fail2ban Configuration

fail2ban on BlitzPress

fail2ban monitors log files for signs of abuse (failed logins, exploit attempts) and automatically bans offending IPs using the firewall. BlitzPress pre-configures fail2ban for SSH protection.

How It Works

1. fail2ban watches log files (e.g., /var/log/auth.log)
2. When it detects repeated failures matching a pattern (filter), it triggers an action
3. The default action bans the IP via iptables/nftables for a configurable duration

Checking Status

# List all active jails
sudo fail2ban-client status

# Check specific jail status and banned IPs
sudo fail2ban-client status sshd

Unbanning an IP

sudo fail2ban-client set sshd unbanip 1.2.3.4

Whitelisting IPs

To permanently whitelist an IP (e.g., your office), create a jail override:

sudo tee /etc/fail2ban/jail.d/whitelist.conf <<EOF
[sshd]
ignoreip = 127.0.0.1/8 ::1 YOUR_OFFICE_IP
EOF
sudo fail2ban-client reload

Adding a WordPress Login Jail

Protect wp-login.php from brute force. Create a filter:

sudo tee /etc/fail2ban/filter.d/wordpress.conf <<EOF
[Definition]
failregex = ^<HOST> .* "POST /wp-login.php
ignoreregex =
EOF

Add the jail:

sudo tee /etc/fail2ban/jail.d/wordpress.conf <<EOF
[wordpress]
enabled  = true
port     = http,https
filter   = wordpress
logpath  = /home/*/logs/access.log
maxretry = 10
findtime = 300
bantime  = 3600
EOF
sudo fail2ban-client reload

Checking Banned IP History

sudo fail2ban-client get sshd banned
sudo zgrep "Ban" /var/log/fail2ban.log*

Configuration Reference

Setting	Default	Description
maxretry	5	Failures before ban
findtime	600	Time window for counting failures (seconds)
bantime	600	Ban duration (seconds). Use -1 for permanent