Installing and Configuring Fail2ban on Raspberry Pi

In this article, we will show you how to install and configure Fail2ban on a Raspberry Pi.
Fail2ban is essential software for improving the security of your Raspberry Pi, especially if it is publicly accessible over the internet, as it provides a form of active defence.
For those who don’t know what Fail2ban is, it is software that attempts to block malicious connections to a device, in our case the Raspberry Pi. It is important if you use SSH or run a publicly accessible web server.

Fail2ban works by continuously analysing log files for signs of potential attacks. These signs can include, for example, too many failed password attempts, scanning for exploits and much more. Once it detects unusual activity, Fail2ban automatically updates the firewall to ban the IP address the attack is coming from.

Installing and configuring Fail2ban

Before installing Fail2ban on your Raspberry Pi, first make sure the system is fully up to date.
You can do this very simply by running the following commands in the terminal on the Raspberry Pi.

sudo apt-get update
sudo apt-get upgrade

With Raspbian up to date, you can proceed to install Fail2ban by running the following command on the Raspberry Pi.

sudo apt-get install fail2ban -y

During installation, fail2ban generates a file called “jail.conf”.
We need to make a copy of this file and name it “jail.local”; fail2ban will automatically detect this file and load it into its configuration.
Copy the file by running the following command in the terminal on the Raspberry Pi.

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Now open the file you just copied and take a look at the default configuration Fail2ban starts with.

Open the file in the nano editor by running the following command on your Raspberry Pi.

sudo nano /etc/fail2ban/jail.local

Inside this file, press CTRL + W to search, then search for “[sshd]”. It should look like this.

Now, to enable this section and set the SSHD filter, add the two lines shown below immediately under the “[sshd]” text you found in the previous step.

enabled = true
filter = sshd

The first line we are adding to this configuration file enables Fail2ban to process these rules for the specified port.
The second line tells Fail2ban to use the file “/etc/fail2ban/filter.d/sshd.conf” to filter connections to the SSH port.

As well as enabling and setting the filter, you can also change what Fail2ban does when one of these filters is triggered.
To set the ban action, you can use the following line. In the example below, we use the “iptables-multiport” ban action.
This action bans the user who triggered the filter and prevents them from accessing any port on the device.

banaction = iptables-multiport

You can find more actions in the /etc/fail2ban/action.d/ folder, for example if you want to block a malicious user on all ports.

As well as setting the ban action, you can also set how many attempts a user can make before being banned, and for how long they should be blocked.
To do this, use the following two values; we have set some example values, which are explained below.

bantime = -1
maxretry = 3

The first line (“bantime = -1”) sets how long you want the user to be banned for. This value is expressed in seconds; for example, 1800 seconds bans the user for 30 minutes.
If you want to ban the user indefinitely, simply set this value to -1, as shown in the example above.
The second line (“maxretry = 3”) defines how many attempts the user has before the ban action is triggered. In our example we have set this to 3, meaning the user has 3 attempts before being banned from accessing the device on all ports.

Once you have finished configuring the [sshd] section with a ban action, ban time and maximum retries, as well as enabling and setting the filter, the result should look like the example below.

[sshd]
enabled = true
filter = sshd
port = ssh
banaction = iptables-multiport
bantime = -1
maxretry = 3
logpath = %(sshd_log)s
backend = %(sshd_backend)s

If you are happy with the changes, save the file by pressing CTRL+O, then CTRL+X to close the nano editor.

You should now have a Raspberry Pi with Fail2ban up and running correctly. To make Fail2ban load the settings you have just configured, run the following command:

sudo service fail2ban restart

Apache & Nginx Web Servers

You can also protect your Apache or Nginx web server with Fail2Ban. The setup is very similar to what we did for SSH. Below is an example for an Apache web server.

If you want to enable Apache protection against bad bots, open the local jail file with the following command.

sudo nano /etc/fail2ban/jail.local

Locate the section called [apache-badbots]; you can use CTRL+W to find it.

Under this heading, add the following two lines.

enabled = true
filter = apache-badbots

The filter name will usually be the same as the module name unless you are using a custom configuration file. So [apache-badbots] will have a filter name of apache-badbots.
You can view all the filter configuration files in the following directory; the ls command lists all the files in the specified folder.

ls /etc/fail2ban/filter.d/

Once you have finished editing the jail.local file, save it by pressing CTRL + O, Enter to confirm, and then CTRL+X to close the editor.

Finally, remember to restart the Fail2Ban service on the Raspberry Pi every time you make a change.

sudo service fail2ban restart

I hope this Fail2Ban on Raspberry Pi tutorial has helped you learn how to install and configure the software, and has shown the benefits of using a tool like Fail2Ban.
If you have any feedback on this tutorial or on setting up and configuring Fail2Ban on your Raspberry Pi, feel free to leave a comment below.

Enjoy!