Informational Website publish


News about our company, tutorials about IT and much more you will find in this page.

How to Protect SSH with Fail2Ban on CentOS 6

Janeiro 31st, 2018

While connecting to your server through SSH can be very secure, the SSH daemon itself is a service that must be exposed to the internet to function properly. This comes with some inherent risks. Any service that is exposed to the network is a potential target in this way. If you pay attention to the application logs for these services, you will often see repeated, systematic login attempts that represent brute force attacks by users and bots alike.

A service called fail2ban can mitigate this problem by creating rules that can automatically alter your iptables firewall configuration based on a predefined number of unsuccessful login attempts. This will allow your server to respond to illegitimate access attempts without your intervention.

In this guide, we will cover how to install and use fail2ban on a CentOS 6 server.


1. Install Fail2Ban

Because fail2ban is not available from CentOS, we will start by downloading the EPEL repository:

  • rpm -Uvh

Follow up by installing fail2ban:

  • yum install fail2ban


2. Copy the Configuration File

The default fail2ban configuration file is located at /etc/fail2ban/jail.conf. The configuration work should not be done in that file, since it can be modified by package upgrades, but rather copy it so that we can make our changes safely.

We need to copy this to a file called jail.local for fail2ban to find it:

  • cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

After the file is copied, you can make all of your changes within the new jail.local file. Many possible services that may need protection are in the file already. Each one is located in its own section, configured and turned off.

3. Configure defaults in Jail.Local

Open up the the new fail2ban configuration file:

  • vi /etc/fail2ban/jail.local

The first section of defaults covers the basic rules that fail2ban will follow to all services enabled for fail2ban that are not overridden in the service’s own section.. If you want to set up more nuanced protection for your server, you can customize the details in each section.

You can see the default section below.


# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip =

# "bantime" is the number of seconds that a host is banned.
bantime  = 3600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 3

Write your personal IP address into the ignoreip line. You can separate each address with a space. IgnoreIP allows you to white list certain IP addresses and make sure that they are not locked out. Including your address will guarantee that you do not accidentally ban yourself from your own server.

The next step is to decide on a bantime, the number of seconds that a host would be blocked from the server if they are found to be in violation of any of the rules. This is especially useful in the case of bots, that once banned, will simply move on to the next target. The default is set for 10 minutes – you may raise this to an hour (or higher) if you like.

Maxretry is the amount of incorrect login attempts that a host may have before they get banned for the length of the ban time.

Findtime refers to the amount of time that a host has to log in. The default setting is 10 minutes; this means that if a host attempts, and fails, to log in more than the maxretry number of times in the designated 10 minutes, they will be banned.

4. Add a jail file to protect SSH

Although you can add this parameters in the global jail.local file, it is a good practice to create separate jail files for each of the services we want to protect with Fail2Ban.

So lets create a new jail for SSH with the vi editor.

  • vi /etc/fail2ban/jail.d/sshd.local

In the above file, add the following lines of code:

enabled = true
port = ssh
action = iptables-multiport
logpath = /var/log/secure
maxretry = 3
bantime = 3600

Enabled simply refers to the fact that SSH protection is on. You can turn it off with the word “false”.

The port parameter defines which port Fail2Ban should be watching, if default port 22 is in use, then there is no need to change this parameter. Otherwise type the port you are using for SSH access.

Action describes the steps that Fail2Ban will take to ban a matching IP address. Each action refers to a file within the action.d directory. The default ban action, “iptables-multiport” can be found at /etc/fail2ban/action.d/iptables-multiport.conf .

log path refers to the log location that fail2ban will track.

The max retry and bantime lines within the SSH section have the same definitions as the default configuration file. However, if you have enabled multiple services and want to have specific values for each one, you can set the new max retry amount and ban time for SSH here.

5. Restart Fail2Ban

After making any changes to the fail2ban config, always be sure to restart fail2ban:

  • service fail2ban restart

You can see the rules that fail2ban puts in effect within the IP table:

  • iptables -L


Check Fail2Ban Status

Use fail2ban-client command to query the overall status of the Fail2Ban jails.

  • fail2ban-client status

You can also query a specific jail status using the following command:

  • fail2ban-client status sshd


Manually Unban IP Banned by Fail2Ban

If for some reason you want to grant access to an IP that it is banned, use the following expression to manually unban an IP address, banned by fail2ban:

  • fail2ban-client set JAIL unbanip IP

eg. Unban IP, that was banned according to [ssh-iptables] jail:

  • fail2ban-client set sshd unbanip


You should now be able to configure some basic banning policies for your services. Fail2ban is very easy to set up, and is a great way to protect any kind of service that uses authentication.