Learn how to boost AlmaLinux 9 security with Fail2ban. Our Server Management Support team is here to help you with your questions and concerns.

AlmaLinux 9 Security: Easy Setup with Fail2ban

In the current day and age keeping your Linux server secure is paramount.

Fail2ban is a free, powerful tool that adds an extra layer of defense against malicious attacks, especially brute-force attempts.

In this blog, we will explore what Fail2ban is and how to get it up and running on our system.

Installation and Configuration

1. Fail2ban isn’t included by default on all Linux systems. So, if we use a RHEL based distribution, we need to install the EPEL repository.

   yum install epel-release

   This offers us additional software packages.
2. After that, installing Fail2ban itself is a breeze using the yum package manager.

   yum install fail2ban
3. Then, start Fail2ban and ensure it starts automatically on boot.

   systemctl start fail2ban
systemctl enable fail2ban

4. After installation, Fail2ban needs some configuration. The tool uses two main files: jail.conf and jail.local. jail.conf holds the default settings, while jail.local lets us customize Fail2ban’s behavior for different services. We can edit jail.local using the vi text editor.

   vi /etc/fail2ban/jail.local

   In this file, we can define various settings like:

   • Ban Time: This determines how long an IP address is blocked after exceeding the allowed login attempts. For example:

     # Ban time setting to 300 seconds
bantime = 300

   • Find Time: It specifies the timeframe within which those attempts must occur to trigger a ban.

     For example:

     # Set conditions to ban a client
findtime = 300
   • Max Retry: This sets the number of failed login attempts permitted before an IP gets blocked.

     For example:

     # Set conditions to ban a client
maxretry = 3
5. After making changes to the jail.local file, restart the Fail2ban service to apply the new settings.

   systemctl restart fail2ban
6. To ensure Fail2ban is running correctly and the configurations are applied, check the status of the Fail2ban service:

   fail2ban-client status

   To check the status of a specific Fail2ban jail, such as the SSH jail, use:

   fail2ban-client status sshd

Fail2ban is a valuable tool for any Linux server administrator. By automatically blocking suspicious IP addresses, it reduces the risk of unauthorized access. With its ease of use and customization options, Fail2ban is a great addition to your server’s security arsenal.

[Need assistance with a different issue? Our team is available 24/7.]

Conclusion

In brief, our Support Experts demonstrated how to boost AlmaLinux 9 security with Fail2ban.