Linux | Install Fail2ban on Ubuntu 24.04 Server

Fail2ban is an automated intrusion prevention framework designed to defend Linux servers against brute-force attacks, dictionary attacks, and unauthorized access attempts.

• Log Parsing Engine: Continuously monitors log files (such as /var/log/auth.log, /var/log/syslog, or systemd journald) for patterns matching failed authentication attempts using regular expressions (Regex filters).

• Jail Infrastructure: Combines a specific filter (what to look for in logs) with an action (how to block the attacker). Each service (SSH, Nginx, FTP, Postfix) runs inside its own isolated jail.

• Firewall Abstraction Layer: Interacts dynamically with local firewalls to apply temporary or permanent IP bans via multiple backends (iptables, nftables, ufw, or firewalld).

• Automated Notification System: Can be configured via sendmail or mailx to dispatch immediate email notifications—including WHOIS lookups and relevant log excerpts—whenever an IP is banned.

Prerequisites

To get started with this guide, make sure you have:

• An Ubuntu 24.04 server
• A non-root user with administrator privileges

Installing Fail2ban and UFW (Uncomplicated Firewall)

Fail2ban is an IPS (Intrusion Prevention Software) that protects servers against brute-force attacks. It is available by default on most Linux repositories and supports multiple firewall backends. In this section, you'll install Fail2ban and then set up UFW (Uncomplicated Firewall) which will be used as the firewall backend for the Fail2ban.

First, run the command below to update your Ubuntu package index.

sudo apt update

Now install the 'fail2ban' and 'ufw' packages with the following 'apt' command. Input 'Y' to confirm the installation.

sudo apt install fail2ban ufw

After the installation is complete, run the command below to open the port for SSH and enable UFW. Input 'Y' to confirm, start, and enable UFW.

sudo ufw allow OpenSSH
sudo ufw enable

Once UFW is enabled, you'll see an output 'Firewall is active and enabled on system startup'.

Next, run the following command to check the UFW status. You'll see the UFW is 'active' with the 'OpenSSH' enabled.

sudo ufw status

Lastly, run the 'systemctl' command below to start, enable, and verify the 'fail2ban' service.

sudo systemctl enable --now fail2ban
sudo systemctl status fail2ban

You can see below the 'fail2ban' is active (running) and enabled.

Configuring Fail2ban

After installing fail2ban, you must configure it before the Fail2ban takes an action (checking and blocking). In this section, you'll modify the fail2ban configuration '/etc/fail2ban/jail.local', set up the global configuration for 'bantime', 'maxretry', and 'findtime', setup default action and UFW firewall backend, and then enable the 'sshd' jail for protecting SSH service from brute force attacks.

To start, copy the default fail2ban configuration to '/etc/fail2ban/jail.local' with the following:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Open the file '/etc/fail2ban/jail.local' with the following 'nano' editor command.

sudo nano /etc/fail2ban/jail.local

Add your local network to the 'ignoreip' option. Any subnet within this option will not be blocked by fail2ban.

ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 192.168.10.20

Adjust the default configuration for 'bantime' (the time of IP address will be banned), 'findtime' (the duration between the number of failures before the ban action), and 'maxretry' (the number of failures for IP addresses to get banned). In this example, you'll set up the 'bantime' to '1 hour', the 'findtime' to '10 minutes', with the 'maxretry' to '5 times'.

bantime = 1h
findtime = 10m
maxretry = 5

Optionally, change the default 'action' to '%(action_mw)s' to ban IP addresses and send notification to the administrator via email. Also, make sure to change the 'destmail' and 'sender' options.

action = %(action_mw)s
destemail = admin@howtoforge.local
sender = root@howtoforge.local

Change the default 'banaction' to 'ufw'. With this, IP addresses will be banned by fail2ban via UFW.

banaction = ufw

Now change the default jail for 'sshd' with the configuration below. In this example, the 'sshd' jail will have custom settings for 'bantime', 'maxretry', and the 'findtime'.

[sshd]
enabled = true
maxretry = 3
findtime = 15m
bantime = 3h

port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

Save and exit the file when finished.

Lastly, run the 'systemctl' command below to restart the 'fail2ban' service and apply your changes.

sudo systemctl restart fail2ban

Checking fail2ban rules using fail2ban-client

At this point, the Fail2ban service is up and running with the 'sshd' jail enabled. Now you'll learn the basic command of 'fail2ban-client' for checking and managing Fail2ban installation.

