Part 6: Security layer

31. Fail2ban: ban password-guessers#

What it does: watches the SSH log. If one address fails to log in 5 times within 10 minutes, it's blocked in the firewall for an hour. Time: 10 minutes.

flowchart LR
  A["Someone tries SSH"] --> L["SSH log"]
  L --> F{"Fail2ban:<br/>5 failures<br/>in 10 min?"}
  F -- "no" --> OK["Nothing happens"]
  F -- "yes" --> B["UFW blocks that<br/>address for 1 hour"]

With keys only and no port forwarding, guesses can't succeed anyway. Fail2ban just keeps the noise down and adds one more layer.

Step 1: Install#

Type on: the server

sudo apt install fail2ban python3-systemd

Step 2: Settings#

Type on: the server

sudo nano /etc/fail2ban/jail.d/homeserver.local

File: /etc/fail2ban/jail.d/homeserver.local

[sshd]
enabled = true
port = 22
backend = systemd
banaction = ufw
findtime = 10m
maxretry = 5
bantime = 1h

Line	Meaning
`backend = systemd`	Read the system log (Debian has no `/var/log/auth.log` by default)
`banaction = ufw`	Block offenders using your existing firewall
`findtime`, `maxretry`, `bantime`	5 failures within 10 minutes means a 1-hour ban

Step 3: Check and start#

Type on: the server

sudo fail2ban-client -t

It should end with OK. Then:

Type on: the server

sudo systemctl enable --now fail2ban
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

You should see the sshd jail with Currently banned: 0. Zero is normal for a private server.

If you ban yourself#

From another device, or the server's keyboard:

Type on: the server

sudo fail2ban-client status sshd
sudo fail2ban-client set sshd unbanip 192.168.1.20

Use the address shown in the Banned IP list.

Done when: fail2ban-client status sshd shows the jail running.

Next: 32. Cockpit dashboard