Skip to content

Commit 0f7efe3

Browse files
bene2k1bene2k1
committed
feat(em): update fail2ban
1 parent bc52717 commit 0f7efe3

File tree

2 files changed

+77
-65
lines changed

2 files changed

+77
-65
lines changed

‎pages/elastic-metal/troubleshooting/troubleshoot-remote-access-issues.mdx‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@ You are unable to connect to your Scaleway Elastic Metal server using remote acc
3535
- Try using a different network or disable VPNs that may interfere.
3636
- Allow the necessary ports for remote access in your firewall settings.
3737

38+
#### Ensure Fail2ban is installed and configured on the machine
39+
- [Fail2ban](/tutorials/protect-server-fail2ban/) is a small software that discovers potential malicious connection attempts to the server and blocks them.
40+
3841
#### Try a different browser or system
3942
- Some remote access solutions require specific browsers or Java versions.
4043
- Try launching the KVM session in a different browser (Chrome, Firefox, Safari, Edge).
@@ -45,6 +48,9 @@ You are unable to connect to your Scaleway Elastic Metal server using remote acc
4548
- Close any existing remote access session and relaunch it from the Scaleway console.
4649
- If the session remains unresponsive, try rebooting your server.
4750

51+
#### Ensure web administration panels (e.g. Proxmox) are located within a Private Network
52+
- Create a [Private Network](https://www.scaleway.com/en/docs/vpc/faq/#private-networks) to avoid exposing the server admin interface on the public internet.
53+
4854
#### Check server status
4955
- If your server is unresponsive, attempt a soft reboot from the Scaleway console.
5056
- If that does not work, use the power cycle option to restart the machine.

‎tutorials/protect-server-fail2ban/index.mdx‎

Lines changed: 71 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,16 @@ tags: security Fail2Ban brute-force
55
products:
66
- instances
77
dates:
8-
validation: 2025-04-08
8+
validation: 2025-08-25
99
posted: 2018-08-22
1010
validation_frequency: 12
1111
---
1212
import image from './assets/scaleway-postfix-install.webp'
1313

1414
import Requirements from '@macros/iam/requirements.mdx'
1515

16-
17-
Fail2Ban is a useful tool that analyses server log files for recurring patterns of failures. This allows blocking IPs trying to run brute force attacks against a server.
18-
19-
In this tutorial, you will learn how to configure the service on an Ubuntu Bionic server to protect the SSH service. Fail2Ban can be used with all services generating log files.
16+
Fail2Ban is a powerful tool that analyzes server log files for recurring patterns of failed login attempts, enabling the blocking of IPs attempting brute force attacks against a server.
17+
In this tutorial, you will learn how to configure Fail2Ban on an Ubuntu 24.04 LTS (Noble Numbat) server to protect the SSH service. Fail2Ban can be used with any service that generates log files.
2018

2119
<Requirements />
2220

@@ -28,79 +26,87 @@ In this tutorial, you will learn how to configure the service on an Ubuntu Bioni
2826

2927
## Installing Fail2Ban
3028

31-
1. The required packages are available in the repositories of Ubuntu and can be installed with `apt`:
32-
```
29+
1. Install Fail2Ban and Postfix (optional, for email notifications) using the package manager:
30+
```bash
3331
sudo apt-get install fail2ban postfix
3432
```
35-
2. Choose `Internet Site` when asked for the configuration:
33+
2. During Postfix installation, select Internet Site when prompted for configuration.
3634
<Lightbox image={image} alt="" />
37-
3. Once the installation has completed, open the file `/etc/aliases` and add the following line:
35+
36+
3. After installation, edit `/etc/aliases` to configure email notifications:
37+
```bash
38+
sudo nano /etc/aliases
3839
```
40+
41+
4. Add the following line, replacing [email protected] with your email address:
42+
```bash
3943
root: [email protected]
4044
```
4145

42-
Make sure to replace `[email protected]` with your actual email address.
43-
44-
<Message type="tip">
45-
To receive notifications by email, it is required that the [email ports are unlocked](/instances/how-to/send-emails-from-your-instance/).
46-
</Message>
46+
5. Save the file, exit nano and run the following command:
47+
```bash
48+
sudo newaliases
49+
```
50+
<Message type="note">
51+
- To receive email notifications, ensure outbound email ports (e.g., 25, 587) are open on your server.
52+
- Postfix is optional. Alternatives like `ssmtp` or external SMTP services can be used for notifications.
53+
</Message>
4754

4855
## Configuring Fail2Ban
4956

50-
1. Start by copying the configuration file:
51-
```
57+
1. Copy the default configuration file to create a custom configuration:
58+
```bash
5259
cd /etc/fail2ban && sudo cp jail.conf jail.local
5360
```
61+
The jail.local file overrides jail.conf for custom settings, preserving the default configuration.
5462

