Deploy fail2ban with firewalld on CentOS 7

The login info shows that there were 6 failed login attempts since the last successful login, which is quite weird. So I want to deploy fail2ban on the server. I found some new problems and here is the solution.

 

PART I. System Information

System: CentOS 7.7 (Minimal)

User: root

 

PART II. Install

1. Install epel repo

[root@myserver ~]# yum install -y epel-release

2. Install firewalld

Usually firewalld is installed as default on CentOS 7+.

[root@myserver ~]# yum install -y firewalld

3. Install fail2ban

[root@myserver ~]# yum install -y fail2ban fail2ban-systemd

Well, fail2ban-systemd is not a dependency.

 

PART III. Configuration

1. sshd

You can find all the files for configuring fail2ban in /etc/fail2ban/. It is recommanded to create a new file for setting a new rule in /etc/fail2ban/jail.d/ instead of editing /etc/fail2ban/jail.conf. In this case, create file /etc/fail2ban/jail.d/sshd.local as below:

[sshd]
enabled = true
port = ssh                               # find the port of ssh automatically
ignoreip = 127.0.0.1/8,192.168.1.1/24    # use ',' to split ip addresses
#action = firewallcmd-ipset              # set here or modify jail.conf:banaction
logpath = %(sshd_log)s                   # '/var/log/secure' on CentOS 7
maxretry