Intermediate LevelLinux Commands & SysAdmin
How does Fail2ban protect SSH and web servers from brute-force authentication attacks?
❓ Interview Prompt: Explain Fail2ban, monitoring log files (jail.local), regex matching, dynamic firewall BAN triggers, and unbanning IPs.
Fail2ban is an automated security daemon that scans system log files for repeated authentication failures and dynamically inserts firewall drop rules against offending IP addresses:
Configuration ('jail.local'):
•
'findtime = 10m': Time window for monitoring failures.
•
'maxretry = 5': Maximum allowed failures before banning.
•
'bantime = 1h': Duration of IP firewall block.
Code Implementation Example
ini
# /etc/fail2ban/jail.local - Protecting SSH service
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 3
bantime = 24h💡Fail2ban jail configuration blocking brute-force SSH attacks.
🎯 Interview Key Takeaway
Deploy Fail2ban to automatically block IP addresses exhibiting brute-force authentication failure patterns.
#Fail2ban#Security#Brute-Force#Firewall#Intermediate
Back to all Linux Commands & SysAdmin Questions→