Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

The default settigs of fail2ban are usually good enough but you can also customize fail2ban to suit your needs.

After a day or so on the Internet you should start seeing people getting banned in the logs, /var/log/fail2ban.log. Here is an example of an ip getting banned and then after 10 minutes it unbans,

...

This is basic Ubuntu Security. Continue to More Linux Security.

 

Note

This article can be enhanced with a strategy and write up on the following triggers,

  • Alert me when a sudo capable account logs in.
  • Alert me when serveradmin logs in.
  • Alert me when accounts fail sudo attempts.

covers Intrusion detection and more advanced techniques.