To ensure that fail2ban is running, run the 'fail2ban-client' command below.

sudo fail2ban-client ping

If fail2ban is running, you'll see an output 'PONG'.

Now check the status of the 'sshd' jail with the following command. This will show you the list of detected and banned IP addresses for the 'sshd' jail.

sudo fail2ban-client status sshd

Next, run the 'fail2ban-client get' command below to check the specific rules of your fail2ban jail. In this section, you'll check the 'bantime', 'maxretry', 'actions', 'findtime', and 'ignoreip' from the 'sshd' jail.

sudo fail2ban-client get sshd bantime
sudo fail2ban-client get sshd maxretry
sudo fail2ban-client get sshd actions
sudo fail2ban-client get sshd findtime
sudo fail2ban-client get sshd ignoreip

How to Ban and Unban IP address with fail2ban-client

It's important to know how to ban or unban IP addresses manually using 'fail2ban-client'. With this, you can easily remove your IP address from the banned list. You'll be utilizing the 'fail2ban-client' command to ban and unban IP addresses on Fail2ban.

To ban IP addresses manually via fail2ban, run the 'fail2ban-client' command below. In this case, the banned IP address goes to the 'sshd' jail.

sudo fail2ban-client set sshd banip IP-ADDRESS

Now run the following command to unban the IP address from the fail2ban 'sshd' jail.

Sudo fail2ban-client set sshd unbanip IP-ADDRESS

Lastly, you can check the 'sshd' jail status using the command below. You'll see the IP address has been removed.

sudo fail2ban-client status sshd

Conclusion

You've successfully installed Fail2ban on Ubuntu 24.04, configured its global and jail settings, and learned how to use fail2ban-client to monitor status, check configurations, and manually ban or unban IP addresses.

Linux | Install Graylog on Ubuntu 24.04

Graylog operates as a centralized log management (CLM) engine that ingests, indexes, and analyzes machine data in real time. Built on Java, it relies on a multi-tiered architecture to handle high-throughput log processing:

• Graylog Server (Java Engine): Handles incoming log inputs (Syslog, GELF, Beats, Kafka, HTTP), parses structured/unstructured data using extractors and pipelines, and manages alert triggers.

• OpenSearch / Elasticsearch: Acts as the search and analytics engine. It indexes the log data to enable fast, real-time search queries, visual dashboards, and aggregate metrics.

• MongoDB: Serves as the configuration database. It stores system metadata, user credentials, stream definitions, alert rules, and dashboard configurations (it does not store raw log data).

This tutorial covers how to install the Graylog open-source log-management platform on Ubuntu 24.04 alongside its core dependencies, MongoDB and Elasticsearch, for centralized real-time data and log analysis.

Prerequisites

To complete this tutorial, make sure you have the following:

• An Ubuntu 24.04 server with at least 4 or 8 GB of memory
• A non-root user with administrator privileges

Installing MongoDB

To install Graylog, you must have the MongoDB installed first. At this time, Graylog only supports MongoDB v5.x-7.x, and in this section, you'll be installing MongoDB 7.x to your Ubuntu server.

First, run the command below to install some dependencies.

sudo apt install apt-transport-https gnupg2 uuid-runtime pwgen curl dirmngr -y

Now add the MongoDB GPG key and repository with the following command. In this example, you'll be using MongoDB 7.0 for the previous Ubuntu version.

curl -fsSL <https://www.mongodb.org/static/pgp/server-7.0.asc> | \
sudo gpg -o /usr/share/keyrings/mongodb-server-7.0.gpg \
--dearmor

echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg ] https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/7.0 multiverse" | \
sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list

Once the repository is added, run the 'apt' command below to update your Ubuntu package index and install MongoDB to your system.

sudo apt update && sudo apt install mongodb-org

Enter 'Y' to confirm the installation.

After the installation is complete, start and enable the 'mongod' service with the command below.

sudo systemctl enable --now mongod

Lastly, verify the 'mongod' service to ensure that the service is running. You should see MongoDB is running on your system.

sudo systemctl status mongod

Installing Elasticsearch

After you've installed MongoDB, you need to install Elasticsearch. And before that, you must install Java OpenJDK first, and then install Elasticsearch. As for now, the Graylog server only supports Elasticsearch v7.x.

