fail2ban is the first line of defence against automated attacks. Configured properly, it stops 99% of brute-force traffic.
Installation
apt install fail2ban systemctl enable --now fail2ban
Base configuration in /etc/fail2ban/jail.local
[DEFAULT] bantime = 3600 ; 1 hour findtime = 600 ; within 10 minutes maxretry = 5 ignoreip = 127.0.0.1 1.2.3.4 ; your own IP [sshd] enabled = true port = 2222 ; if you changed the SSH port logpath = /var/log/auth.log [nginx-http-auth] enabled = true logpath = /var/log/nginx/error.log [nginx-botsearch] enabled = true logpath = /var/log/nginx/access.log maxretry = 2
WordPress protection (VPS without a control panel)
[wordpress] enabled = true filter = wordpress logpath = /var/log/nginx/access.log maxretry = 3 bantime = 86400
The filter in /etc/fail2ban/filter.d/wordpress.conf:
[Definition] failregex = ^<HOST>.*"POST /wp-login.php
The recidive jail — long bans for repeat offenders
[recidive] enabled = true logpath = /var/log/fail2ban.log bantime = 604800 ; 1 week findtime = 86400 maxretry = 3
Checking it works
fail2ban-client status fail2ban-client status sshd
Need this set up? Order fail2ban configuration for your VPS.
