Security on Panic! At The Terminal

Fail2ban SSH Protection on RHEL9: Installation and Configuration Guide

Mon, 28 Jul 2025 00:00:00 +0000

Fail2ban SSH Protection on RHEL9: Installation and Configuration Guide #

Fail2ban is an essential security tool that helps protect your Linux server from brute force attacks and automated bot spam targeting SSH and other services. By monitoring log files and automatically banning IP addresses that show signs of malicious activity, fail2ban acts as an intrusion prevention system that significantly enhances your server’s security posture.

Installation #

# Install fail2ban and firewalld integration
dnf install fail2ban fail2ban-firewalld

# Enable and start the service
systemctl enable fail2ban --now

Basic Configuration #

1. Create Local Configuration Files #

Never edit the default configuration files directly. Instead, create local copies that won’t be overwritten during updates:

SELinux Troubleshooting

Wed, 23 Jul 2025 10:00:00 +0200

SELinux Troubleshooting #

Here’s a little guide on how to find if SELinux is blocking something and how to add an exception to the policy.

SELinux Modes #

SELinux operates in three modes:

# Check SELinux status and mode
sestatus

Understanding the Three Modes #

Enforcing: SELinux policy is enforced
Permissive: SELinux policy violations are logged but not blocked
Disabled: SELinux is completely disabled

Check if SELinux is the problem #

# Temporarily set to permissive mode and test
setenforce 0
# Test your application
# If it works now, SELinux was blocking it
setenforce 1

Troubleshooting Workflow #

When an application fails and you are certain that SELinux is blocking it, e.g. you turned SELinux off or into permissive mode and the application worked, you can do the following:

SSH Hardening and Automation User Setup with Ansible

Sat, 12 Jul 2025 12:00:00 +0300

SSH Hardening and Automation User Setup with Ansible #

Here’s a little post about how I do SSH hardening for my RHEL9 homelab and how I ensure that the Ansible automation user is properly set. The playbook stems from an incident I had in Red Hat Insights where it was reported that I had an SSH configuration that allowed legacy ciphers. It was also adviced to create a crypto policy that disables weak algorithms.