Detection of Unauthorized Access on Linux & Blocked by Fail2Ban
Real-Time Detection and Automated Response Workflow for Unauthorized Access Attempts on Linux Using Fail2Ban
Overview
Simulate unauthorized SSH access attempts against a Linux host and build a complete detection → investigation → automated response workflow using Fail2Ban.
You will generate failed and successful SSH login attempts from attacker sources, monitor authentication logs in real time, configure Fail2Ban detection rules and jails, and automatically block malicious IP addresses using firewall policies (UFW/iptables). The project validates the effectiveness of automated host-level intrusion prevention and demonstrates alerting and real-time response actions.
Key outcomes:
Generate realistic SSH login activity including brute-force and unauthorized access attempts.
Parse and monitor auth.log to identify repeated failed logins and suspicious authentication patterns.
Configure Fail2Ban filters, jails, and ban policies to detect and automatically block attacker IPs.
Validate real-time automated response by confirming firewall rule creation (UFW/iptables).
Measure security effectiveness through before/after access behavior and log evidence.
What You'll Learn
-
Simulating Unauthorized SSH Access
Learn how to generate realistic failed and successful SSH login attempts from attacker sources.
-
Real-Time Log Monitoring (auth.log)
Understand how to observe authentication logs, detect suspicious login patterns, and interpret brute-force attempts.
-
Fail2Ban Detection Rules & Jails
See how custom filters and jails are created to detect repeated failures and enforce automated blocking.
Prerequisites
- Linux machine (Ubuntu recommended) with SSH enabled
- Basic familiarity with SSH commands and authentication
- Ability to view and read Linux log files (/var/log/auth.log)
- Fail2Ban installed or ready to install
- Basic understanding of UFW or iptables firewall rules
About Trainer
Rajneesh Gupta
Rajneesh Gupta is a seasoned cybersecurity professional with over 11 years of industry experience. With a remarkable career focused on incident response, penetration testing, security compliance, and risk management, Rajneesh has established himself as a leading expert in the field. He is also an accomplished author, having penned the book "Hands-on with Blockchain and Cybersecurity". As a dedicated educator, Rajneesh has made a significant impact on the cybersecurity community by training over 60,000 students globally.
Related Projects
Apache Server Log Analysis using Splunk
Detecting Brute Force, SQL Injection, XSS, and Suspicious Web Activity from Apache Access Logs with Splunk SIEM
Practical AWS Cloud Security Posture Assessment Using Scout Suite
Identify real-world AWS attack surfaces through visual security posture analysis.
Wazuh + n8n + Anyrun: Automated Malware Analysis
Automate malware analysis by sending Wazuh-detected suspicious files into ANY.RUN, retrieving detailed reports and IOCs, and integrating results back into your SOC workflow.