from brute-force attacks and unauthorized login attempts. It works by monitoring log files and banning IP addresses that exhibit suspicious behavior. If you host your server on AnonVM, securing it with Fail2Ban can significantly enhance your server's security. This guide will walk you through the installation and configuration of Fail2Ban on your AnonVM server.

Prerequisites

Before beginning, make sure you have the following:

• A VPS or Dedicated Server: Ensure you're using AnonVM for secure, offshore hosting with high performance.
• A Linux-based Operating System: This tutorial works on distributions such as Ubuntu, Debian, or CentOS.
• Sudo or Root Access: You must have administrative privileges to install Fail2Ban.

Step 1: Update Your System

First, log in to your server using SSH. Update your server to ensure all packages are up-to-date:

For Ubuntu/Debian-based systems:

For CentOS:

Step 2: Install Fail2Ban

Fail2Ban is available from the default repositories of most Linux distributions. To install it, use the following commands:

For Ubuntu/Debian-based systems:

For CentOS:

This will install the Fail2Ban package and all its dependencies.

Step 3: Start and Enable Fail2Ban Service

After the installation, start the Fail2Ban service and ensure it runs automatically at system startup.

You can verify the status of Fail2Ban to ensure it is running:

Step 4: Configure Fail2Ban

Fail2Ban comes with a default configuration that protects against common attacks, such as SSH brute-force attempts. You can customize its behavior by editing its configuration files.

1. Create a Local Configuration File:

   It's recommended to create a local configuration file rather than modifying the default one directly. Copy the default configuration to a local one:

    

   sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

   This ensures that your changes won’t be overwritten during package updates.

2. Edit the Jail Configuration:

   Open the jail.local configuration file in a text editor:

    

   sudo nano /etc/fail2ban/jail.local

   In this file, you can configure various settings. For example, you can configure the protection for SSH by finding the [sshd] section and ensuring it's enabled:

    

   [sshd] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 3 bantime = 600 findtime = 600

   Here’s what each option means:

   • enabled: Whether the filter is enabled (set it to true to enable).
   • port: The port Fail2Ban should monitor for SSH attacks (default is ssh).
   • filter: Defines the log filter to use.
   • logpath: The log file to monitor for authentication attempts.
   • maxretry: The number of failed login attempts before banning an IP.
   • bantime: The time (in seconds) that the IP will be banned.
   • findtime: The time period within which the failed attempts are counted.

   You can customize these values based on your preferences and security requirements.

3. Additional Configurations:

   You can also enable protection for other services such as nginx, apache2, postfix, and more. Find the relevant sections for these services in the jail.local file and set enabled = true to activate them.

Step 5: Restart Fail2Ban

Once you've made your changes, restart the Fail2Ban service to apply the new configurations:

Step 6: Verify Fail2Ban is Working

To check that Fail2Ban is actively protecting your server, use the following command:

This will display the status of Fail2Ban and list all the enabled jails. To check the status of a specific jail, such as SSH, run:

This will show you the number of currently banned IP addresses for SSH.

Step 7: Viewing Fail2Ban Logs

Fail2Ban logs its activity, which can be useful for troubleshooting or auditing. The logs are typically stored in the /var/log/fail2ban.log file. To view the logs, you can use the following command:

This will display the most recent log entries in real-time, allowing you to see when IPs are banned and why.

Step 8: Whitelist Trusted IPs (Optional)

If you want to prevent certain IPs (such as your own) from being banned by Fail2Ban, you can add them to the whitelist. To do this:

1. Open the jail.local file:

    

   sudo nano /etc/fail2ban/jail.local

2. Add your trusted IP to the ignoreip directive:

    

   ignoreip = 127.0.0.1/8 ::1 your-trusted-ip

3. Restart Fail2Ban to apply the changes:

    

   sudo systemctl restart fail2ban

This will ensure that the specified IP address is never banned.

Step 9: Unbanning IPs

If you want to unban an IP address manually, you can do so with the following command:

Replace your-ip-address with the actual IP address you want to unban.

Conclusion

By following this tutorial, you've successfully installed and configured Fail2Ban on your AnonVM server. Fail2Ban is an essential tool for protecting your server from unauthorized access and brute-force attacks. With this setup, you can ensure that your server is safer and that malicious actors are quickly blocked.

Fail2Ban is highly customizable and can be adapted to protect various services, making it a versatile security solution for your AnonVM server. Be sure to regularly monitor the logs and adjust configurations as needed to maintain a strong security posture.