RASPI: Installing and configuring fail2ban on the RaspberryPi

Wikipedia:

Fail2ban operates by monitoring log files (e.g. /var/log/auth.log, /var/log/apache/access.log, etc.) for selected entries and running scripts based on them. Most commonly this is used to block selected IP addresses that may belong to hosts that are trying to breach the system's security. It can ban any host IP address that makes too many login attempts or performs any other unwanted action within a time frame defined by the administrator. Fail2ban is typically set up to unban a blocked host within a certain period, so as to not "lock out" any genuine connections that may have been temporarily misconfigured. However, an unban time of several minutes is usually enough to stop a network connection being flooded by malicious connections, as well as reducing the likelihood of a successful dictionary attack.

Fail2ban is an intrusion protection software which will prevent brute force attempts from accessing your ssh service. This is accomplished by logging the failed attempts and banning the offending ip addresses in iptables.

In this short tutorial i will show you how to install and configure fail2ban on Raspbian in four easy steps.

---

Step 1) Update

First thing to do is update your repositories...
sudo apt-get update

Step 2) Install

Secondly install fail2ban...
sudo apt-get install fail2ban

After installing, fail2ban will now protect ssh with default settings, so it will work after installing. Section three will show you how to customize these configurations.

Step 3) Configure

3.1)

Now take a look in this file at the default configurations, focusing on the defaults at the top and those under [ssh]. Don't change anything, just take a look around as our configurations will not be added here.
sudo nano /etc/fail2ban/jail.conf


The default configurations are stored in the jail.conf file, however changes should not be directly  here, instead they should be added to the jail.local file. - By adding our amendments to the .local, we can avoid adding everything and just those that we want to override.

Now open up jail.local:
sudo nano /etc/fail2ban/jail.local

3.2)

Here are my settings. You can paste these directly in to the empty jail.local file in if you want and use them as a template.

[ssh]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
bantime = 600
banaction = iptables-allports
maxretry = 3
ignoreip = 127.0.0.1/8 192.168.1.0/24

What they mean: 

• 'enabled' is set to true so that fail2ban operates for ssh. 
• 'port' is what port to monitor, the default will be ssh (port 22). You may want to change this if you are running ssh on a different port than 22, but most users will use 22 however.
• 'logpath' is the default log file used by fail2ban to track login attempts.
• 'bantime' is measured in seconds and is the amount of time an offender will have to wait until attempting to connect again. The default is 600 seconds (10 minutes). To add permanent bans set this to -1 or bellow. 
• 'maxretry' is the amount of login attempts until the offender will be locked out.
• 'ignoreip' can be set to define ip addresses or subnets which the rules do not apply to. In the example i have added the loopback address and the private address space for my LAN. Change appropriately to suite your private addressing on your LAN.

In nano: ctrl+o saves, and ctrl+x exists.

Step 4) Restart fail2ban to take effect

Once the configurations are added to jail.local and saved, you can restart the fail2ban service for changes to take effect..
sudo service fail2ban restart

View banned ip addresses

sudo iptables -L INPUT -v -n | less

Note: keep in mind, whenever fail2ban is restarted, all the previous bans will be removed.