Linux | Install Fail2ban on Ubuntu 24.04 Server

Fail2ban is an automated intrusion prevention framework designed to defend Linux servers against brute-force attacks, dictionary attacks, and unauthorized access attempts.

• Log Parsing Engine: Continuously monitors log files (such as /var/log/auth.log, /var/log/syslog, or systemd journald) for patterns matching failed authentication attempts using regular expressions (Regex filters).

• Jail Infrastructure: Combines a specific filter (what to look for in logs) with an action (how to block the attacker). Each service (SSH, Nginx, FTP, Postfix) runs inside its own isolated jail.

• Firewall Abstraction Layer: Interacts dynamically with local firewalls to apply temporary or permanent IP bans via multiple backends (iptables, nftables, ufw, or firewalld).

• Automated Notification System: Can be configured via sendmail or mailx to dispatch immediate email notifications—including WHOIS lookups and relevant log excerpts—whenever an IP is banned.

Prerequisites

To get started with this guide, make sure you have:

• An Ubuntu 24.04 server
• A non-root user with administrator privileges

Installing Fail2ban and UFW (Uncomplicated Firewall)

Fail2ban is an IPS (Intrusion Prevention Software) that protects servers against brute-force attacks. It is available by default on most Linux repositories and supports multiple firewall backends. In this section, you'll install Fail2ban and then set up UFW (Uncomplicated Firewall) which will be used as the firewall backend for the Fail2ban.

First, run the command below to update your Ubuntu package index.

sudo apt update

Now install the 'fail2ban' and 'ufw' packages with the following 'apt' command. Input 'Y' to confirm the installation.

sudo apt install fail2ban ufw

After the installation is complete, run the command below to open the port for SSH and enable UFW. Input 'Y' to confirm, start, and enable UFW.

sudo ufw allow OpenSSH
sudo ufw enable

Once UFW is enabled, you'll see an output 'Firewall is active and enabled on system startup'.

Next, run the following command to check the UFW status. You'll see the UFW is 'active' with the 'OpenSSH' enabled.

sudo ufw status

Lastly, run the 'systemctl' command below to start, enable, and verify the 'fail2ban' service.

sudo systemctl enable --now fail2ban
sudo systemctl status fail2ban

You can see below the 'fail2ban' is active (running) and enabled.

Configuring Fail2ban

After installing fail2ban, you must configure it before the Fail2ban takes an action (checking and blocking). In this section, you'll modify the fail2ban configuration '/etc/fail2ban/jail.local', set up the global configuration for 'bantime', 'maxretry', and 'findtime', setup default action and UFW firewall backend, and then enable the 'sshd' jail for protecting SSH service from brute force attacks.

To start, copy the default fail2ban configuration to '/etc/fail2ban/jail.local' with the following:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Open the file '/etc/fail2ban/jail.local' with the following 'nano' editor command.

sudo nano /etc/fail2ban/jail.local

Add your local network to the 'ignoreip' option. Any subnet within this option will not be blocked by fail2ban.

ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 192.168.10.20

Adjust the default configuration for 'bantime' (the time of IP address will be banned), 'findtime' (the duration between the number of failures before the ban action), and 'maxretry' (the number of failures for IP addresses to get banned). In this example, you'll set up the 'bantime' to '1 hour', the 'findtime' to '10 minutes', with the 'maxretry' to '5 times'.

bantime = 1h
findtime = 10m
maxretry = 5

Optionally, change the default 'action' to '%(action_mw)s' to ban IP addresses and send notification to the administrator via email. Also, make sure to change the 'destmail' and 'sender' options.

action = %(action_mw)s
destemail = admin@howtoforge.local
sender = root@howtoforge.local

Change the default 'banaction' to 'ufw'. With this, IP addresses will be banned by fail2ban via UFW.

banaction = ufw

Now change the default jail for 'sshd' with the configuration below. In this example, the 'sshd' jail will have custom settings for 'bantime', 'maxretry', and the 'findtime'.

[sshd]
enabled = true
maxretry = 3
findtime = 15m
bantime = 3h

port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

Save and exit the file when finished.

Lastly, run the 'systemctl' command below to restart the 'fail2ban' service and apply your changes.

sudo systemctl restart fail2ban

Checking fail2ban rules using fail2ban-client

At this point, the Fail2ban service is up and running with the 'sshd' jail enabled. Now you'll learn the basic command of 'fail2ban-client' for checking and managing Fail2ban installation.

