1.3 KiB
1.3 KiB
The software monitors the log files for authentication errors. In case of multiple retries from the same IP address, it reconfigures the firewall on the fly to block the source IP. This is to prevent brute‑force methods for cracking passwords and bots checking for weak passwords. However, a system administrator may also lock himself out if a mistake is made. Therefore, you can exclude distinct IP addresses, e.g., the administrator’s desktop, from blocking.
-
Installation of the software
[…]# dnf install fail2ban -
Create and fill configuration file
[…]# vi /etc/fail2ban/jail.local # Jail configuration additions for local installation # Adjust the default configuration's default values [DEFAULT] # Optional enter an trusted IP never to ban #ignoreip = www.xxx.yyy.zzz/32 bantime = 6600 backend = auto # The main configuration file defines all services but # deactivates them by default. We have to activate those needed [sshd] enabled = true -
Activate software
[…]# systemctl enable fail2ban --now -
Control in the log
[…]# tail -f /var/log/fail2ban.log