Setting up fail2ban on Debian

Setting up fail2ban on Debian is an effective way to protect your server from brute-force attacks by banning IP addresses that show malicious signs, such as repeated failed login attempts. Here's a step-by-step guide on how to set it up:

Step 1: Install fail2ban

1. Update your package index:

   sudo apt update

2. Install fail2ban:

   sudo apt install fail2ban

Step 2: Configure fail2ban

After installing fail2ban, you need to configure it to protect your services, such as SSH. You will be editing configuration files located in /etc/fail2ban.

1. Copy the default configuration file for local use:

   sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

2. Edit the jail.local file:

   Open the configuration file in a text editor:

   sudo nano /etc/fail2ban/jail.local

3. Configure basic settings:

   Look for the [DEFAULT] section and modify the following options:

   • Ban Time: The duration of the ban (e.g., 10 minutes).

     bantime = 10m

   • Find Time: The duration within which the number of failed attempts is checked (e.g., 10 minutes).

     findtime = 10m

   • Max Retry: The number of failed attempts allowed before a ban is applied.

     maxretry = 5

   • Unban Time (optional): If you want the ban to last indefinitely, use:

     bantime = -1

4. Enable SSH protection : Look for the [sshd] section and make sure it is enabled by setting:

   [sshd]
   enabled = true

5. Whitelist trusted IP addresses (optional):

   If you have specific IPs or IP ranges you want to whitelist (e.g., your office or home IP), add them to the ignoreip directive under the [DEFAULT] section:

   ignoreip = 127.0.0.1/8 ::1 <your IP here>

6. Additional jail configurations :
   fail2ban comes with pre-configured jails for various services such as Nginx, Postfix, Dovecot, etc. If you want to protect these services, find the relevant section in jail.local, and set enabled = true for the ones you wish to protect.

Step 3: Start and Enable fail2ban

Once your configuration is ready, start and enable fail2ban:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

Step 4: Verify fail2ban Status

To check the status of fail2ban and ensure it is running correctly:

sudo systemctl status fail2ban

You can also check the status of a specific jail, like the SSH jail:

sudo fail2ban-client status sshd

This will show the currently active jails, banned IPs, and other information.

Step 5: Monitor Logs

fail2ban logs all its actions in the log file /var/log/fail2ban.log. You can monitor this file to ensure fail2ban is working as expected:

sudo tail -f /var/log/fail2ban.log

Step 6: Unban an IP (if needed)

If you accidentally ban your own IP or another trusted IP, you can unban it using the following command:

sudo fail2ban-client set sshd unbanip <IP_ADDRESS>

This setup should provide basic protection for your server from brute-force attacks. You can expand the protection by configuring more jails for additional services based on your server's needs.

To disable sshd from listening on IPv4 in Debian, you need to modify the SSH server configuration file (/etc/ssh/sshd_config). Follow these steps:

1. Edit the sshd_config file:

   sudo nano /etc/ssh/sshd_config

2. Find the ListenAddress directives in the file. By default, SSH listens on all available network interfaces and IP addresses. To restrict it to only IPv6, you will need to add or modify a ListenAddress directive to only listen on IPv6.

3. Set SSH to listen only on IPv6 :

   Add the following line to specify that SSH should only listen to IPv6 addresses:

   ListenAddress ::
   

   This line tells sshd to listen on all available IPv6 addresses.

4. Save and exit the file by pressing Ctrl+X, then Y, and Enter.

5. Restart the SSH service to apply the changes:

   sudo systemctl restart sshd

This will prevent SSH from listening on IPv4 addresses while still allowing connections over IPv6. You can confirm this by running the following command:

sudo ss -tuln | grep ssh

You should see that SSH is only listening on IPv6 (::) and not on any IPv4 addresses.

To allow both inbound and outbound traffic for TCP port 4662 and UDP port 4672 using ufw, you can use the following commands:

1. Allow inbound and outbound TCP traffic on port 4662:

   sudo ufw allow 4662/tcp

2. Allow inbound and outbound UDP traffic on port 4672:

   sudo ufw allow 4672/udp

These commands will enable both inbound and outbound traffic for the specified ports. You can verify the rules with:

sudo ufw status

This will show you the list of active rules in your ufw configuration.