NDC & PKI

[Day 8] 3. Implementing Fail2Ban for SSH Protection on Linux (LAB 3)

D
DITISS Admin
••4 min read

1. Install Dependencies on the Victim Machine

On the victim machine (

192.168.80.128
), run the following command to install 
fail2ban
and related dependencies:

bash
sudo apt-get install -y iptables python3-systemd fail2ban
fail2ban-server --version

2. Check the Status of 
fail2ban
Service

To verify if 

fail2ban
is running, use:

bash
sudo systemctl status fail2ban

This will show a 

failed
status for now.

3. Modify Configuration

Since we should not modify the main configuration file (

jail.conf
), we will create a custom configuration file (
jail.local
). Follow these steps:

bash
ls -l /etc/fail2ban/jail.conf
sudo vim /etc/fail2ban/jail.local

4. Add SSH Settings in 
jail.local

Add the following lines to configure 

fail2ban
for SSH login attempts:

plaintext
[sshd]  # Header section for SSH service
backend = systemd
enabled = true
port = 22
filter = sshd
maxretry = 3
bantime = 3600
findtime = 600

Explanation of Keywords:

  • [sshd]: This section specifies the configuration for the SSH service.
  • backend = systemd: Specifies the logging backend to use. 
    systemd
    allows 
    fail2ban
    to monitor systemd logs.
  • enabled = true: Activates the filter for this service (SSH).
  • port = 22: Specifies the port on which SSH is running.
  • filter = sshd: Refers to the filter for SSH log messages (predefined in 
    /etc/fail2ban/filter.d/sshd.conf
    ).
  • maxretry = 3: The number of failed login attempts allowed before blocking the IP.
  • bantime = 3600: The time (in seconds) for which the IP will be blocked after exceeding the maximum number of retries (1 hour in this case).
  • findtime = 600: The time window (in seconds) in which the failed login attempts are counted (10 minutes).

5. Restart 
fail2ban
Service

After making changes, restart the service to apply them:

bash
sudo systemctl restart fail2ban
sudo systemctl status fail2ban

6. Check 
fail2ban
Status

To check the overall status of 

fail2ban
:

bash
sudo fail2ban-client status

To check the status for SSH specifically:

bash
sudo fail2ban-client status sshd

7. Check 
iptables
Status

To view the current list of blocked IPs and rules applied by 

fail2ban
:

bash
sudo iptables -L

8. Simulate an Attack from the Attacker Machine

On the attacker machine (

192.168.80.129
), simulate a failed SSH login attempt:

bash
ssh shuhari@192.168.80.128

Repeat the command three times (with invalid credentials) to trigger the blocking mechanism.

Expected Result:

  • The IP address (

    192.168.80.129
    ) will be blocked after three failed attempts.

  • On the victim machine (

    192.168.80.128
    ), check the logs to see details of the failed login attempts and the banning of the IP:

    • You can use the following to check the logs:
    bash
    sudo tail -f /var/log/auth.log
    • You should see logs regarding the failed SSH login attempts and the IP being banned.

Read Next

8/26/2026

[Day 8] 4. IPTABLES and Chains

### **1. Checking Chains of Different Tables** In `iptables`, tables contain chains for organizing and applying rules. Use the following commands t...

8/26/2026

[Day 8] 5. Full Tunnel and Split Tunnel VPN

### **1. Full Tunnel VPN** In a **Full Tunnel VPN**, **all your internet traffic** is routed through the VPN server, regardless of which website, a...