Hack The Sec-Leading Resource Of Linux Tutorial: fail2ban ssh

COPY PUTTY (SSH) SESSIONS TO NEW OR OTHER COMPUTER

<p> <b><u><span style="font-size: large;">COPY PUTTY (SSH) SESSIONS TO NEW/OTHER COMPUTER</span></u></b></p><p><span face="Lato, sans-serif" style="color: #2b2b2b; font-size: 16px;"><br /></span></p><p><span face="Lato, sans-serif" style="color: #2b2b2b; font-size: 16px;">I’m a huge fan of putty – available for download at:</span><span face="Lato, sans-serif" style="color: #2b2b2b; font-size: 16px;"> </span><a href="https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html" style="border: 0px; color: #24890d; font-family: inherit; font-size: 16px; font-style: inherit; font-weight: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Download PuTTY: latest release (0.78) (greenend.org.uk)</a></p><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiw6DmAPtJ_KtkLaWWcNiyFLTjlTgHEIc21VnBrMUjL4BZtlyMXXsjeMU7lBX91pK0N-blwlF02TCDRhaXA2kdojQFqOetYjidlc-nMYXzFoU0oEdkVFLeucqFLMuaSfVlD0vEDBxPMAyvMiUsAvzqiBgxZB5pLGhr-TZEhRWzMV5rTqYtpkVz92M/s1200/PuTTY_Icon_upstream.svg.png" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" data-original-height="1200" data-original-width="1200" height="212" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiw6DmAPtJ_KtkLaWWcNiyFLTjlTgHEIc21VnBrMUjL4BZtlyMXXsjeMU7lBX91pK0N-blwlF02TCDRhaXA2kdojQFqOetYjidlc-nMYXzFoU0oEdkVFLeucqFLMuaSfVlD0vEDBxPMAyvMiUsAvzqiBgxZB5pLGhr-TZEhRWzMV5rTqYtpkVz92M/w212-h212/PuTTY_Icon_upstream.svg.png" width="212" /></a></div><br /><p><br /></p><p style="border: 0px; color: #2b2b2b; font-family: Lato, sans-serif; font-size: 16px; margin: 0px 0px 24px; outline: 0px; padding: 0px; vertical-align: baseline;">Over time, I tend to accumulate a large number of saved “sessions” that I find it useful to either move to a new computer, or save/backup. He</p><p style="border: 0px; color: #2b2b2b; font-family: Lato, sans-serif; font-size: 16px; margin: 0px 0px 24px; outline: 0px; padding: 0px; vertical-align: baseline;"><code style="border: 0px; font-family: monospace, serif; font-size: 15px; font-style: inherit; font-weight: inherit; hyphens: none; line-height: 1.6; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">regedit /ea c:\Users\mark\dropbox\_mark\puttycopy.reg HKEY_CURRENT_USER\Software\SimonTatham\PuTTY</code></p><p style="border: 0px; color: #2b2b2b; font-family: Lato, sans-serif; font-size: 16px; margin: 0px 0px 24px; outline: 0px; padding: 0px; vertical-align: baseline;">Copied that puttycopy.reg to the new drive/computer.</p><p style="border: 0px; color: #2b2b2b; font-family: Lato, sans-serif; font-size: 16px; margin: 0px 0px 24px; outline: 0px; padding: 0px; vertical-align: baseline;">To add the saved sessions, just double clicked on that .reg file on the new computer.</p>

COPY PUTTY (SSH) SESSIONS TO NEW OR OTHER COMPUTER

COPY PUTTY (SSH) SESSIONS TO NEW/OTHER COMPUTER I’m a huge fan of putty – available for download at: Download PuTTY: latest release (0.7...