To install Java OpenJDK, run the 'apt' command below. Enter 'Y' to proceed with the installation.

sudo apt install openjdk-11-jre-headless

Now check the Java version with the following. You should see that Java OpenJDK 11 has been installed.

java --version

After Java is installed, you're ready to install Elasticsearch.

Run the command below to add the GPG key and repository for Elasticsearch. In this example, you'll be installing Elasticsearch 7.x.

wget -qO - <https://artifacts.elastic.co/GPG-KEY-elasticsearch> | apt-key add -
echo "deb https://artifacts.elastic.co/packages/oss-7.x/apt stable main" | \
sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list

Now run the command below to update your Ubuntu repository and install the 'elasticsearch' package. Input 'Y' to confirm.

sudo apt update && sudo apt install elasticsearch

After the installation, open the Elasticsearch config file '/etc/elasticsearch/elasticsearch.yml' with the 'nano' editor.

sudo nano /etc/elasticsearch/elasticsearch.yml

Change the default 'cluster.name' and set the 'action.auto_create_index' to 'false' like the following:

cluster.name: graylog
action.auto_create_index: false

Save the file and exit the editor.

Now run the 'systemctl' command below to reload the systemd manager, start, and enable the Elasticsearch service.

sudo systemctl daemon-reload
sudo systemctl enable --now elasticsearch

With the Elasticsearch running, you can verify it with the command below.

sudo systemctl status elasticsearch

The following output confirms that Elasticsearch is running.

You can also check Elasticsearch with the 'curl' command below.

curl -X GET http://localhost:9200

If Elasticsearch running, you can see its version number and the cluster name like the following.

Installing Graylog

Now that you've installed MongoDB and Elasticsearch, you're ready to install Graylog on your server. In this section, you'll install Graylog and set up password authentication for your installation.

Download the Graylog repository package using the 'wget' command and install it with the 'dpkg' command like the following:

wget https://packages.graylog2.org/repo/packages/graylog-6.1-repository_latest.deb
sudo dpkg -i graylog-6.1-repository_latest.deb

Now run the 'apt' command below to update your Ubuntu package index and install the 'graylog-server' package. Enter 'Y' to confirm the installation.

sudo apt update && sudo apt install graylog-server

After the installation, you need to generate two passwords, 'password_secret' and 'root_password_sha2', for Graylog.

To generate the 'password_secret', run the command below. Make sure to copy the generated password.

< /dev/urandom tr -dc A-Z-a-z-0-9 | head -c${1:-96};echo;

For the 'root_password_sha2' password, run the following command. Enter your password when prompted and copy the generated sha password.

echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1

Now that you've generated Graylog passwords, you'll modify Graylog configuration file.

Open the file '/etc/graylog/server/server.conf' with the following 'nano' editor.

sudo nano /etc/graylog/server/server.conf

Paste your generated password for both 'password_secret' and 'root_password_sha2'. And then, change the default 'http_bind_address' to your local IP address.

password_secret = PoMVlAiuJLA89rNAtLWz0PF7TLwX3JEQD7zp1kfOGAwdr0P-oQ0HKoebpevpPK2Q2quvjmqHQreP1yQYTX0jDjIe3JcBU5J
root_password_sha2 = a7fdfe53e2a13cb602def10146388c65051c67e60ee55c051668a1c709449111
http_bind_address = 192.168.10.60:9000

Save the file and exit the editor.

Next, run the following 'systemctl' command to reload the systemd manager, start and enable the 'graylog-server' service.

sudo systemctl daemon-reload
sudo systemctl enable --now graylog-server

Lastly, check the 'graylog-server' status using the command. If your installation is successful, you'll see Graylog is running on your Ubuntu server.

sudo systemctl status graylog-server

Configuring Graylog

At this point, Graylog is running on your Ubuntu server. Now you'll configure Graylog through a web browser.

Before accessing Graylog, check the log file '/var/log/graylog-server/server.log' with the command below. Copy the link for configuring your Graylog installation and paste it into your browser.

cat /var/log/graylog-server/server.log

Now you'll see the Graylog initial setup page. Here, you'll configure SSL certificates for Graylog data-node like the following:

• Enter your organization's name
  Enter certificate expiration days
  Skip the certificate data-node provision

Once finished, click the 'Resume startup' to continue.

