TUBES KSI VIDEO FIX

Main topic

A tutorial showing how to set up Fail2Ban (Fail2Ban) to protect SSH by automatically banning IP addresses that fail login attempts too many times.

Tech steps / configuration (Fail2Ban + SSH)

1. Install Fail2Ban

   • Use a terminal with root/superuser privileges (e.g., sudo su).
   • Install Fail2Ban via an apt install command.
   • Wait for the installation to complete.

2. Edit Fail2Ban configuration

   • Navigate to Fail2Ban’s configuration directory on the server (described as moving to a saved /etc/fail2ban-type path).
   • Use jail.d / jail-style configuration, specifically for SSH.

3. Create or edit SSH jail rules

   • Create an SSH-specific configuration file using nano (e.g., nano sshd.conf or nano sshd.local).

   • Key parameters:

     • enabled = true: enables the jail/ruleset.
     • port = SSH: targets the SSH service/port.
     • filter = sshd: uses the SSH filter to detect failed/threatening attempts.

     • logpath = /var/log/...: sets the SSH log location where Fail2Ban reads events (the subtitle implies a path similar to /.../log/.../sshd.log).

     • maxretry = 3: bans the IP after 3 failed attempts.

     • findtime = 1h: the counting window for failures (within 1 hour).
     • bantime = 1h: how long the IP remains banned (1 hour).

4. Start/verify Fail2Ban services

   • Start Fail2Ban (shown as service fail2ban start).
   • Check status with service fail2ban status.
   • Verify related services are running (the subtitle references systemctl status fail2ban-style checks).

5. Check logs / see banned IPs

   • Inspect Fail2Ban logs (e.g., checking .../fail2ban.log).
   • Monitor activity using tail on the relevant log.

Test procedure (confirm banning behavior)

• From a Windows terminal, repeatedly attempt SSH to the target IP using an incorrect password.
• Observed behavior:
  • After the first failed attempt: a failed login message appears.
  • After the second failed attempt: another failure is shown.
  • After the third failed attempt:
    • Fail2Ban logs the IP.
    • The IP becomes banned (further attempts are blocked and won’t reach the normal login prompt).

Unbanning / removing the ban

• Unban an IP using a Fail2Ban unban command (subtitle resembles):
  • fail2ban-client set <jail> unbanip <IP>
• After unbanning:
  • Confirm the IP is removed from the ban list.
  • Retry SSH login successfully.

Reviews / guides / tutorials

This is a hands-on tutorial/guide covering:

• installation
• configuration
• service verification
• testing the banning behavior
• unbanning workflow for Fail2Ban SSH protection

Main speakers or sources (from subtitles)

• Primary source/speaker: the video’s single instructor (no other distinct speakers named).
• Software sources being used/configured: Fail2Ban and SSH/sshd (via the sshd filter and the configured SSH log path).