How to protect your SSH server with Fail2Ban on Ubuntu

<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 class="entry-title" itemprop="headline" style="background-color: #fdfdfd; box-sizing: border-box; font-family: proxima-nova, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-weight: 500; line-height: 1.1; margin: 21px 0px 0px;">
<span style="color: red; font-size: x-large;"><u><i>Protect your SSH server with Fail2Ban on Ubuntu</i></u></span></h1>
<div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">The most suitable application for this purpose is <a href="http://www.hackthesec.co.in/search/label/fail2ban" target="_blank">Fail2ban</a>. It is an intrusion prevention framework written in the Python programming language. It is able to run on servers that have an interface to a packet-control system or firewall installed locally. </span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_4cJIHMGOWul32IjKw2UHT3plp2cfuBxHMY7xFOQn3stZVpLEMarRug4jdQoFnKOtnQlH0Kr_lploQv_re2tP7msBLfE9WnJY18x5OiRKH12pqZMMiA_R0LCFsuAnMTxPffsoA6WjiHso/s1600/fail2ban_www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_4cJIHMGOWul32IjKw2UHT3plp2cfuBxHMY7xFOQn3stZVpLEMarRug4jdQoFnKOtnQlH0Kr_lploQv_re2tP7msBLfE9WnJY18x5OiRKH12pqZMMiA_R0LCFsuAnMTxPffsoA6WjiHso/s1600/fail2ban_www.hackthesec.co.in.jpg" /></a></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;"><br /></span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">It scans log files and bans IPs that show the malicious signs — too many password failures, seeking for exploits, etc. In order to install <a href="http://www.hackthesec.co.in/search/label/fail2ban" target="_blank">fail2ban</a>, make sure your repositories are up to date and simply install it:</span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<strong style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;"><span style="color: #0e0e0e; font-family: Open Sans, serif, sans-serif;"><span style="display: block; font-size: 18px; line-height: 1.4em; max-height: 200px;"></span></span></strong></div>
<ul style="text-align: left;">
<li><strong style="background-color: white; color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;"><span style="color: #0e0e0e; font-family: Open Sans, serif, sans-serif;"><strong style="color: #333333; font-family: Verdana, Geneva, sans-serif; font-size: 12px; line-height: 19.2px;"><span style="color: #0e0e0e; font-family: Open Sans, serif, sans-serif;"><span style="font-size: 18px; line-height: 1.4em; max-height: 200px;"><a href="http://www.hackthesec.co.in/2016/01/how-to-protect-sshftp-using-fail2ban-on.html" target="_blank">How To Protect SSH/FTP using Fail2ban on CentOS/RHEL</a></span></span></strong></span></strong></li>
</ul>
<br />
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10.5px; overflow: auto; padding: 10px; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; padding: 0px; white-space: pre-wrap;"><span style="font-size: large;"># apt-get update
# apt-get install fail2ban</span></code><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: inherit; padding: 0px; white-space: pre-wrap;">
</code></pre>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">Once it is installed, it puts sample configuration file in <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; font-size: 16.2px; padding: 2px 4px;"><b>/etc/fail2ban/jail.conf</b></code>. We should copy the sample configuration file in <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; font-size: 16.2px; padding: 2px 4px;"><b>/etc/fail2ban/jail.local</b></code> and then, open file for editing using our favorite text editor. A lot of the possible services that we need to protect are already inside the sample file in their own section and there is DEFAULT section in the configuration file. Some of the important settings in this file are:</span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; margin-bottom: 10.5px;">
</div>
<ul style="text-align: left;">
<li><span style="font-family: Georgia, 'Times New Roman', serif; font-size: 18px; line-height: 28px;"><b>ignoreip</b>: We can use single IP, mask or a host name. IP addresses listed here will be excluded and will always be allowed to access the server</span></li>
<li><span style="font-family: Georgia, 'Times New Roman', serif; font-size: 18px; line-height: 28px;"><b>bantime</b>: The time (in seconds) that a host would be blocked from the server if they are found to be in violation of any of the defined rules. The default is set for 600 (10 minutes) but it should be increased to at least 30 minutes or more.</span></li>
<li><span style="font-family: Georgia, 'Times New Roman', serif; font-size: 18px; line-height: 28px;"><b>maxrwtry</b>: This is the number of incorrect login attempts allowed for a client before they get restricted to access the server. The default is 3.</span></li>
<li><span style="font-family: Georgia, 'Times New Roman', serif; font-size: 18px; line-height: 28px;"><b>backend</b>: specifies the backend used to get files modification. It should be set to “auto”</span></li>
<li><span style="font-family: Georgia, 'Times New Roman', serif; font-size: 18px; line-height: 28px;"><b>destemail</b>: We can specify email address where we want to get notifications when IP address is banned.</span></li>
</ul>
<br />
<div style="background-color: #fdfdfd; box-sizing: border-box; margin-bottom: 10.5px;">
</div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">Another important section is the ACTION section. Important lines here line describe that fail2ban will use the system iptables in order to ban suspicious IP address and specify the protocol that fail2ban will monitor which can be TCP or UDP.</span></div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10.5px; overflow: auto; padding: 10px; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; padding: 0px; white-space: pre-wrap;"><span style="font-size: large;">banaction = iptables-multiport
protocol = tcp</span></code><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: inherit; padding: 0px; white-space: pre-wrap;">
</code></pre>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">After we are done with the default settings and actions, we should setup our <a href="http://www.hackthesec.co.in/search/label/SSH" target="_blank">SSH </a>section which will make sure that the SSH access to our server is secured. Here is how the <a href="http://www.hackthesec.co.in/search/label/SSH" target="_blank">SSH </a>section should look inside the configuration file:</span></div>
<pre style="background-color: whitesmoke; border-radius: 4px; border: 1px solid rgb(204, 204, 204); box-sizing: border-box; color: #333333; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; line-height: 1.42857; margin-bottom: 10.5px; overflow: auto; padding: 10px; word-break: break-all; word-wrap: break-word;"><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; padding: 0px; white-space: pre-wrap;"><span style="font-size: large;">[ssh]

enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 4</span></code><code style="background-color: transparent; border-radius: 0px; box-sizing: border-box; color: inherit; font-family: Menlo, Monaco, Consolas, 'Courier New', monospace; font-size: inherit; padding: 0px; white-space: pre-wrap;">
</code></pre>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">This section makes <a href="http://www.hackthesec.co.in/search/label/SSH_Security" target="_blank">SSH monitoring active</a>, it listens on the SSH port for the ssh dameon, using the log file location <code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; font-size: 16.2px; padding: 2px 4px;"><b>/var/log/auth.log</b></code> and bans the IP address of the user that will have 4 failed login attempts.</span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">After all settings are made, we need to restart fail2ban and it will start monitoring the log files according to our settings, you can also check which rules are currently applied with the following <b><code style="background-color: #f9f2f4; border-radius: 4px; box-sizing: border-box; font-size: 16.2px; padding: 2px 4px;">iptables</code> </b>command.</span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;">Fail2ban is one of the most widely used applications when it comes to server security. It is very simple and effective, so you shouldn’t think twice in order to decide to install it on your server. It is a must have application.</span></div>
<div style="background-color: #fdfdfd; box-sizing: border-box; font-size: 18px; line-height: 28px; margin-bottom: 10.5px;">
<span style="font-family: Georgia, Times New Roman, serif;"><a href="http://www.hackthesec.co.in/">www.hackthesec.co.in</a></span></div>
</div>
</div>

How to protect your SSH server with Fail2Ban on Ubuntu

Protect your SSH server with Fail2Ban on Ubuntu The most suitable application for this purpose is Fail2ban . It is an intrusion prevent...

