Fail2ban

Installation

apt-get install fail2ban

Configuration

Edit the configuration file

vim /etc/fail2ban/jail.conf

Default (generic) properties

 
[DEFAULT]
ignoreip = 127.0.0.1/8
...
# "bantime" is the number of seconds that a host is banned.
bantime  = 3600

SSH configuration

Enable and adjust:

• SSH port
• SSH-DDOS

 
[ssh]
enabled  = true
#port     = ssh
port     = 2200
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 4

...

[ssh-ddos]
enabled  = false
#port     = ssh
port     = 2200
filter   = sshd-ddos
logpath  = /var/log/auth.log
maxretry = 6