55-
The file `jail.conf` contains the default parameters. If a file `jail.local` is available, it will have priority over `jail.conf` if parameters are modified.
56-
2. Edit the file `/etc/fail2ban/jail.local` with your preferred editor.
57-
58-
Following are the parameters which should be modified:
59-
- `ignoreip = 127.0.0.1/8` - By default the IPs of localhost are ignored, self-banning would not be very useful. It is possible to exclude other IPs from being banned.
60-
- `bantime = 600` - The duration of a ban. By default, it is set to 10 Minutes. The value has to be specified in seconds and it is recommended to set it at least to one hour, or one day.
61-
- `findtime = 600` - The timespan which will be considered for maxretry. If you want for example to ban somebody who made more than 3 malicious attempts during the last hour or, as here, in the last 10 minutes.
62-
- `maxretry = 3` - Amount of attempts before being banned.
63-
- `destemail = root@localhost` - The recipient of the mail. As an alias for root has been set during the installation, this value can be left as it is.
64-
- `sendername = Fail2Ban` - The name of the sender of the mail.
65-
- `action = %(action_)s` - This defines the action to execute when a limit is reached.
66-
By default, it will only block the user.
67-
68-
To receive an email at each ban, set it to:
69-
70-
- `action = %(action_mw)`
71-
72-
To receive the logs with the mail, set it to:
73-
74-
- `action = %(action_mwl)`
75-
76-
Further down in the configuration file, it comes to the “Jails”. These are configurable blocks per service to filter logs and ban in cases where patterns are matched.
77-
As a minimum, it is recommended to activate the jail ssh as follows:
78-
```
79-
[ssh]
80-
81-
enabled = true
82-
port = ssh
83-
filter = sshd
84-
logpath = /var/log/auth.log
85-
```
86-
87-
<Message type="tip">
88-
If your SSH daemon is listening on multiple ports or a different port, you have to modify the line port with the correct parameters:
89-
For example:
90-
```
91-
port = ssh,1234
92-
```
93-
Fail2Ban analyses the logs and will ban the users who made several intrusion attempts on ports 22 (SSH by default) & 1234.
94-
</Message>
95-
3. Save the file once you have edited it.
96-
97-
Fail2Ban uses filters, pre-made configuration files indicating what to parse in a log.
98-
99-
They can be found in `/etc/fail2ban/filter.d`.
100-
You can create your own filters in case you need to.
101-
4. Restart the service to take the actions into effect:
63+
2. Edit `/etc/fail2ban/jail.local` with your preferred editor (e.g., nano):
64+
```bash
65+
sudo nano /etc/fail2ban/jail.local
66+
```
67+
Modify the following parameters:
68+
```bash
69+
ignoreip = 127.0.0.1/8 - Ignores localhost IPs to prevent self-banning. Add other trusted IPs if needed (e.g., 127.0.0.1/8 192.168.1.0/24).
70+
bantime = 3600 - Duration of a ban, set to 1 hour (3600 seconds) by default in newer versions. Consider increasing to 86400 (1 day) for stronger protection.
71+
findtime = 3600 - Time window for counting failed attempts (1 hour). Adjust to 600 (10 minutes) for stricter monitoring if preferred.
72+
maxretry = 5 - Number of failed attempts before a ban. The default in Ubuntu 24.04 is 5.
73+
destemail = root@localhost - Email recipient for notifications. Leave as is if /etc/aliases is configured.
74+
sendername = Fail2Ban - Sender name for notification emails.
75+
banaction = nftables[multiport] - Default ban action using nftables, which is preferred in Ubuntu 24.04 over iptables.
76+
action = %(action_mwl)s - Sends email with logs when banning. Use %(action_mw)s for email without logs, or %(action_)s for no email.
10277
```
103-
sudo service fail2ban restart
78+
79+
3. Enable the SSH jail by ensuring the following configuration is present:
80+
```bash
81+
[sshd]
82+
enabled = true
83+
port = ssh
84+
filter = sshd
85+
logpath = /var/log/auth.log
86+
```
87+
If your SSH service uses a non-standard port, update the `port` line. For example, for ports 22 and 1234:
88+
```
89+
port = ssh,1234
90+
```
91+
Fail2Ban will monitor the specified ports for intrusion attempts.
92+
<Message type="tip">
93+
For systems using `systemd` logging (e.g., Proxmox), use:
94+
```
95+
[sshd]
96+
enabled = true
97+
port = ssh
98+
filter = sshd
99+
logpath = %(sshd_log)s
100+
backend = systemd
101+
```
102+
</Message>
103+
104+
4. Save the file.
105+
Fail2Ban uses filter files in `/etc/fail2ban/filter.d` to parse logs. The `sshd` filter is pre-configured for SSH. Custom [filters](https://fail2ban.readthedocs.io/en/latest/filters.html) can be created for other services.
106+
107+
5. Restart Fail2Ban to apply changes:
108+
```bash
109+
sudo systemctl restart fail2ban
104110
```
105111
106-
The service will now analyze the connections made to the SSH service. The logs of Fail2Ban are located in the file `var/log/fail2ban.log`.
112+
Fail2Ban will now monitor SSH connections. Check logs at `/var/log/fail2ban.log` for activity.

0 commit comments

Comments
 (0)