Protect your server with Fail2ban (CentOS)

Problem

Install Fail2ban on CentOS.

tl;dr

rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
yum install fail2ban
service fail2ban start
chkconfig fail2ban on

Solution

Fail2ban is a security service for Linux that logs potential hacking/discovery attempts to your machine and bans suspicious originating IPs. By default, it bans IPs that attempt to guess or brute force your passwords (cutoff is set to 5 tries), port scans, numerous handshake requests, etc. However, it can also be configured to take other actions, such as send an email warning. It is recommended to run Fail2ban, or a similar service, on any unsecured servers exposed to the Internet.

Installation

Fail2ban is available for CentOS via the EPEL repository. This guide assumes you have CentOS 6. If you have releases 5 or 7, you can refer to my other guide to install EPEL repository on CentOS. Download the repository first:

rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

Afterward, install Fail2ban:

yum install fail2ban

Start the Fail2ban service

Fail2ban needs to be turned on before it has any effect:

service fail2ban start

Set it to auto-start after a reboot:

chkconfig fail2ban on

Make sure it works (optional)

You can also check if Fail2ban works by attempting to SSH into your server using incorrect credentials.
WARNING: Do NOT do this from the IP you use to SSH, or you will lose the ability connect to and manage your server!

[root@opencompute ~]# ssh root@1.2.3.4
root@1.2.3.4's password:

Try entering a wrong password several times (you may have to do a second SSH attempt), and you will see:

[root@ess001010 ~]# ssh root@1.2.3.4
ssh: connect to host 1.2.3.4 port 22: Connection refused

Congratulations. Your server is now secure against brute force attacks and attempts to probe your server, such as port scans.