How to protect SSH using fail2ban on CentOS 6
If your SSH server is vulnerable to password-cracking attacks, this guide shows how to protect SSH from malicious login attempts using the fail2ban package on CentOS 6.
Installation
Enable the EPEL repository and install fail2ban:
sudo yum install epel-release
sudo yum install fail2banConfiguration
Create a local jail configuration file:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.localFind or add the [ssh-iptables] section:
[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
logpath = /var/log/secure
maxretry = 5
bantime = 600
findtime = 600- maxretry: Number of failures before a ban is triggered.
- bantime: Ban duration in seconds (600 = 10 minutes).
- findtime: Time window in which failures are counted.
Starting and enabling fail2ban
sudo service fail2ban start
sudo chkconfig fail2ban onChecking status
sudo fail2ban-client status ssh-iptablesUnbanning an IP address
sudo fail2ban-client set ssh-iptables unbanip 203.0.113.5Viewing banned IPs via iptables
sudo iptables -L -n | grep fail2ban