Fail2Ban

Overview

Fail2Ban protects SSH from brute-force attacks.

Field	Value
Status	Active
Jails	1 (sshd)
bantime	10 minutes
findtime	10 minutes
maxretry	5 attempts
banaction	iptables-multiport

Configuration

• Config: /etc/fail2ban/jail.conf (uses paths-debian.conf)
• Only the sshd jail is enabled
• Default ban time is 10 minutes
• Uses iptables backend for ban enforcement

Recent Activity

The following auth failures were observed in recent logs:

• Brute-force attempts from 212.0.217.14 targeting root and admin accounts (3 failed attempts)
• Multiple kex_exchange_identification: Connection reset by peer errors from various IPs (likely network issues or scanning)

Recommendations

1. Consider increasing bantime from 10 minutes to 1 hour or more
2. Consider adding nftables-compatible ban action (current iptables works via UFW/nft)
3. Monitor logs for recurring IPs