fail2ban jail.local config - Ingress Server

By alecgarcia // 2 weeks ago

Clone

Configures fail2ban to protect against SSH brute force attacks, malicious bots, rate limit abuse, and vulnerability scanners. Run on load balancers or standalone web servers that receive direct internet traffic. Requires adding your IP to ignoreip after installation or modify the script to include it.

#!/bin/bash
set -e

# Ensure script is run as root
if [ "$EUID" -ne 0 ]; then
    echo "❌ This script must be run as root"
    echo "Please run with: sudo bash $0"
    exit 1
fi

echo "=== fail2ban jail.local config - Ingress Server ==="
echo ""

# Ensure fail2ban is installed
if ! command -v fail2ban-client &> /dev/null; then
    echo "fail2ban is not installed. Installing..."
    apt-get update
    apt-get install -y fail2ban
fi

# Backup existing config if it exists
if [ -f /etc/fail2ban/jail.local ]; then
    BACKUP_FILE="/etc/fail2ban/jail.local.backup.$(date +%Y%m%d_%H%M%S)"
    echo "Backing up existing jail.local to: $BACKUP_FILE"
    cp /etc/fail2ban/jail.local "$BACKUP_FILE"
fi

# Create jail.local
echo "Creating /etc/fail2ban/jail.local..."
cat > /etc/fail2ban/jail.local <<'EOF'
[DEFAULT]
# Use nftables (Ubuntu 24.04 / Debian 12+ default firewall)
banaction = nftables
banaction_allports = nftables[type=allports]

# Ban for 1 hour (increase after testing: 6h, 12h, 24h, 1w)
bantime  = 1h
findtime = 10m
maxretry = 5

# IMPORTANT: Add your IP addresses here to prevent lockout!
# Replace YOUR.IP.HERE with your actual IP address(es)
ignoreip = 127.0.0.1/8 ::1
# ignoreip = 127.0.0.1/8 ::1 YOUR.IP.HERE YOUR.OFFICE.IP.HERE

# SSH Protection (brute force attacks)
[sshd]
enabled = true
maxretry = 3
port = ssh
backend = systemd

# Nginx: Failed HTTP authentication attempts
[nginx-http-auth]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log

# Nginx: Malformed or suspicious requests
[nginx-bad-request]
enabled = true
port = http,https
logpath = /var/log/nginx/access.log
maxretry = 2

# Nginx: Rate limit violations (too many requests)
[nginx-limit-req]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log
maxretry = 10

# Nginx: Bots searching for vulnerabilities
[nginx-botsearch]
enabled = true
port = http,https
logpath = /var/log/nginx/error.log
maxretry = 2
EOF

# Test configuration before applying
echo ""
echo "Testing fail2ban configuration..."
if fail2ban-client -t; then
    echo "Configuration valid. Reloading fail2ban..."
    service fail2ban reload
    sleep 2
    echo ""
    echo "✅ fail2ban configured successfully!"
    echo ""
    echo "Active jails:"
    fail2ban-client status
    echo ""
    echo "⚠️  IMPORTANT NEXT STEPS:"
    echo "   1. Get your current IP: curl -4 ifconfig.co"
    echo "   2. Edit /etc/fail2ban/jail.local"
    echo "   3. Add your IP to the ignoreip line"
    echo "   4. Reload: sudo fail2ban-client reload"
    echo ""
    echo "💡 To increase ban time after testing:"
    echo "   Edit 'bantime' value: 1h | 6h | 12h | 24h | 1w"
else
    echo "❌ Configuration test failed!"
    if [ -f "$BACKUP_FILE" ]; then
        echo "Restoring backup..."
        cp "$BACKUP_FILE" /etc/fail2ban/jail.local
    fi
    exit 1
fi

Site maintained by Vince Mitchell.

Inspired by original by David Hemphill, Tanner Hearne, & Matt Stauffer.