How To Protect SSH/FTP using Fail2ban on CentOS/RHEL

<div dir="ltr" style="text-align: left;" trbidi="on">
<span style="background-color: white; border: 0px; color: #555555; font-family: 'Roboto Slab'; font-size: 16px; font-weight: 700; line-height: 28px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"></span><br />
<h2 class="title single-title title20" style="-webkit-transition: opacity 0.24s ease-in-out; background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 28px; line-height: 38px; margin: 0px 0px 5px; opacity: 1; outline: 0px; padding: 0px; transition: opacity 0.24s ease-in-out; vertical-align: baseline; visibility: visible;">
<span style="color: #990000;">Protect SSH/FTP using Fail2ban on <span style="color: #990000;"><a href="http://www.hackthesec.co.in/search/label/Centos" target="_blank">CentOS</a>/<a href="http://www.hackthesec.co.in/search/label/RHEL" target="_blank">RHEL</a></span></span></h2>
<div>
<br /></div>
<span style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; font-weight: 700; line-height: 28px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Fail2ban</span><span style="background-color: white; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px;"> is very useful application for you, if you are managing security of server, or you are running your own vps or physical server. Fail2ban scan log files created on system and has ability to ban ips which found malicious bassed on configuration rules. We can use it for monitoring various system services logs like Apache, SSH and blog the ips which are trying to breach the system’s security.</span><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvYwtsMX3Bq2_cXxy4niiEgIqf37zBT4OxmPthki2VDo-2_0ZGme6o8Dh9MCx8WbtvpA4_X4oExHdUqhEhJyd4273kHqF-JYwU3ulTphv8qzTenWsVnqudq6s8eqXAhMzZesm-wnqwqIUw/s1600/fail2ban-on-centos_www.hackthesec.co.in.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="272" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvYwtsMX3Bq2_cXxy4niiEgIqf37zBT4OxmPthki2VDo-2_0ZGme6o8Dh9MCx8WbtvpA4_X4oExHdUqhEhJyd4273kHqF-JYwU3ulTphv8qzTenWsVnqudq6s8eqXAhMzZesm-wnqwqIUw/s640/fail2ban-on-centos_www.hackthesec.co.in.jpg" width="640" /></a></div>
<span style="background-color: white; color: #0b5394; font-family: 'Roboto Slab'; font-size: 24px; font-weight: bolder; line-height: 34px;"><br /></span>
<span style="background-color: white; color: #0b5394; font-family: 'Roboto Slab'; font-size: 24px; font-weight: bolder; line-height: 34px;">Step 1: Install EPEL RPM Repository</span><br />
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
<span style="font-size: large;"><span style="line-height: 28px;">Fail2ban is available in <a href="http://www.hackthesec.co.in/2016/01/how-to-install-epel-repo-on-centos-and.html" target="_blank">EPEL</a> repository, So make sure you have installed <a href="http://www.hackthesec.co.in/2016/01/how-to-install-epel-repo-on-centos-and.html" target="_blank">EPEL</a> repository in your system or you can use </span><a href="http://www.hackthesec.co.in/2016/01/how-to-install-epel-repo-on-centos-and.html" style="line-height: 28px; outline: none; text-decoration: none;" target="_blank">these instructions</a><span style="line-height: 28px;"> to install it.</span></span></div>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
<span style="line-height: 28px;"><br /></span><span style="font-size: 24px; font-weight: bolder; line-height: 34px;"><span style="color: #0b5394;">Step 2: Install Fail2ban Package</span></span></div>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
After installing required repository use yum package manager to install Fail2ban rpm package using following command.</div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; line-height: 1.3em; margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># yum install fail2ban<span style="font-size: 0.9em;">
</span></pre>
<h2 class="heading1" style="-webkit-transition: opacity 0.24s ease-in-out; background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 24px; font-weight: bolder; line-height: 34px; margin: 45px 0px 12px; opacity: 1; outline: 0px; padding: 0px; transition: opacity 0.24s ease-in-out; vertical-align: baseline; visibility: visible;">
<span style="color: #0b5394;">Step 3: Setup Fail2ban Default Configuration</span></h2>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
Fail2ban provides its own security configuration file <span style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-size: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">/etc/fail2ban/jail.conf</span>, but we need to create a copy of this file as <span style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-size: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">jail.local</span>.</div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; line-height: 1.3em; margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local<span style="font-size: 0.9em;">
</span></pre>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
Now we need to make necessory changes in jail.local file to create ban rules. Edit this file in your favorite editor and make changes in <span style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-size: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">[DEFAULT]</span> section.</div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; line-height: 1.3em; margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;"># "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will use as always allowed, 
# so add your system ip to protect your ip from banned.
<orange style="color: orange;">ignoreip = 127.0.0.1/8 192.168.1.0/24 11.22.33.44</orange>

# "bantime" is the total number of seconds that a host is banned (3600sec = 1 Hour ).
<orange style="color: orange;">bantime  = 3600</orange>

# A host is banned if it has generated "maxretry" during the last "findtime" seconds. as per below 
# settings, 2 minutes
<orange style="color: orange;">findtime  = 120</orange>

