Fail2ban

With Fail2ban we can block IPs that want to connect to our device, here I am going to explain how to configure the blocking when they try to connect via ssh

This notebook has been automatically translated to make it accessible to more people, please let me know if you see any typos.

Installation

The installation is very simple, we only have to make

sudo apt update
      sudo apt install fail2ban
      

Configuration file

Once installed, we modify the configuration file by doing the following

sudo nano /etc/fail2ban/jail.conf
      

We go down to the part where [sshd] is, in my case I have left it like this

[sshd]
      bantime = 172800
      port = ssh
      logpath = %(sshd_log)s
      backend = %(sshd_backend)s
      maxretry = 3
      

What it does is that if someone makes 3 connection retries, it bans that IP for 48 hours (172800 seconds).

Review logs

We can check through the logs whether any IP has been blocked with

cat /var/log/fail2ban.log