To ensure that fail2ban is running, run the 'fail2ban-client' command below.

sudo fail2ban-client ping

If fail2ban is running, you'll see an output 'PONG'.

Now check the status of the 'sshd' jail with the following command. This will show you the list of detected and banned IP addresses for the 'sshd' jail.

sudo fail2ban-client status sshd

Next, run the 'fail2ban-client get' command below to check the specific rules of your fail2ban jail. In this section, you'll check the 'bantime', 'maxretry', 'actions', 'findtime', and 'ignoreip' from the 'sshd' jail.

sudo fail2ban-client get sshd bantime
sudo fail2ban-client get sshd maxretry
sudo fail2ban-client get sshd actions
sudo fail2ban-client get sshd findtime
sudo fail2ban-client get sshd ignoreip

How to Ban and Unban IP address with fail2ban-client

It's important to know how to ban or unban IP addresses manually using 'fail2ban-client'. With this, you can easily remove your IP address from the banned list. You'll be utilizing the 'fail2ban-client' command to ban and unban IP addresses on Fail2ban.

To ban IP addresses manually via fail2ban, run the 'fail2ban-client' command below. In this case, the banned IP address goes to the 'sshd' jail.

sudo fail2ban-client set sshd banip IP-ADDRESS

Now run the following command to unban the IP address from the fail2ban 'sshd' jail.

Sudo fail2ban-client set sshd unbanip IP-ADDRESS

Lastly, you can check the 'sshd' jail status using the command below. You'll see the IP address has been removed.

sudo fail2ban-client status sshd

Conclusion

You've successfully installed Fail2ban on Ubuntu 24.04, configured its global and jail settings, and learned how to use fail2ban-client to monitor status, check configurations, and manually ban or unban IP addresses.

Linux | Install Graylog on Ubuntu 24.04

Graylog operates as a centralized log management (CLM) engine that ingests, indexes, and analyzes machine data in real time. Built on Java, it relies on a multi-tiered architecture to handle high-throughput log processing:

• Graylog Server (Java Engine): Handles incoming log inputs (Syslog, GELF, Beats, Kafka, HTTP), parses structured/unstructured data using extractors and pipelines, and manages alert triggers.

• OpenSearch / Elasticsearch: Acts as the search and analytics engine. It indexes the log data to enable fast, real-time search queries, visual dashboards, and aggregate metrics.

• MongoDB: Serves as the configuration database. It stores system metadata, user credentials, stream definitions, alert rules, and dashboard configurations (it does not store raw log data).

This tutorial covers how to install the Graylog open-source log-management platform on Ubuntu 24.04 alongside its core dependencies, MongoDB and Elasticsearch, for centralized real-time data and log analysis.

Prerequisites

To complete this tutorial, make sure you have the following:

• An Ubuntu 24.04 server with at least 4 or 8 GB of memory
• A non-root user with administrator privileges

Installing MongoDB

To install Graylog, you must have the MongoDB installed first. At this time, Graylog only supports MongoDB v5.x-7.x, and in this section, you'll be installing MongoDB 7.x to your Ubuntu server.

First, run the command below to install some dependencies.

sudo apt install apt-transport-https gnupg2 uuid-runtime pwgen curl dirmngr -y

Now add the MongoDB GPG key and repository with the following command. In this example, you'll be using MongoDB 7.0 for the previous Ubuntu version.

curl -fsSL <https://www.mongodb.org/static/pgp/server-7.0.asc> | \
sudo gpg -o /usr/share/keyrings/mongodb-server-7.0.gpg \
--dearmor

echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg ] https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/7.0 multiverse" | \
sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list

Once the repository is added, run the 'apt' command below to update your Ubuntu package index and install MongoDB to your system.

sudo apt update && sudo apt install mongodb-org

Enter 'Y' to confirm the installation.

After the installation is complete, start and enable the 'mongod' service with the command below.

sudo systemctl enable --now mongod

Lastly, verify the 'mongod' service to ensure that the service is running. You should see MongoDB is running on your system.

sudo systemctl status mongod

Installing Elasticsearch

After you've installed MongoDB, you need to install Elasticsearch. And before that, you must install Java OpenJDK first, and then install Elasticsearch. As for now, the Graylog server only supports Elasticsearch v7.x.

To install Java OpenJDK, run the 'apt' command below. Enter 'Y' to proceed with the installation.

sudo apt install openjdk-11-jre-headless

Now check the Java version with the following. You should see that Java OpenJDK 11 has been installed.

java --version

After Java is installed, you're ready to install Elasticsearch.