# "maxretry" is the number of failures before a host get banned.
<orange style="color: orange;">maxretry = 3 </orange><span style="font-size: 0.9em;">
</span></pre>
<h2 class="heading1" style="-webkit-transition: opacity 0.24s ease-in-out; background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 24px; font-weight: bolder; line-height: 34px; margin: 45px 0px 12px; opacity: 1; outline: 0px; padding: 0px; transition: opacity 0.24s ease-in-out; vertical-align: baseline; visibility: visible;">
<span style="color: #0b5394;">Step 4: Protect SSH/SFTP</span></h2>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
After completing default configuration, go down in the same file jail.local and update <span style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-size: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">[ssh-iptables]</span> section as below.</div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; line-height: 1.3em; margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=22, protocol=tcp]
           sendmail-whois[name=SSH, dest=root, sender=admin@hackthesec.co.in, sendername="Fail2Ban"]
logpath  = /var/log/secure
maxretry = 3<span style="font-size: 0.9em;">
</span></pre>
<h2 class="heading1" style="-webkit-transition: opacity 0.24s ease-in-out; background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 24px; font-weight: bolder; line-height: 34px; margin: 45px 0px 12px; opacity: 1; outline: 0px; padding: 0px; transition: opacity 0.24s ease-in-out; vertical-align: baseline; visibility: visible;">
<span style="color: #0b5394;">Step 5: Protect FTP (vsFTPd) Server</span></h2>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
Let’s protect your FTP (vsFTPd) server, Find the below entry of <span style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 0px; font-size: inherit; font-weight: 700; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">[vsftpd-iptables]</span> section and make changes as below. If you are not using vsFTPd, you can skip this section.</div>
<pre style="background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; line-height: 1.3em; margin-bottom: 20px; outline: 0px; overflow: auto; padding: 20px; vertical-align: baseline;">[vsftpd-iptables]

enabled  = true
filter   = vsftpd
action   = iptables[name=VSFTPD, port=21, protocol=tcp]
           sendmail-whois[name=VSFTPD, dest=admin@hackthesec.co.in]
logpath  = /var/log/vsftpd.log
maxretry = 5
bantime  = 1800<span style="font-size: 0.9em;">
</span></pre>
<h2 class="heading1" style="-webkit-transition: opacity 0.24s ease-in-out; background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 24px; font-weight: bolder; line-height: 34px; margin: 45px 0px 12px; opacity: 1; outline: 0px; padding: 0px; transition: opacity 0.24s ease-in-out; vertical-align: baseline; visibility: visible;">
<span style="color: #0b5394;">Step 6: Restart Fail2ban Service</span></h2>
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
After making all the changes save your file and restart Fail2ban service using following command.</div>
<br />
<div style="background-color: white; border: 0px; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin-bottom: 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
</div>
<div class="single-post-ad" style="background-color: white; border: 0px; clear: both; font-family: 'Roboto Slab'; font-size: 16px; line-height: 28px; margin: 0px 0px 20px; outline: 0px; padding: 0px; vertical-align: baseline;">
</div>
<br />
<pre style="-webkit-text-stroke-width: 0px; background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 1.3em; margin: 0px 0px 20px; orphans: auto; outline: 0px; overflow: auto; padding: 20px; text-align: start; text-indent: 0px; text-transform: none; vertical-align: baseline; widows: 1; word-spacing: 0px;"># service fail2ban restart
# chkconfig fail2ban on<span style="font-size: 0.9em;">
</span></pre>
<pre style="-webkit-text-stroke-width: 0px; background: none 0px 0px repeat scroll rgb(60, 60, 60); border-radius: 4px; border: 1px solid rgb(229, 229, 229); color: white; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 1.3em; margin: 0px 0px 20px; orphans: auto; outline: 0px; overflow: auto; padding: 20px; text-align: start; text-indent: 0px; text-transform: none; vertical-align: baseline; widows: 1; word-spacing: 0px;"><a href="http://www.hackthesec.co.in/" target="_blank">Hack The Security</a>
<a href="https://www.twitter.com/hackthesecurity" target="_blank">Hack The Security Twitter</a>
<a href="http://facebook.com/htsecu" target="_blank">Hack The Security Facebook</a></pre>
</div>

How To Protect SSH/FTP using Fail2ban on CentOS/RHEL

Protect SSH/FTP using Fail2ban on CentOS / RHEL Fail2ban is very useful application for you, if you are managing security of server, ...