Now you'll be redirected to the Graylog login page. Enter the default user 'admin' with the password within the 'root_password_sha2' option.

If you have the correct username and password, you'll get the Graylog dashboard like the following:

Conclusion

You've successfully installed Graylog on Ubuntu 24.04 alongside MongoDB 7.x and Elasticsearch 7.x, and the server is ready to receive logs through new inputs.

Linux | Install Joomla with Nginx on Ubuntu 24.04 Server

This guide explains how to install and secure the Joomla open-source CMS on an Ubuntu 24.04 server using a LEMP stack (Nginx, MariaDB, and PHP-FPM) with HTTPS encryption.

Prerequisites

To complete this guide, make sure you have the following:

• An Ubuntu 24.04 server.
• A non-root user with administrator privileges.
• A domain name pointed to a server IP address.

Installing dependencies

Joomla is a PHP-based content management system. To install it, you must install PHP on your system. In this section, you'll be installing the LEMP Stack (Linux, Nginx, MariaDB, and PHP-FPM) as dependencies for Joomla.First, run the command below to update your Ubuntu package index.

sudo apt update

Install the LEMP Stack dependencies with the command below. Enter 'Y' to confirm the installation.

sudo apt install nginx mariadb-server php-fpm php-curl php-common php-json php-intl php-xml php-gd php-mysql php-imagick php-mbstring php-zip

After the installation is completed, check the Nginx service status with the following:

sudo systemctl is-enabled nginx
sudo systemctl status nginx

You can see Nginx service is running.

Now check the MariaDB service to ensure that the service is running and enabled with the command below:

sudo systemctl is-enabled mariadb
sudo systemctl status mariadb

Lastly, run the following command to verify the PHP-FPM service. The PHP-FPM should be running by default on the sock file.

sudo systemctl is-enabled php8.3-fpm
sudo systemctl status php8.3-fpm

Configuring PHP-FPM

Now that the LEMP Stack is installed, you'll configure PHP-FPM installation and change some default configurations as needed for Joomla.

Open the PHP-FPM configuration '/etc/php/8.3/fpm/php.ini' with the 'nano' editor.

sudo nano /etc/php/8.3/fpm/php.ini

Change the default configuration with the following:

memory_limit=512M
upload_max_filesize=64M
post_max_size=64M
max_execution_time=120
output_buffering = Off
extension=intl

Save the file and exit the editor.

Now restart the PHP-FPM service to apply your changes.

sudo systemctl restart php8.3-fpm

Lastly, you can check the PHP sock file for the PHP-FPM service with the command below.

ss -pl | grep php

You can see below the sock file for PHP-FPM is located at the '/var/run/php/php8.3-fpm.sock'.

Configuring MariaDB server

In this section, you'll secure the MariaDB server installation, and then create a new database and user for Joomla. You'll be using the 'mariadb-secure-installation' to secure the MariaDB server, and then through the 'mariadb' client to create a new database and user.

To secure the MariaDB server, run the 'mariab-secure-installation' command below.

sudo mariadb-secure-installation

Now you'll be asked to set up the MariaDB server with the following:

• For the default MariaDB server installation without a root password, press ENTER when asked about the password.
• The local authentication for MariaDB root users is secured by default, input 'n' when asked to change the authentication method to 'unix_socket'.
• Input 'Y' to create a new MariaDB root password. Then, input the strong password for your MariaDB root user and repeat.
• When asked to disable remote authentication for the MariaDB root user, input 'Y' to agree.
• The default MariaDB server installation comes with the database 'test' and allows an anonymous user to access it.
• Input 'Y' for both settings to remove the default database 'test' and remove the anonymous privilege.
• Lastly, input 'Y' to confirm reloading table privileges.

Once the MariaDB is secured, you'll create a new database and user for Joomla.

Log in to the MariaDB server with the 'mariadb' command below. Enter your MariaDB root password when prompted.

sudo mariadb -u root -p

Now run the following queries to create a new database 'joomladb', and a new user 'joomla' with the password 'p4ssword'.

CREATE DATABASE joomladb;
CREATE USER joomla@localhost IDENTIFIED BY 'p4ssword';
GRANT ALL PRIVILEGES ON joomladb.* TO joomla@localhost;
FLUSH PRIVILEGES;

Next, run the query below to check privileges for user 'joomla'. You'll see the 'joomla' user can access the database 'joomladb'.

