CDTCyber Duct Tape

Home / Knowledge Base / Open source

Linux security automation

Harden SSH, web, and mail services with Fail2ban

The Fail2ban Hardening Installer is a conservative Bash tool for deploying useful jails while preserving existing configuration, validating its output, and providing a rollback path.

Fail2ban turns repeated authentication failures and suspicious log patterns into temporary bans. The hard part is deploying it without enabling irrelevant jails, breaking an existing firewall setup, or locking out the administrator.

The open-source Fail2ban Hardening Installer detects applicable services, protects SSH, and can enable jails for Nginx, Apache, Postfix, and Dovecot. On cPanel or CSF hosts, it avoids replacing CSF with firewalld and selects iptables actions.

Preview the change first

git clone https://github.com/itchyitchy123/install_fail2ban.git
cd install_fail2ban
sudo ./install-fail2ban.sh --dry-run

Read the proposed configuration and confirm the detected logs, SSH port, trusted networks, and enabled jails. Do not pipe an unreviewed download into a root shell.

Protect your own access

  • Add your management IP or network to --ignore-ip.
  • Confirm a nonstandard SSH port with --ssh-port.
  • Keep a second administrative session open during the first deployment.
  • Verify that access logs use a format expected by the selected web filters.
  • Remember that Fail2ban supplements patching, service hardening, and firewall policy; it does not replace them.
sudo ./install-fail2ban.sh \
  --ssh-port 2222 \
  --ignore-ip "127.0.0.1/8 ::1 192.0.2.0/24" \
  --ban-time 2h \
  --max-retry 4

What the installer changes

It installs the distribution package, writes one managed jail file and two custom filters, then validates the configuration before enabling and restarting Fail2ban. Existing managed configuration receives a timestamped backup. It does not edit SSH daemon, web server, mail server, or firewall configuration.

The scanner filter recognizes repeated requests for common secrets, source-control files, exposed diagnostic paths, and suspicious WordPress or PHP targets. AI crawler blocking is optional because crawler access is a policy decision rather than automatic evidence of an attack.

Verify and recover

sudo fail2ban-client -t
sudo fail2ban-client status
sudo fail2ban-client status sshd
sudo journalctl -u fail2ban --since today

If the deployment is unsuitable, preview and restore the installer-created backup with --restore-backup --dry-run, then repeat without --dry-run. The repository includes configuration examples, a support matrix, test fixtures, packaging checks, and an MIT license.