Run the command below to add the GPG key and repository for Elasticsearch. In this example, you'll be installing Elasticsearch 7.x.

wget -qO - <https://artifacts.elastic.co/GPG-KEY-elasticsearch> | apt-key add -
echo "deb https://artifacts.elastic.co/packages/oss-7.x/apt stable main" | \
sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list

Now run the command below to update your Ubuntu repository and install the 'elasticsearch' package. Input 'Y' to confirm.

sudo apt update && sudo apt install elasticsearch

After the installation, open the Elasticsearch config file '/etc/elasticsearch/elasticsearch.yml' with the 'nano' editor.

sudo nano /etc/elasticsearch/elasticsearch.yml

Change the default 'cluster.name' and set the 'action.auto_create_index' to 'false' like the following:

cluster.name: graylog
action.auto_create_index: false

Save the file and exit the editor.

Now run the 'systemctl' command below to reload the systemd manager, start, and enable the Elasticsearch service.

sudo systemctl daemon-reload
sudo systemctl enable --now elasticsearch

With the Elasticsearch running, you can verify it with the command below.

sudo systemctl status elasticsearch

The following output confirms that Elasticsearch is running.

You can also check Elasticsearch with the 'curl' command below.

curl -X GET http://localhost:9200

If Elasticsearch running, you can see its version number and the cluster name like the following.

Installing Graylog

Now that you've installed MongoDB and Elasticsearch, you're ready to install Graylog on your server. In this section, you'll install Graylog and set up password authentication for your installation.

Download the Graylog repository package using the 'wget' command and install it with the 'dpkg' command like the following:

wget https://packages.graylog2.org/repo/packages/graylog-6.1-repository_latest.deb
sudo dpkg -i graylog-6.1-repository_latest.deb

Now run the 'apt' command below to update your Ubuntu package index and install the 'graylog-server' package. Enter 'Y' to confirm the installation.

sudo apt update && sudo apt install graylog-server

After the installation, you need to generate two passwords, 'password_secret' and 'root_password_sha2', for Graylog.

To generate the 'password_secret', run the command below. Make sure to copy the generated password.

< /dev/urandom tr -dc A-Z-a-z-0-9 | head -c${1:-96};echo;

For the 'root_password_sha2' password, run the following command. Enter your password when prompted and copy the generated sha password.

echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1

Now that you've generated Graylog passwords, you'll modify Graylog configuration file.

Open the file '/etc/graylog/server/server.conf' with the following 'nano' editor.

sudo nano /etc/graylog/server/server.conf

Paste your generated password for both 'password_secret' and 'root_password_sha2'. And then, change the default 'http_bind_address' to your local IP address.

password_secret = PoMVlAiuJLA89rNAtLWz0PF7TLwX3JEQD7zp1kfOGAwdr0P-oQ0HKoebpevpPK2Q2quvjmqHQreP1yQYTX0jDjIe3JcBU5J
root_password_sha2 = a7fdfe53e2a13cb602def10146388c65051c67e60ee55c051668a1c709449111
http_bind_address = 192.168.10.60:9000

Save the file and exit the editor.

Next, run the following 'systemctl' command to reload the systemd manager, start and enable the 'graylog-server' service.

sudo systemctl daemon-reload
sudo systemctl enable --now graylog-server

Lastly, check the 'graylog-server' status using the command. If your installation is successful, you'll see Graylog is running on your Ubuntu server.

sudo systemctl status graylog-server

Configuring Graylog

At this point, Graylog is running on your Ubuntu server. Now you'll configure Graylog through a web browser.

Before accessing Graylog, check the log file '/var/log/graylog-server/server.log' with the command below. Copy the link for configuring your Graylog installation and paste it into your browser.

cat /var/log/graylog-server/server.log

Now you'll see the Graylog initial setup page. Here, you'll configure SSL certificates for Graylog data-node like the following:

• Enter your organization's name
  Enter certificate expiration days
  Skip the certificate data-node provision

Once finished, click the 'Resume startup' to continue.

Now you'll be redirected to the Graylog login page. Enter the default user 'admin' with the password within the 'root_password_sha2' option.

If you have the correct username and password, you'll get the Graylog dashboard like the following:

Conclusion

You've successfully installed Graylog on Ubuntu 24.04 alongside MongoDB 7.x and Elasticsearch 7.x, and the server is ready to receive logs through new inputs.