Linux - how to setup fail2ban

Model situation: We have a Linux server with SSH access and we want to secure SSH service against brute force attack. Ie. after several unsuccessful SSH login attempts, we want to set a temporary block for the IP address from which the SSH login attempt is made. The fail2ban package is intended for this purpose.

REPLY

Perform fail2ban installation and enable the service
apt install fail2ban && systemctl enable fail2ban

Add jail for sshd service
vim /etc/fail2ban/jail.local

[DEFAULT]
# Ban hosts for one hour:
bantime = 3600

# Override /etc/fail2ban/jail.d/00-firewalld.conf:
banaction = iptables-multiport

[sshd]
enabled = true

Restart fail2ban
systemctl restart fail2ban

Appendix

Last logs
tail /var/log/fail2ban.log

Status of sshd jail
fail2ban-client status sshd

Remove blocked IP address 10.11.10.10 from sshd jail
fail2ban-client set sshd unbanip 10.11.10.10