Fail2ban
With Fail2ban we can block IPs that want to connect to our device, here I am going to explain how to configure the blocking when they try to connect via ssh
This notebook has been automatically translated to make it accessible to more people, please let me know if you see any typos.
Installation
The installation is very simple, we only have to make
sudo apt update
sudo apt install fail2ban
Configuration file
Once installed, we modify the configuration file by doing the following
sudo nano /etc/fail2ban/jail.conf
We go down to the part where [sshd]
is, in my case I have left it like this
[sshd]
bantime = 172800
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 3
What it does is that if someone makes 3 connection retries, it bans that IP for 48 hours (172800 seconds).
Review logs
We can check through the logs whether any IP has been blocked with
cat /var/log/fail2ban.log