fail2ban brute-force protection
high on-server
What it inspects
Looks for this finding: fail2ban is missing, stopped or has no active jails. `systemctl is-active fail2ban` and `fail2ban-client status` (as root), reading the `Number of jail` line. It fails if fail2ban is not active, warns if it is active with zero jails or an unhealthy daemon, and passes with one or more jails. When SSH is not publicly reachable, a missing fail2ban is only an informational warning.
Why it matters
Finding: fail2ban is missing, stopped or has no active jails. fail2ban watches authentication logs and temporarily firewalls addresses that repeatedly fail to log in. That blunts password guessing and reduces log noise. It complements key-only SSH rather than replacing it, and it only helps if a jail such as sshd is actually enabled.
How to verify
systemctl is-active fail2ban; sudo fail2ban-client statusHow to fix
Clears the finding "fail2ban is missing, stopped or has no active jails". Install fail2ban, enable the sshd jail through a jail.d file, restart the service, and confirm with fail2ban-client status sshd.
Install fail2ban and enable the sshd jail
Debian / Ubuntu
# If sshd listens on a port other than 22, also add: port = <that port> under [sshd] below.
apt-get install -y fail2ban python3-systemd
install -m 0644 /dev/stdin /etc/fail2ban/jail.d/umbermark-sshd.local <<'EOF'
[DEFAULT]
# Add your own admin IP(s) here so you cannot ban yourself, e.g. ignoreip = 127.0.0.1/8 ::1 203.0.113.7
ignoreip = 127.0.0.1/8 ::1
[sshd]
enabled = true
backend = systemd
EOF
systemctl enable fail2ban
systemctl restart fail2ban
# The server needs a moment to open its socket after a restart; wait for it (at most about 15 seconds).
for _ in $(seq 1 15); do fail2ban-client ping >/dev/null 2>&1 && break; sleep 1; done
fail2ban-client status sshd
RHEL / Rocky / Alma / Fedora
# epel-release exists on Rocky/Alma/CentOS Stream; on RHEL itself enable EPEL first (see the Fedora EPEL docs).
# If sshd listens on a port other than 22, also add: port = <that port> under [sshd] below.
. /etc/os-release; [ "$ID" = fedora ] || dnf install -y epel-release
dnf install -y fail2ban python3-systemd
install -m 0644 /dev/stdin /etc/fail2ban/jail.d/umbermark-sshd.local <<'EOF'
[DEFAULT]
# Add your own admin IP(s) here so you cannot ban yourself, e.g. ignoreip = 127.0.0.1/8 ::1 203.0.113.7
ignoreip = 127.0.0.1/8 ::1
[sshd]
enabled = true
backend = systemd
EOF
systemctl enable fail2ban
systemctl restart fail2ban
# The server needs a moment to open its socket after a restart; wait for it (at most about 15 seconds).
for _ in $(seq 1 15); do fail2ban-client ping >/dev/null 2>&1 && break; sleep 1; done
fail2ban-client status sshd