Lion Cipher Lab
Auto-block brute-force attempts with Fail2Ban
- Cyber / Security Engineer
- Beginner
- ~40 min
- Free · no account required
Why it matters
Any server reachable on the internet gets a steady stream of automated login attempts — bots trying common usernames and passwords against SSH and other services, all day, forever. Reading the logs (the previous lab) tells you it's happening; it doesn't stop it. Fail2Ban is the standard, lightweight tool that closes the loop: it watches your auth logs for the failure pattern you learned to recognise, and when a single source crosses a threshold you set, it bans that IP at the firewall for a while. It turns a manual, reactive chore into an automatic control that runs while you sleep. Learning…
What you'll learn
- installing Fail2Ban
- understanding jails, filters, and actions
- configuring jail.local (bantime, findtime, maxretry)
- protecting yourself from self-lockout with ignoreip
- enabling the sshd jail
- checking status and unbanning with fail2ban-client
Steps in this lab
- What Fail2Ban does, and the one safety rule
- Install Fail2Ban
- The three pieces: jails, filters, and actions
- Write jail.local: thresholds and your own IP
- Reload and confirm the jail is active
- Watch a ban happen, and lift it
- Why this small tool matters more than it looks