Tag: security

run the following command

nano /fail2ban.sh

Copy and paste the script below.

#!/bin/bash

# Fail2Ban auto-install and setup script (no sudo)

# Step 1: Update package list and install Fail2Ban and rsyslog
apt update && apt install fail2ban rsyslog -y

# Step 2: Ensure rsyslog is running and enabled on boot
systemctl start rsyslog
systemctl enable rsyslog

# Step 3: Configure rsyslog to log auth messages
if ! grep -q "^auth,authpriv.*" /etc/rsyslog.conf; then
    echo "auth,authpriv.*   /var/log/auth.log" >> /etc/rsyslog.conf
    echo "Configured rsyslog to log authentication messages."
fi

# Restart rsyslog to apply changes
systemctl restart rsyslog

# Step 4: Copy the default jail.conf to jail.local to prevent overwriting in updates
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# Step 5: Configure the SSH jail and other settings in jail.local
if ! grep -q "^\[DEFAULT\]" /etc/fail2ban/jail.local; then
    echo -e "\n[DEFAULT]\n" >> /etc/fail2ban/jail.local
fi

# Check and set bantime if it doesn't exist
if ! grep -q "^bantime" /etc/fail2ban/jail.local; then
    echo "bantime = 24h" >> /etc/fail2ban/jail.local
else
    sed -i 's/^bantime.*/bantime = 24h/' /etc/fail2ban/jail.local
fi

# Check and set findtime if it doesn't exist
if ! grep -q "^findtime" /etc/fail2ban/jail.local; then
    echo "findtime = 10m" >> /etc/fail2ban/jail.local
else
    sed -i 's/^findtime.*/findtime = 10m/' /etc/fail2ban/jail.local
fi

# Check and set maxretry if it doesn't exist
if ! grep -q "^maxretry" /etc/fail2ban/jail.local; then
    echo "maxretry = 5" >> /etc/fail2ban/jail.local
else
    sed -i 's/^maxretry.*/maxretry = 5/' /etc/fail2ban/jail.local
fi

# Configure the SSH jail
if ! grep -q "^\[sshd\]" /etc/fail2ban/jail.local; then
    echo -e "\n[sshd]\nenabled = true\nlogpath = /var/log/auth.log\n" >> /etc/fail2ban/jail.local
else
    sed -i 's/^enabled.*/enabled = true/' /etc/fail2ban/jail.local
    sed -i 's|^logpath.*|logpath = /var/log/auth.log|' /etc/fail2ban/jail.local
fi

# Step 6: Ensure SSH logging is enabled in /etc/ssh/sshd_config
# Handle LogLevel
if grep -q "^#LogLevel" /etc/ssh/sshd_config; then
    sed -i 's/^#LogLevel.*/LogLevel INFO/' /etc/ssh/sshd_config
elif grep -q "^LogLevel" /etc/ssh/sshd_config; then
    sed -i 's/^LogLevel.*/LogLevel INFO/' /etc/ssh/sshd_config
else
    echo "LogLevel INFO" >> /etc/ssh/sshd_config
fi

# Handle SyslogFacility
if grep -q "^#SyslogFacility" /etc/ssh/sshd_config; then
    sed -i 's/^#SyslogFacility.*/SyslogFacility AUTH/' /etc/ssh/sshd_config
elif grep -q "^SyslogFacility" /etc/ssh/sshd_config; then
    sed -i 's/^SyslogFacility.*/SyslogFacility AUTH/' /etc/ssh/sshd_config
else
    echo "SyslogFacility AUTH" >> /etc/ssh/sshd_config
fi

# Step 7: Restart SSH and Fail2Ban services to apply the changes
systemctl restart sshd
systemctl restart fail2ban

# Step 8: Enable Fail2Ban on boot
systemctl enable fail2ban

echo "Fail2Ban and rsyslog have been installed and configured successfully."

CTRL + O Then CTRL + X to Save and Close the file.

Now run the following command to sent the scripts permissions

chmod 755 /fail2ban.sh

Now we need to run the script to automatically install and setup fail2ban

./fail2ban.sh