SHOW GRANTS FOR joomla@localhost;

Lastly, type 'quit' to exit from the MariaDB server.

Downloading Joomla source code

At this point, you've installed and configured dependencies for Joomla. Now you'll download the Joomla source code and set up the document-root/webroot directory for Joomla installation.

Go to the '/var/www' directory and download the Joomla source code with the 'wget' command below. Check the Joomla download page and grab the link for the latest version.

cd /var/www/
wget https://downloads.joomla.org/cms/joomla5/5-1-4/Joomla_5-1-4-Stable-Full_Package.zip

Now run the 'unzip' command below to extract the Joomla source code to the 'joomla' directory.

unzip Joomla_5-1-4-Stable-Full_Package.zip -d joomla

Lastly, run the 'chmod' command below to change the ownership of the '/var/www/joomla' directory to the user 'www-data'.

sudo chown -R www-data:www-data /var/www/joomla

Setting up Nginx server block

Now you'll be creating a new Nginx server block configuration for running Joomla. So make sure that you've your domain name ready and pointed to the server IP address.

Create a new Nginx server file '/etc/nginx/sites-available/joomla' with the following 'nano' editor.

sudo nano /etc/nginx/sites-available/joomla

Insert the configuration below and change the 'server_name' option with your domain name.

server {
listen 80;
server_name howtoforge.local;
server_name_in_redirect off;

access_log /var/log/nginx/localhost.access_log;
error_log /var/log/nginx/localhost.error_log info;

root /var/www/joomla;
index index.php index.html index.htm default.html default.htm;

# Support API
location /api/ {
try_files $uri $uri/ /api/index.php?$args;
}

# Support Clean (aka Search Engine Friendly) URLs
location / {
try_files $uri $uri/ /index.php?$args;
}

# add global x-content-type-options header
add_header X-Content-Type-Options nosniff;

# deny running scripts inside writable directories
location ~* /(images|cache|media|logs|tmp)/.*\.(php|pl|py|jsp|asp|sh|cgi)$ {
return 403;
error_page 403 /403_error.html;
}

location ~ \.php$ {
fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include /etc/nginx/fastcgi.conf;
}

# caching of files
location ~* \.(ico|pdf|flv)$ {
expires 1y;
}

location ~* \.(js|css|png|jpg|jpeg|gif|swf|xml|txt)$ {
expires 14d;
}

}

Save the file and exit the editor.

Now run the command below to activate the 'joomla' server block and verify your Nginx configuration. If you've proper Nginx settings, you'll see an output 'Syntax is OK'.

sudo ln -s /etc/nginx/sites-available/joomla /etc/nginx/sites-enabled/
sudo nginx -t

Lastly, run the 'systemctl' command below to restart the Nginx service and apply your changes.

sudo systemctl restart nginx

Securing Joomla with HTTPS

In this guide, you'll secure Joomla with HTTPS. If you're using the public domain, you can secure Joomla through SSL/TLS certificates via Certbot and Letsencerypt.

Install 'Certbot' and the Certbot Nginx plugin with the 'apt' command below. Input 'Y' to confirm the installation.

sudo apt install certbot python3-certbot-nginx

After the installation is complete, run the following 'certbot' command to generate SSL/TLS certificates and secure your Joomla installation with HTTPS. Make sure to change the domain name and email address with your information.

sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email kyrie@howtoforge.local -d howtoforge.local

When finished, your Joomla installation is secured with HTTPS through SSL/TLS certificates from Letsencrypt.

Installing Joomla

Open your web browser and visit your Joomla domain name such as https://howtoforge.local/. You'll see the Joomla installation wizard.

Select your default language and enter your site name.

Enter the new admin user, email, and password for Joomla.

Enter details of your MariaDB database and user, then click 'Install Joomla' to proceed with the installation.

After the installation is complete, click the 'Open Site' to open the default homepage, or 'Open Administrator' to access the Joomla administration dashboard.

For the default Joomla homepage, you'll see the following.

Now enter your admin user and password and click 'Login'.

If you've the correct user and password, you'll see the following Joomla administration dashboard.

Conclusion

You've successfully installed Joomla on Ubuntu 24.04 using Nginx, MariaDB, and PHP-FPM, and secured your site with free HTTPS via Certbot and Let's Encrypt.